Hacker News Reader

Comment by DCKing | Hacker News Reader

Long pins and passwords make you a lot more susceptible to casual attackers, as they can be gotten from shoulder surfing and casual video, like e.g. surveillance footage.

Fingerprint replicas (or your actual fingers) are obtainable by targeted attackers of some sophistication. But if you're targeted by attackers willing to go that length for you, you have other problems. IMO, fingerprints provide the best practical security.

View on HN

Ultimately its a device you're carrying around with you, if someone wants access they're probably going to get it, all you're aiming to stop is chance opportunists.

Pin, fingerprint reader (that works) is enough.

Btw, I don't think 'casual attackers' really fits with access to, and willingness to go through cctv.

Only one of those can unlock your phone while you are unconscious, or with a body part that has been removed.

Those would be the "attackers willing to go that length" the person was referring to. If these are the adversaries you want to defend against, your solution is even simpler - don't store such secrets on your phone. Also maybe hire a bodyguard.

If those are your adversaries, they are going to use rubber hose decryption.

Is that more of a day-to-day problem for you than shoulder surfing? I ask because I used to have a drinking problem, too.

"or with a body part that has been removed"

wow. in what line of business do you work if you don't mind me asking?

Technology.

;)

If someone have lifted your pin/password, they can very much unlock your phone while you are unconscious.

IMO a combination of bio-metric and pin/password/phrase would be a good solution.

If someone is going to go to the lengths of cutting off your finger to get into your phone, I would suggest you're screwed anyway because they seem like the kind of people who'd chop off your/your wife/your children's fingers to get you to unlock it if you had a passphrase anyway.

Consider someone robbing you in a dark alley. They just want your phone and to disable any security alarms/tracking that may exist in the phone. They certainly have no motivation to cut off your finger, but now you've given them one

Consider also a roommate or someone you've recently started seeing. They can very easily unlock your phone by using your finger while you're asleep. They could shoulder-surf as well, but you can be vigilant against that. It's almost impossible to be vigilant against someone grabbing your finger while sleeping

Over here (UK) at least, I think a lot of phone thefts are done by people on mopeds who grab phones out of peoples hands while they're using them, so the phone is already unlocked.

There's no value to a robber of unlocking an iPhone with a fingerprint. Unless the phone is dissociated with an iCloud account (which requires entering the user's Apple ID and password) it's useless for anything other than for spare parts.

There is if you’ve allowed touchID for bank accounts and have ability to transfer money. Also, it could happen if you’re a heavy sleeper or passed out drunk.

> It's almost impossible to be vigilant against someone grabbing your finger while sleeping

I believe most phones have a way to easily disable fingerprint or face unlock until the next time the pass code is entered.

For example, on recent iPhones, just hold both the power button and one of volume buttons down for a couple seconds, which brings up the screen for power off, medical ID, and emergency SOS. Hit cancel on that screen, and biometrics are disabled until you next enter the pass code.

It should be reasonably possible to be vigilant enough to do that before going to sleep.

The kind of criminal prepared to knock you unconcious or remove a thumb is pretty rare.

I'd say finger removal is a few steps less likely than knocking someone unconscious, esp. if you can knock them unconscious and then clone their fingerprint.

Mind you, there are some quite dumb criminals, so "likely probability" besides "how likely am I to get robbed?" likely goes out the window.

There’s quite a few people that knock themselves out with drugs like alcohol.

Just stealing your drinking glass to get a good print to replicate seems to be almost as reliable as detaching body parts, with much less mess.

>> or with a body part that has been removed

If I remember the order correctly: One of the first attacks on finger print readers was to blow on them, making them read the remains on the previous fingerprint used. That was fixed by adding a temperature sensor to the reader, so to attack it you had to use a plastic bag with water at around human temperature. The easy fix was to also check for a pulse while reading the fingerprint, this also make it impossible to use a removed body part.

I have not kept up with the progress in the last years, so not sure how good creating a fake fingerprint that you put on top of your own prints work, like they do in movies. Finding and reproducing a print is not that hard.

As others have written, fingerprint are usernames. It is not secret and you can not change it

Reply on news.ycombinator.com