Hacker News Reader

Comment by autoexec | Hacker News Reader

Stop using biometrics generally.

This is the advice I give to everyone who comes to me for digital security advice. I let them know that building habits of using lengthy PINs (my own personal PIN is far more than four or six digits) takes some time to get used to but makes them immune to device seizure followed by law enforcement-compelled or court-ordered biometric unlock (this is specific to US law).

Too useful

And also more secure unfortunately, when you need to unlock your phone in public for example.

The same public where you're constantly leaving your fingerprints, where your face is being constantly recorded and scanned into multiple facial recognition systems, where your DNA is being constantly shed? When everything needed to unlock your phone can be taken off of your corpse or just reconstructed from what you leave everywhere you go you're not really "secure".

Exactly! Biometrics have never been less secure than they are now. It's approaching Social Security number levels of insecure. LOL

It's like using a password that can never be reset, writing it on a stack of post-it notes, then tearing one off and throwing it over your shoulder every 10 feet you travel

Nobody is going to all that trouble to unlock my phone, they'll just beat me with a hammer until I unlock it for them

If your threat model includes abduction and torture, then you probably don’t need to worry about your rights to begin with, and probably shouldn’t be using a regular cell phone for anything important

Ffs, taking usable fingerprints is not that easy

Facial recognition cameras don’t use or give you the same data that FaceID’s 3D depth mapping FaceID uses, besides few cameras get close enough to practically reconstruct a useful 3D mask that could fool it.

And if you’re a corpse why would you care?

Until one person or one CCTV camera catches the code over your shoulder and you're done.

That is what they meant

No, because for most people, the alternative to "no biometrics" isn't "secure password/pin", it's a weak password (eg. 1234 or the S pattern that half the people with a pattern lock uses) because the ergonomics of a secure password are terrible.

Bad security, either in the form of weak passwords or biometrics is a choice.

It has always been a trade off of security and convenience.

The fact is most people will favor the latter.

Reply on news.ycombinator.com