Fingerprints are Usernames, not Passwords
blog.dustinkirkland.com
blog.dustinkirkland.com
I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake fingerprint, and then they'd have to enter my code. And if they fail to enter my code 10 times, the phone is wiped.
All in all TouchID basically removes almost the entire burden from the security of having a locked phone. It's actually faster to unlock my phone with TouchID than codeless swipe to unlock, so it's a no-brainer to turn it on. It doesn't matter that the NSA probably has my fingerprints, in practice it prevents most people from getting into my phone in a way that is transparent and easy to use. If the spooks want my data, they can already get it.
It's a cute feature. It's not going to change the world, sell another billion phones, push other companies out of the market, or save anyone from serious attacks. It's probably a good idea to enable it anyway.
With a fingerprint unlock, I need to go to at least a little trouble to fake the fingerprint.
In neither case is the phone meaningfully protected against serious attack. Why must we have this argument? It's a cute feature. Use it.
That doesn't seem to be the case to my knowledge. The evidence from the successful attack is that you need an excellent-quality print from one of the specific fingers that has been programmed into the phone. Some phones probably have that on them, but it appears likely that many do not.
edit: build an app, get your colleague, significant other etc touch it on any touchscreen phone or get on camera and create a 3d printed finger. 3d printing vs touchid...maybe
But putting that aside, your hypothetical app would -- using the demonstrated method -- 'lift' that excellent quality print, scan it at 2400 dpi, (clean up said print), print it on a transparency at 1200 dpi, mask it onto photosensitive PCB, develop/etch/clean the PCB, spray graphite and apply wood glue to the mold.
It might make for a slightly-more-plausible-than-normal gadget sequence in a Mission Impossible movie, but it's not much of a concern for the target market. [2]
[1] Despite what decades of shows like CSI might lead us to believe, this is not a simple or error-free process. And each mistake irrecoverably destroys the print.
[2] Most of that market doesn't even use a passcode today and many that do are still using surprisingly bad PINs (birthdays/anniversaries/1234)
Except when confronted with an Apple product. Then it's all "Nah bro, relax. No way could you lift a fingerprint from a glossy phone screen". :)
I'll say it for the third time. It's cute feature (like face unlock was before it). Use it and enjoy it. If you honestly think you're buying a serious security mechanism you're simply wrong.
When you say it's not "a serious security mechanism", it sounds as if that's defined in some absolute terms. But if the effort to hack it is hundreds of times more difficult than the possible payoff from hacking it (which appears to be the case for nearly anybody but James Bond), then it acts as a serious security mechanism for that user's context. Literally nobody is going to make a mold of my finger to unlock my iPhone — they'd have to be absolutely insane to think that was worthwhile. So it's a serious security mechanism for me. Would it be a serious security mechanism to cover nuclear launch codes? Of course not.
You have to understand that the practice of cryptography has always had a military basis; the commercial/private use is ancillary.
So, what's "a serious security mechanism?" Presume you're a military commander during active war, whose battle plans are intercepted by an opposing nation. What is the likelihood, given the opposing nation believes your plan will lead to their complete destruction, that they'll be able to break the security in time to execute a counter-operation? A serious security mechanism is anything that reduces that likelihood.
There's security that geeks advocate for ourselves and our own implementations (often things we only have to set up and maintain infrequently) and then there's security that normals actually use (often things they have to authenticate with several times a day).
And I must have missed it, if anyone's been arguing this is a serious security mechanism. As far as I've seen, it's been lauded as (not much) better than a passcode, but, primarily, convenient enough to get people to use it instead of nothing, bringing up the relative security of a still-fairly-insecure bunch.
And you may want to re-read the discussion over the faked-print attacks. It isn't about (im)possibility. It's about the time, expertise and equipment involved and the likelihood of success being too expensive to be worthwhile for gaining access to most phones. [1]
And if we're wearing our "serious" security hats, I still don't see any reason to worry too much about print faking, as its core assumption is a skilled attacker who has unfettered physical access to our device, unbeknownst to us and beyond our control. And at that point, the game is already over.
