Hacker News Reader

Comment by diafygi | Hacker News Reader

All the security experts on HN say you should use a passcode instead of a fingerprint for unlocking your phone. However, it seems fairly easy for someone to just watch you over your shoulder input your passcode (i.e. "shoulder surf"), or have it be recorded on increasingly ever-present surveillance cameras (e.g. buses, subways, food courts, etc.).

What about putting buttons along the sides of your phone and using chorded combinations as your passcode? Seems squeezing those buttons would be much harder to observe or record (intentionally or unintentionally).

View on HN

On my Galaxy S9+, I have 4 buttons: power, vol up/down and a stupid useless bixby button. Ignoring how to put it into 'password' mode, each of these buttons is effectively a bit. I assume you need at least 1 key to register an input (otherwise wait for a pause which I won't consider), so you get 15 possibilities. I think you could make a reasonably strong password using 4-8 chords (15^4-15^8 possibilities). Anyways, it's certainly better than those swipe passwords with an effective length of 9 Cr 4 == 128 which are readily seen and copied by nearby people.

Do you mean to say there are 9 choose 4 == 126 possible combinations for a 3x3 pattern? I think this would only be true if you could use a maximum of four dots in the pattern, which isn't the case.

Although calculating it this way will double-count some patterns which include long lines, I would say that there ar far closer to 9! == 362880 passwords. Even if long lines cut that space in half, 150000 more than meets your minimum of 15^4.

You're right. I goofed on my analysis. Instead of chose, it's indeed a factorial. You're also right, you can chose up to 9 dots, so indeed it is up to 9! combinations. Thanks for catching that.

Would be nice if we didn't already have touch id and face id.

https://techsolidarity.org/resources/basic_security.htm

"Don't use your fingerprint to lock/unlock devices."

"Use a long passphrase to lock your devices."

Seems touch id and face id is exactly what security experts tell you not to do.

Yes, I forget how much of this was because of forgeability and how much was because of the ambiguity of digital rights in America. Compelling someone to share a passcode was considered a 5th amendment violation but we collect biological samples all the time with just a warrant so biological locks seemed less safe.

>Basic security precautions for non-profits and journalists in the United States, early 2019.

Those are recommendations for a specific group of highly targeted individuals in specific situations. It's not "basic security", it's "basic security for people who have such damaging information on certain subjects that they may be killed for it".

For the general population, TouchID and FaceID are more secure than the most common alternative (which tends to be no passcode at all) and secure enough that common criminals aren't going to bother with it.

Stopping nation-states from intercepting your data and using it as a flimsy basis for your murder isn't something an average person needs to worry about on a day to day basis.

Reply on news.ycombinator.com