Hacker News Reader

Comment by TIPSIO | Hacker News Reader

I’m sure people way smarter than me have this figured out, from the Google post:

> When you sign into a website or app on your phone, you will simply unlock your phone — your account won’t need a password anymore.

> Instead, your phone will store a FIDO credential called a passkey which is used to unlock your online account. The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone

So if I was a dumb kid, I could login to my parents bank accounts (or more / worst) if my mom gave me her 4 digit phone password for games earlier?

View on HN

If that kid can get their parent's finger on the fingerprint scanner, sure. The authentication part of the process is moved to the device's security system, so that's fingerprints, passcodes, and facial recognition.

I don’t think fingerprint scanners on consumer devices are always great. My daughter has one on her laptop and last week I tried my finger and it worked.

Honestly, biometrics are terrible for authorization. They're more of a username than a password and we shouldn't use them like passwords. The same is truth for facial recognition algorithms, no matter how advanced.

They're so damn convenient, though. I trust the fingerprint scanner on my phone and my laptop, but there are definitely bad scanners out there.

Why do you trust your laptop scanner? Have you let other people try to unlock with their fingerprint?

FWIW, my daughter's laptop is a Dell.

Apple's bioauth is very good and I trust both the fingerprint and face authentication. YMMV with other manufacturers and devices.

I've tried unlocking my laptop's scanner with my other hand and I've asked other people to put their finger on it to see if it does some kind of weird matching based on finger type. No problems so far. It even works across both Windows and Linux if I use the right Windows reboot incantations.

Since there is nothing genetic about fingerprints, I'd personally consider your daughter's laptop to be defective if you're able to unlock it. A critical part of the laptop's security mechanisms is clearly broken and should be looked at. I can't find many other stories about Dell specifically so this may be a specific unit or product line that's broken.

You may even have something to gain by reporting it; I don't know if Dell or their manufacturers do bug bounties, but this definitely sounds like something that should be accepted in such a program. Even if they don't, writing a short blog about it with the brand, model, and model of the fingerprint reader might get the press rolling, forcing Dell to take action. This is simply unacceptable.

> Since there is nothing genetic about fingerprints

While it's true that even identical twins don't have the same fingerprints [1], it's not true that there are no genetic factors in the general shape of fingerprints [2]. I agree that it's unacceptable if a fingerprint reader isn't good enough to distinguish identical twins based on the differences in fingerprints though, as those should be the most similar fingerprints possible, essentially setting a floor on the minimum uniqueness in the problem.

It seems like they would use identical twin derived validation data sets to ensure this.

1. https://www.nytimes.com/2004/11/02/health/the-claim-identica...

2. https://www.mcgill.ca/oss/article/did-you-know/you-inherit-p...

I don't want my password to be something I leave behind on everything I touch, which the police have because I was arrested once, which can be ascertained from high quality photos, and which I can't ever change once stolen.

.. but biometrics can be lost too. I could lose my finger, I could have a facial injury. The algorithm could be changed and suddenly I can't log into anything anymore. Or I simply age and my faceId stops working some day. I don't know but biometrics only sound smart initially but it seems very brittle if you think about it. Plus there are plenty of stories of people who were able to unlock somebody else's phone randomly. Just google "unlocked my friends phone via faceid". This all seems like such theater for nothing. I think a simple "own this usb stick = it's proof that you are you" is a very nice 2 factor without any biometrics. Create a usb stick that needs to be unlocked via a passcode to work and voila.

* On Apple devices TouchID allows you to register multiple fingers. And if you have a severe facial injury it will fall back to a password if it can't identity you.

* No one is unlocking their friends phone via FaceID unless they are unconscious and they have deliberately disabled the awake-detection feature.

* It is not theatre for nothing. It is a far more secure and convenient form for authentication.

Normal usage would require a reauthentication - i.e. FaceId or TouchId - to produce the passkey.

Currently on the iPhone, if your FaceID or TouchID fail repeatedly, you have the option to type in the passcode, which grants the same access. I'm not sure if the same is true on Android.

I think the more general point is that "able to unlock the phone" is not / should not be the same as "I have verified that this is you" for sensitive applications and information.

I just tested with two banks' apps. They both allow touch ID with fallback to a bank-account-specific PIN - not the phone passcode.

Of course, if you've enrolled your kid's fingerprints they'd have access.

Ah cool, the Google post made it seem a bit more automatic and instant.

> you will simply unlock your phone

Then I guess that really is no different from opening an app.

No, because it should be evident by now that a phone is a personal computer, not to be shared with other people.

I can tell you don’t have kids ;)

And personal computers have supported multiple people with separated data and settings since what, the 1980s?

For you perhaps. Phones are shared more often than you think. And no, they don't use multi-account features built into modern mobile operating systems.

Reply on news.ycombinator.com