[1] CCC themselves, with ideal source prints, had to significantly complicate their process to generate fakes that worked with a suitable consistency. So even if you think suitable source prints grow on trees, the point of significant skill, equipment, time and resources remains.
You need to be able to sign in with the Apple ID to remove the association.
I've already done that service for another, using some auto-unlocking tools. Takes all but 5 seconds, including USB negotiation. And it even gets past sim-locks.
What utter unmitigated rubbish. It is extremely unlikely that even a fully qualified CSI would be able to lift a full print from a mobile phone, let alone one that that can be reliably reproduced in the manner CCC described.
My 5 year old son was quite literally dusting for fingerprints at the local science museum last weekend. We have some shockingly high fidelity prints of both our thumbs showing all the ridges. And all we had to do was squeeze a piece of plastic. Fingerprints have even less identifying detail than faces. You've been hoodwinked by Apple's marketing, and I'm willing to bet this isn't the first time.
Yeah, not so much. The fakes didn't even pretend to be live tissue.
I have no idea how finger print vs facial recognition compare in accuracy, but a decently implemented facial recognition system shouldn't be compromised by a still image.
As they said when they unveiled the feature and people mentioned this: give them a little credit.
http://www.soyacincau.com/2011/11/12/clarification-on-the-ic...
Of course, I don't actually use it because the face recognition is so bad, and nonexistent in the dark.
I'm ready to have a chip in my arm now.
face unlock now requires you to blink.
I think that's the key distinction here. In any given authentication scheme it's important not to have false positives (incorrectly identifying a bad guy as you) or false negatives (incorrectly identifying you as a bad guy). In this case false positives break security, false negatives break usability. However, false positives won't outright stop adoption whereas false negatives will.
edit; not 911emergency, but casual situations of full or dirty hands..
Edit: I went to it. I leads to a special dialer. Instead of voicemail the button leads to a special emergency contact (or list). It only shows 4 inputs on top so I am guessing that is the limit so you can't dial anything but emergency services (that are 4 numbers or shorter). Then it goes back to my lock screen.
With glove, dirty or too much sweat, I believe it does not work. So, it's not 'always'.
However like others, I turned it off because the performance was highly variable, and the failure mode consists of a many-seconds wait which can be extremely infuriating (even embarrassing, as as you stare blankly at your phone for 5 seconds at a party, trying to quickly get someone's number or something).
The big enterprise market is an awesome place to get a foothold in - they are not really price-sensitive and hate change. Not that Apple has any problems in that segment, but extra lock-in doesn't hurt.
Where this becomes semi-dangerous is in assuming that now your phone is ironclad and you can store whatever on it totally unprotected. The best route to safety is to make informed decisions based on your own risk-tolerance and not be a lemming.
If I was the kind of person who was worried about someone accessing the contents of my phone, I'd simply turn off touch ID and use a long password (or spend less money on a phone that didn't have a feature I wouldn't use).
I've gone down the route of using both a long password and touch ID simply because touch ID works so reliably - I've never had to enter my password. That way someone either needs my long password or a physical copy of my fingerprint to access my device. I'd say that's much better than the 4 digit numerical code I relied on previously - which had been seen by friends and family.
Your iPhone has a picture of your fingerprint inside of it now. It's just a picture, and it's likely a very good picture at that.
What happens when I swipe your phone for a second or two, plug it into my machine, and download the high-resolution picture of your fingerprint?
Do you use a fingerprint lock at home? If so, I've just broken into your home.
Do you use a fingerprint lock for the datacenter you administer? I've just gained access.
Do you own a registered gun? How'd you like me to commit a murder with your fingerprint on it?
This kind of attack is the missing piece of my argument. When someone figures out how to do this, these issues are going to become very important very quickly.
