Are long pins and passwords still the most secure way to control access to your phone? Is there U2F for phones as a 2nd factor?
Fingerprint replicas (or your actual fingers) are obtainable by targeted attackers of some sophistication. But if you're targeted by attackers willing to go that length for you, you have other problems. IMO, fingerprints provide the best practical security.
Pin, fingerprint reader (that works) is enough.
Btw, I don't think 'casual attackers' really fits with access to, and willingness to go through cctv.
wow. in what line of business do you work if you don't mind me asking?
;)
IMO a combination of bio-metric and pin/password/phrase would be a good solution.
Consider also a roommate or someone you've recently started seeing. They can very easily unlock your phone by using your finger while you're asleep. They could shoulder-surf as well, but you can be vigilant against that. It's almost impossible to be vigilant against someone grabbing your finger while sleeping
I believe most phones have a way to easily disable fingerprint or face unlock until the next time the pass code is entered.
For example, on recent iPhones, just hold both the power button and one of volume buttons down for a couple seconds, which brings up the screen for power off, medical ID, and emergency SOS. Hit cancel on that screen, and biometrics are disabled until you next enter the pass code.
It should be reasonably possible to be vigilant enough to do that before going to sleep.
Mind you, there are some quite dumb criminals, so "likely probability" besides "how likely am I to get robbed?" likely goes out the window.
If I remember the order correctly: One of the first attacks on finger print readers was to blow on them, making them read the remains on the previous fingerprint used. That was fixed by adding a temperature sensor to the reader, so to attack it you had to use a plastic bag with water at around human temperature. The easy fix was to also check for a pulse while reading the fingerprint, this also make it impossible to use a removed body part.
I have not kept up with the progress in the last years, so not sure how good creating a fake fingerprint that you put on top of your own prints work, like they do in movies. Finding and reproducing a print is not that hard.
As others have written, fingerprint are usernames. It is not secret and you can not change it
I like fingerprint scanner as a quick way to unlock my phone, it's at least more secure than the 4 digit passcodes or patterns I used before that, and more convenient than that or face recognition. But I wouldn't want to use fingerprint to replace entering a password for making payments or accessing any secure data.
First of all because they cannot be revoked. Unless you count cutting tools and torches. Just as well as they can be easily used without the user's consent (e.g. sleeping) without them being aware of it. Note: this does not require stealing anything as in the passphrase case.
Additional problems are the high false positive rate.
They just identify the user, not an action of authentication/authorization; i.e. a mental action like remembering a password and actively approving something.
See it this way: Your bank card identifies you, you pin number authorizes the payment. These are distinct differences. If you ignore authorization you get nfc payments which are very convenient but far less secure and easier to manipulate. Note: your pin can be revoked, your fingerprint can't.
It's awkward, but I think if you care about security that's still really the most practical solid option. Fingerprints were only ever "better than nothing" here and should not have been sold as more than that (Biometrics _can_ be very secure but they need human supervision, e.g. when police take a DNA sample you can't give them somebody else's DNA but nobody is supervising you when you press what may or may not be your actual finger up against the sensor on a stolen phone).
I have a passphrase and a relatively short screen timeout for my phone, it certainly is less convenient than most people's zero authentication strategy, I noticed this when my closest place to buy groceries announced I could use the phone instead of needing a cashier.
For a regular person you just wander around, bagging anything you want and scanning it with the phone, then obviously you pay at the end. But for any time I spent more than 30 seconds or so browsing the phone locked and I needed to re-enter my passphrase to scan an item, cumbersome. There are tweaks I could do to let the scanning app stay active when the screen locks, but ultimately I just won't bother, there are hand scanners for people who don't have a phone or don't want to use it like me. I'll only use the phone if I pop in to get a single item so that unlocking the phone is faster than swiping to get a scanner.
Which is the most secure? It depends on the threat model. With an NFC sensor, I suppose it should be possible to unlock a phone from a physical key, but is it really convenient?
The only downside of a fingerprint is that there is no key rotating. If your fingerprint pattern is compromised, you are screwed. This doesn't have to be a security vuln in the device itself. A determined attacker can take your fingerprints off the screen surface or back fit eh phone.
It's not perfect, (and my Yubikey doesn't support it so I don't do it) but what is?
This makes no sense and I struggle to even comprehend how somebody could come to this conclusion.
Before: I take my phone out, I unlock it, I look at something on the phone, then I get distracted, I leave it on a bar, a desk, somebody's refrigerator, wherever.
Now: I take my phone out. I need the FIDO key to unlock it, so I get that out too, I unlock the phone, I look at something on the phone, and then I get distracted and this time leave both the FIDO key and the phone in the same exact place, because of course I do I was using them both when I was distracted.
Can at least one of the people who seems so sure that somehow this wouldn't alter how often they lose the two items they now need together explain their thinking? Do you just... lose things randomly like maybe you have a gaping hole in your pocket and things fall out but you've never bothered to repair it? How are you losing things so that it somehow doesn't matter whether they're used together?
If I had an NFC one what I imagine doing is just pulling my phone out of one pocket and tapping it against the other, where my keys are.
I suppose if I was going to plug it in I could do that today (albeit with a USB-C adapter) but I don't because, the security point you mention aside, it's a usability nightmare (even if I didn't need an adapter).
Both have separated contacts / app store etc and are separated with support from the hardware.
Like a folder? Probably noticeable with a utility like WinDirStat.
Like a separate user? Can the other one install apps? If so, you're likely done for if someone gets access to the one account. Also there's this [1] to consider, as well.
I hate shooting privacy ideas down. Unfortunately, that's all I have to contribute this time.
After using it I like the idea with Huawei Private Space. You need to unlock the phone with a different biometric/password to get notifications even. So separate storage / user / app store.
Samsung Knox is a bit more seamless, you can choose how much you share (like copy & paste).
In case you are made to do it both can fool goverment to accept that you phone is clean with the correct setup.