Hacker News Reader

Comment by Sohcahtoa82 | Hacker News Reader

> biometrics

Biometrics are a convenience feature, not a security feature.

Fingerprints are trivial to lift and replicate. Face unlocks can be fooled by pictures, or in some cases, get false positives from people that just look enough like you (which is common in some Asian countries). Even if it requires you to blink, new AI tools will easily generate a video of you looking around and blinking.

But the worst part about it all, is that biometrics are a password you can't change without surgery.

I really REALLY wish "biometrics" would stop coming up as a solution to security.

View on HN

Agree with the insights in your comment about biometrics != security, but I'd like to take a moment to nitpick a slight inaccuracy-- Asian faces don't actually look similar to each other, but they do look similar to a person/model that has been trained mostly on white faces. If the facial recognition model had been trained predominantly on Asian faces, then white faces would look similar to each other instead.

Reminder that the outputs of AI don't reflect some deeper truth about reality, just an extrapolation of the training data. Garbage in, garbage out.

> don’t actually look similar to each other

I think this should be “more similar than other groups” rather than simply “similar”. Even then I think it’s possible that some groups have more loci with higher diversity for facial features. That’s not even getting to epigenetic and environmental elements.

I think the deeper truth is in your final paragraph: facial similarity is in the eye of the beholder.

biometrics are used in combination with a specific device. same as a PIN (you can't withdraw money from an ATM with just a PIN, you need the chipped card + your PIN)

i can't go up to just any computer and log into my bank with my face

you would have to possess my phone and then deepfake me

i am comfortable with this security posture because the convenience of face id allows me to use long random passwords with frequent rollover which I never have to type

if i lose my phone I can remotely disable it

this is all much less of a crime to me than any service that allows password reset over SMS which is a much more well trodden vulnerability.

Low security is security too. Biometrics can useful when used for appropriate applications. They're very useful in applications where authentication would be otherwise be omitted or undermined due to usability concerns. They can also be used in conjunction with other authentication methods to complement the flaws of other authentication methods, like passphrase or token, which can be shared more easily.

Like with many things pertaining to security, there are no universal solutions without first defining the problem.

Say for instance, you have an access control system where you want to solve the issue of credentials being intentionally shared. Biometrics are a great solution for this; tokens and passphrases are not. You need different tools for different problems.

> Face unlocks can be fooled by pictures

Isn't that only Android (and maybe only older models)? Doesn't iOS use a LIDAR sensor instead of the camera?

Correct. Depending on the phone, on Android the face unlock will not work with a 2D image. Perhaps only on cheaper phones.

On Windows for example you can't even have face unlock without a sensor that will provide 3D details so most laptops don't support Windows Hello.

Reply on news.ycombinator.com