Let's suppose that Apple introduces a feature that syncs your fingerprint across many devices. How convenient, right? Let's say that means keeping all of your fingerprints on Apple servers. Let's now suppose that, like a credit card database, an attacker is able to obtain a leaked copy of the fingerprint database of every iPhone user. The recent touchid hack shows that fingerprints can be spoofed for high-end scanners. What then?
Sure, this scenario is very unlikely. I'm totally in slippery-slope land here.
But when we choose to turn up the dial on convenience to sacrifice more security, we must be prudent, carefully considering the consequences of our intentional ignorance.
Thieves will offload the phone to someone using software explicitly designed to wipe electronics to be resold.
Whether they are wiping an iphone that happens to have touch ID or not is only relevent towards the resale price once it's wiped.
Clearly Apple marketing works, as it's somehow convinced a member of (I'd hope) a more technical audience that their electronics are somehow safer against thieves.
The point is that with TouchID (as opposed to no passcode) the thief will not be able to send porn to my mom or read my text messages before they wipe the phone.
Basically, a stolen iPhone is only worth the sum of its parts so they can be used to repair other phones.
So if it works as advertised, stolen iPhones and iPads will only be worth the sum of their parts.
did I just predict iOS8?
Apple are perfectly happy with the second hand market for iPhones.
I've just ordered a 5S. It's costing me £709. My iPhone 4S 64Gb is worth about £200 second hand. Even a new 8Gb 4S, the cheapest model available new, is £349.
Anyone interested in my second hand phone was almost certainly never going to spring for a new iPhone.
The market for second hand iPhones does next to nothing to cannibalise the market for new iPhones (which Apple cares about) and strengthens the iOS ecosystem (both by bringing in new customers who might buy apps, music and movies but also keeping customers away from competing platforms).
There's more upside than downside for Apple in second hand iPhones.
Now, if you arguee that no thief will ever want your data (and you'd be probably right), it doesn't matter if you lock your phone or not, and it won't matter how you do that. In this case, locking schemes are completely useless.
(Now, I'd be content with a fingerprint reader that recognizes a finger - any finger - and unlocks the phone. It's enough protection if my pocket can't defeat it. Unlocking only by specific fingerprints looks like a pain, nobody else will be able to unlock my phone? Thanks, but I'll pass that.)
With touch unlock, all I need is my buddy to hold you for 3 seconds while I twist your arm and unlock the phone.
With passcode unlock, getting the password out of you will take some more effort.
Oh, and in this scenario, I can be a thief, or a police officer, or a borders agent, or an abusive husband, or many other things :)
Given that there are two people, capable of violence, against the phone owner I'm not sure that getting the password is going to be that much trouble.
While an individual person might not be at that great of risk because the amount of crackers willing to exploit touchID is limited to a minute demographic of people, the real harm comes when many iphone owners who share your ideology start using touchID instead of the more secure locking features their phones provide just because its more convenient.
Consider what happens when there are 100,000,000 million insecure phones out in the world. To a motivated cracker/spy/terrorist this is a huge ocean of potential suckers/victims vulnerable to exploitation. While most of these people aren't worth targeting, 1000-10,000 people might be.
This is why rejecting broken security technology is a cause everybody should rally behind. Even if you are never a victim of a black hat, you may very well suffer indirect consequences from the exploitation of somebody else.
This reminds me of certain U.S. Supreme Court decisions. As someone who's interested in constitutional law, I often find myself defending things that seem trivial and nitpicky. Why does it matter if the police enter one drug dealer's home without a proper warrant? Who cares if we restrict someone's speech, considering that the person was, say, a racist whose ideas were ignorant and offensive?
Of course, the content in this analogy is very different. I'm not comparing fingerprint scanners to crimes. But the logic is very similar: when judging law and technology, respectively, it's important to consider how seemingly small decisions serve as a precedents for bigger trends.
If fingerprint scanners become a common replacement for passwords, and the author's argument is correct, the scanners may dramatically change our security and expectations of privacy.
However, your fingerprint is a username in that case because it is all over the place. The police already have it. Don't be fooled, there are certainly kits being sold to law enforcement to dupe TouchID. You're data is less protected from those that you'd probably prefer not have easy access to it now.
