Hacker News Reader

Comment by recursive | Hacker News Reader

When the biometrics on the client client send the credential for the server for authentication, it's going to be serialized somehow. This is the part I'm worried about. I'm not so worried about someone lifting my print off a wine glass. Somehow a print (or iris or face or whatever) is encoded into bits and bytes. And that's going to be handled by every service I want to authenticate with? I don't trust them. Passwords leak all the time from leaky databases. Why wouldn't my fingerprints? The only difference is... I can't change my prints.

View on HN

They don't necessarily serialize and send your biometrics over the internet. FIDO biometric implementations, for example, use it to unlock an on-device private key, which is then used to sign a challenge for the server to authenticate. No secrets, biometrics included, leave the device.

So how would I be able to use a new device to authenticate using an existing account. How would I be able to do that if the original device was cast into the fires of Mount Doom?

IMO biometric auth will never completely displace passwords unless it can beat the user experience of a password manager.

But, as it may be obvious, I really don't understand how the biometric stuff works.

The simple answer is that generally you don't, you first authenticate in some other way and then add biometrics (stored on the device) as an alternate means of authentication. It displaces other methods as the day-to-day commonly used authentication, but not completely.

Which is a really big deal! I don't buy into Apple's flashy marketing crap, but TouchID got a few things right. Things that are easy to get wrong. Specifically, if an attacker steals my phone, getting my fingerprint out of the touchID chip is (supposed to be) nigh impossible, but no matter how possible that is/isn't, the point is that an attacker can't snoop the wires between the touchID chip and the phone's CPU, and then replay that conversation. There's a ton of ways to implement it wrongly. That the iPhone did it well isn't a reason that it would be okay to YOLO post picture of your fingerprints on Twitter.

Reply on news.ycombinator.com