Hacker News Reader

Comment by bjt2n3904 | Hacker News Reader

If passwords are the original sin, then Face ID and Touch ID are Sodom and Gomorrah.

Authentication is something you KNOW. Strong authentication is something you KNOW, and something you HAVE.

Something you ARE is great for identification, but terrible for authentication. Something you are cannot be changed like a password.

View on HN

The “something you have” is the key stored in the secure enclave/yubikey/whatever. That’s the real authenticator in this scenario. That it’s (maybe) unlocked biometrically is nice, but secondary.

In this case Face/Touch ID represents something you have (the iOS device with a persisted credential in its secure enclave), and something you are (fingerprint/face).

At least, in the case of biometric authentication on device, the ability to use biometrics expires automatically when the device is turned off (and other times), so biometric credential theft has a limited window of vulnerability. This contrasts with many fixed biometric authentication systems that aren't used as often as a cell phone.

Maybe... but if I steal your fingerprint, I have it forever.

And the courts can't yet force you to reveal secrets from your mind. But you can be compelled to use your fingerprint to unlock things.

In USA? I’m not even sure. In France there are many circumstances where you must reveal your phone password or any hard drive’s encryption key, if there is legit suspicion it has been used for general criminality (case in court with a cannabis dealer).

Reply on news.ycombinator.com