Outside the HN bubble, this is an acceptable tradeoff. People who are concerned can continue to use passwords.
I'm glad you have been deemed worthy enough to make that decision for the rest of the population that doesn't understand the implications of what they are getting into.
Therefore it is up to us to make the right choices. That we aren't doing it, choosing instead to defend flawed technological improvements and the companies doing it, is very regrettable.
> This is a disadvantage only when you are on trial. That's a pretty extreme contingency
No dude, that's not the only thing that can happen and it's in no way extreme. Many people do go on trial for trivial things (because shit, in the US at least, suing people is a way of life) and your laptop or phone contains your most secret conversations and desires, being the ultimate incrimination tool, a digital fingerprint of your own mind.
And you don't have to be on any trial. You don't even have to be a suspect in an investigation. It can happen and has happened for laptops or phones to be seized for inspection during routine filters, like by the airport security.
Also, in the US you may live under the rule of the law. What about countries where oligarchies rule, countries where corruption is the norm? What about countries like Rusia, China, India or Brazil?
Just today I read about a story about this traffic cop from my own country that had the bad inspiration of doing his job by fining his own boss for ignoring a red light and exceeding the speed limits. He was later accused of all sort of bullshit and had to fight it in a court of law for 2 years before he was exonerated.
And technology evolves and our devices are gradually becoming our stored memory. What do you think these corrupt officials or organized crime syndicates could do with your own mind, 10 years from now? A lot dude ;-)
Are you saying that random people can pick up your phone when you go to the bathroom, touch the home button 3 times, and then enter "1111" 10 times, and wipe your phone? Is there some protection against this?
It's not like you will lose data since it is backed up to iCloud.
Um, protection against random people wiping your phone maybe?
If this is a problem with your circle of friends: find new friends, or disable this feature.
Anyhow, my initial thought was, perhaps not an asshole but a child? I could see a child playing with the phone and wiping it in quite short time. But other commenters pointed out it's not the default and there's cloud back-up it doesn't seem a major problem.
My guess at an answer is that human beings are more comfortable thinking about numbers that are small integers (between 1 and 20 or so?), and that (roughly speaking) we often want to be able to give a bit more precision than you'd get from just "1" vs. "2".[1]
So for baby growth, parents will talk about how many days old their child is for the first week or so, and then use "weeks" for the first few months, and then use "months" until they're around 2 years old. (There's also a real sense in which the pace of child development seems to progress on a sort of log scale: change is very rapid at first, but gradually slows down. The use of different age units seems to roughly parallel that.)
As an aside, this same human preference is presumably also why the English developed different units for (say) inches, feet, and miles rather than using one of those units for everything. [Side note: is there any common English unit between yards and miles? I grew up using "blocks", which is handy, but that's pretty city-specific.]
[1] By "precision" I'm thinking more or less about "relative uncertainty". If you assume that an integer value is accurate to within +/- 0.5, then the percent uncertainty on 1 or 2 is so large as to make the information almost useless, while the implied uncertainty on a big number like 50 is probably smaller than is justified for most contexts.
Literally, the length of a furrow. A sensible length for
farmers that later evolved into the acre, which is discussed
later in this section. A standard furrow is 220 yards long
or ⅛ mile
- 1.0833 years old: 13 months
- 1.4166 years old: 17 months
- 1.8333 years old: 22 months
So, is it easier to use years on the clean decimals and months whenever it gets hairy, or to just settle on months?
- Clothes are sized in months 0-3, 3-6 etc.. - During doctor visits you discuss developmental milestones expressed in months.
Etc. You get used to it, since at that age the development of a child is extremely condensed and years simply don't provide enough resolution.
If you use the iPhone Configuration Utility, you can even reduce the attempts down 2 before it wipes itself.
I guess it's useful in circumstances where the data on the phone is more valuable than the phone itself.
You must not have kids, because that statement scares the shit out of me.
