Comment by dustinmoris | Hacker News Reader

Comment by dustinmoris | Hacker News Reader

> Despite their respective merits, every one of these solutions has a massive shortcoming that severely limits their viability and it's something they simply can't compete with:

> Despite it's many flaws, the one thing that the humble password has going for it over technically superior alternatives is that everyone understands how to use it. Everyone.

This is (mostly) true, however, there is already evidence that new technology could kill the password indeed. What I am talking about is modern phones which all come with a fingerprint scan or facial recognition which, from my own limited experience and my own observations, has mostly killed of the "passcode" on the phone. Yes our phones still make us pick a passcode, but unless forced to use it nobody does anymore. Even my technology incompetent mother uses the fingerprint scan to log into her phone and I don't see why something similar couldn't replace the current experience of her having to type an insecure password into her hotmail all the time.

<insert standard argument against biometrics>

Biometrics is essentially putting a massively complex system in front of your password input, that lets the device read the password off your body, but the consequences are a) you now can't ever change your password, and b) there's this massively complex system in front of (now hidden) password form, and complexity means unreliability and exploitable holes.

The reason it seems to be working in phones and in laptops is just because the protected systems - personal computing devices of random members of general population - are of low importance, so it's unlikely an attacker is going to bother, whereas the convenience benefits are substantial.

It’s also not the complexity that’s the problem.

Even if it’s flawless, which is impossible, with biometrics you can easily be coerced into giving access without effort, whereas we haven’t invented a mind reader yet.

In other words I can easily imagine kids gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-)

I wanted to write about law enforcement agencies, but this is so easy that your kids can do it.

> In other words I can easily imagine kinds gaining access to a credit card via fingerprints or facial recognition, while their parents are sleeping ;-)

Kids, or partners. There even was this funny video making rounds around the Internet couple years back[0].

The point about coercion is good too.

--

[0] - https://www.youtube.com/watch?v=fawPebE75xA

That new HP laptop commercial featuring the fingerprint reader makes me facepalm every time. They advertise it as "reinventing passwords" WHILE ILLUSTRATING EXACTLY HOW INSECURE IT IS.

https://www.youtube.com/watch?v=KTn0r0HPXVg

That's too good to be true :-))

My banking app uses the Iphone fingerprint sensor to fill in your password. From time to time the fingerprint fails a couple of times because my fingers are greasy or whatever and you can manually enter your password.

I fail in operating my Samsung phone's fingerprint scanner roughly once in 20 attemts, but sometimes those failed attempts are in a row and I end up having to type in the password. Since biometrics still require you to know the password as backup, they're not going to replace it.

Fingerprint scan and Facial recognition can not replace password authentication because both face and fingerprint are public information, while password is meant to be private. You cannot hide your face or fingerprint from others.

As a rule of thumb (pun not intended), biometric data is a username, not a password.

Disagree. It is not a password for sure, but not even a username. biometrics are an indentifier.

username/password split an unique/secure identifier in a unique part and a (supposedly) secure part. biometrics are that pair together.

Biometrics are really more equivalent to a user name than they are a password.

Sure, they get used in some applications as a "password" because it's "cool" but it's fair to say biometrics is public information so while many biometric services do their best to avoid being spoofed, they're really more akin to a user name.

I'd also like to point out that fingerprint scanners don't work if you need to use then when you've just gotten out of the bath / been swimming. If something is going to replace passwords then I'd want to be damn sure I can use it 100% of the time I need to (baring when I personally fuck up - eg forgetting my password).

that is how it would be used in high/er security environments but not how it is used in the consumer arena.

I've always been of the opinion that biometrics are much more closely related to a username rather than a password. There will always be ways to either fake or compel biometric scans, and having a second layer of proof required to authenticate and authorize seems like the only responsible thing to do.

Reply on news.ycombinator.com