Hacker News Reader

Comment by BoppreH | Hacker News Reader

I understand the frustration with login systems, but why is the title "Passwordless: A Different Kind of Hell" if it doesn't talk about passwordless authentication, like passkeys, magic links, and biometrics?

View on HN

> biometrics

Biometrics are a convenience feature, not a security feature.

Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking.

But the worst part about it all, is that biometrics are a password you can't change without surgery.

I really REALLY wish "biometrics" would stop coming up as a solution to security.

Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead.

Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.

> don’t actually look similar to each other

I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements.

I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.

Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily.

Like with many things pertaining to security, there are no universal solutions without first defining the problem.

Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.

biometrics are used in combination with a specific device. same as a PIN (you can't withdraw money from an ATM with just a PIN, you need the chipped card + your PIN)

i can't go up to just any computer and log into my bank with my face

you would have to possess my phone and then deepfake me

i am comfortable with this security posture because the convenience of face id allows me to use long random passwords with frequent rollover which I never have to type

if i lose my phone I can remotely disable it

this is all much less of a crime to me than any service that allows password reset over SMS which is a much more well trodden vulnerability.

> Face unlocks can be fooled by pictures

Isn't that only Android (and maybe only older models)? Doesn't iOS use a LIDAR sensor instead of the camera?

Correct. Depending on the phone, on Android the face unlock will not work with a 2D image. Perhaps only on cheaper phones.

On Windows for example you can't even have face unlock without a sensor that will provide 3D details so most laptops don't support Windows Hello.

I was confused as well. It seems to me that by lowering the experience complexity, while not really changing security, by the author's own logic the experience stars would go up a notch.

Instead they just mention it in passing with a "only time will tell" comment

I was curious about that as well. Since most services implement an email based Forgot Password feature, and 2FA tokens are also often email based, why isn't magic links the default approach now? Seems to be just as secure as password+2FA but easier to use (and probably to implement, as well).

By the title, I thought the article would explore some of the downsides of this approach that I might be missing.

Magic links are not the default as it gives your login process the speed and reliability of email delivery and most login processes are aiming for better than a p95 of about 5 minutes.

It talks about passkeys and biometrics though.

At the very end, as possible alternatives to the hell they're describing.

Yeah and would passkeys themselves prevent the session from expiring? Notion et al can still have short lived sessions on their client apps.

Yeah I'm not saying anything about the truth of that, just that the title doesn't match the content

Reply on news.ycombinator.com