I guess the question at that point is, is a 4-digit code better or worse? I'm not fielding that one...
Fingerprints are a nice way to keep almost everyone out of your device. And for the rest, well, I really doubt some other locking mechanism would've kept them out.
Keep in mind that if these criminals can't figure it out by googling it, they will give up and move on. The typical phone thief isn't a security expert with the knowledge to invent a previously unknown exploit.
I can think of some examples:
* jealous spouses who want to look at call logs, emails, text histories
* unscrupulous managers looking to see if you've been talking to headhunters, competitors, etc.
* stalker coworkers who are looking for "private selfies"
* frenemies who want to post inflammatory messages using one of your social media accounts
Most of us don't live in a James Bond movie.
(1) If someone has my fingerprints they still need my phone to do anything.
(2) Even with my phone there's a good chance it's worthless unless they also have my pin.
(3) Stealing my phone has also become worth much less unless you have my prints and the followthrough to make fake ones and again they'll want my pin in most cases because you only get 5 failed attempts with your fake prints.
(4) All of that takes time, during which I may be able to remote wipe my phone, making the whole exercise worth even less. And it takes money, again lowering potential returns.
It's easy to imagine (numbers pulled out of ass) that a thief could get a few hundred bucks for a 5C (no touch id) but say half that for the more expensive 5S. Maybe that won't hold up for various reasons (hey thieves will work hard to make those stolen 5s's worth more) but the principle behind multi-factor is sound.
It would probably take a few tries, but seems well within a person-sized budget.
One theft isn't practical? How about a million? Driven by a never-ending pursuit of monetary gain via crime; with criminals always happy to conquer the latest technology wave. There's absolutely no reason to think that criminals won't amass substantial finger print records just like they do any other intimate information they can get their hands on, from SS numbers to passwords. It's not a question of if, but when this starts becoming common.
All it requires is linking finger prints to something valuable at a mass market scale, and that will drive an unlimited criminal demand for finger prints.
It's not about the iPhone. It's about a consumer shift to finger prints as a primary security feature, and whether that is sane (with the iPhone potentially setting the trend given its cultural status).
> It's about a consumer shift to finger prints as a primary
> security feature
Now, in that world, what will criminals use the fake fingerprints for?
The CCC could have used a stray fingerprint (say on a glass or the phone itself) but didn't. I suspect they would have demo'd that if they could have made it work reliably or even at all.
Your slippery slope argument seems faith-based and doesn't answer the big questions I posed above. I don't see Samsung or Moto going fingerprints anytime soon - and if they do, Apple is there with patented tech waiting to sue them if it's at all similar. Widely varying implementations of the same thing with possibly different exploit angles - does that seem like a security epidemic to you?
I'd suggest that someone would just access the data storage, bypassing the fingerprint mechanism.
It's cute. Honestly I don't see what this adds over face unlock which is reasonably mature now and equally yawnworthy IMHO.
Face unlock is very fast - generally I turn device towards me to start using it and face unlock has unlocked it before I even realise it was locked (less than half a second).
When it fails to recognise you, you can enter a pin/password/pattern. There is a menu option to 'Improve Matches' so it can pick up whatever is different this time. Every release has improved dramatically. After my most recent Android reinstall I recall only ever improving matches once.
It doesn't work in low light which fingerprints will.
I know that Picasa's face detection works even if I am wearing sunglasses... thats the only reason I ask.
He asks: "I don't see what this adds over face unlock."
I answer: "You can use Touch ID to buy things."
If the fingerprint is the identification that is used to then trigger decryption of securely stored data, it's a lot less secure of a mechanism than a fingerprint AND a password.
There was a good recent discussion that fingerprints also do not enjoy the same protection as passwords, as the fingerprint is not a "content of your mind". Here's the wired article on this: http://www.wired.com/opinion/2013/09/the-unexpected-result-o...
It was also discussed at length on HN, but I can't find the thread.
I agree that the touchID shouldn't be used for authentication with everything and I think Apple agrees, which is why they haven't opened it up to 3rd party developers.
For the purpose of a full-disk encryption software, fingerprints are many times weaker than a good password. The purpose of such software is to prevent a thief, the cops, the NSA, or anyone else who takes possession of your computer, from viewing the contents of your hard drive. A fingerprint won't protect you from the cops, since your prints are already all over the place and they can probably force you to provide a fresh copy anyway. In that case, fingerprint logins would only give the user an illusion of security. So it's understandable that the author doesn't want to enable fingerprint logins to his software.
For the purpose unlocking a phone, on the other hand, a fingerprint is probably good enough. The contents of the phone usually aren't encrypted, so a determined attacker will just turn the phone off, pull out the SD card and/or the internal Flash memory, and read everything off of it. Or if you're NSA, forget the phone and get the data straight from Apple. TouchID is not for NSA-proofing your phone, it's for deterring common thieves and pranksters.
tl;dr: I agree with the author that fingerprints are not a good fit for full-disk encryption software. But I don't agree that fingerprints are completely useless. It all depends on the type of attack you're trying to defend against.
Of course it's also possible to use eCryptFS with a four-digit passcode, but it's strongly recommended against. The main difference between FBI-proof encryption and pickpocket-proof encryption is not in the algorithms used, but in the typical use case of each.
You can definitely brute force it. I saw an article somewhere (probably here on HN) addressing the fact. I can't find it, but if I remember correctly, it said something about Apple or an associated company quietly offering forensic help to police on bypassing the password. I think it implied they were using a ramdisk to brute force the encryption.
edit: Found an Ars article about Apple doing it, but it doesn't mention anything about a ramdisk. http://arstechnica.com/apple/2013/05/apple-will-reportedly-u...
Ok, they are not private but I'd still not willingly put them on anything controlled by an US corporation. Govt sending their agents to collect my fingerprints from glasses? Not feasible, too costly. Agency asking Apple to fetch the fingerprints willingly provided by the population "just in case"? Maybe not today and not tomorrow but in a few years? I wouldn't bet on them not doing it. And once there you're just one false positive away from some serious shit happening to you.
If you're worried that Apple will roll over for the NSA, and that the NSA will, at some point, be out to get you, the quantity of information they could gather through backdoors on your phone is so astounding that it's hard to understand why hashed fingerprint feature analysis would be the last straw.
The US Govt probably has 3-4 sets of my fingerprints in various data stores across several agencies...and I'm no one special.
My security keypad will actually be a fingerprint scanner. Anyone who watches someone press a sequence of buttons or dusts the pad for fingerprints then subsequently tries to enter by repeating that sequence will trigger the alarm system.
Why not have the sequence remain the password, but also scan fingerprints? If you have the wrong fingerprints (username), the right password still won't work.
This is the central question for all biometrics for me and I believe one of the hardest problems to solve. There are many people who believe they are solving this by using ever more intricate biometric identifiers, thus increasing the bar to reproduce them beyond what they believe currently feasible. But I'm yet to see that central question addressed.
What happens when you lose control of a biometric key?
> they'd have a few attempts to unlock it with a fake fingerprint, and then they'd have to enter my code. And if they fail to enter my code 10 times, the phone is wiped.
I don't use it, but it seems there's a fallback password after __ failed attemps.
Touch ID will likely cover the vast majority of security use cases for iPhone owners.
However, I think the point of the article is that you can change a compromised password, you can't change a compromised fingerprint. As is mentioned, there are plenty of databases with fingerprint information. Also, for the crowd that is paranoid about government accessing their data, an authority might have an easier time getting into a device when they already have your fingerprint as opposed to figuring out your passwords.
If we consider phone unlocking mechanisms to be in a different "not fully secure, but at least practical" category, then I think it's perfectly acceptable to use a fingerprint as an unlock.
Mitigation is possible too. For example, the phone could lock out and require a proper password if it detects tampering (which, AIUI from other comments, the iPhone does).
The biggest annoyance is I keep holding my thumb on the home button on my iPad, then get disappointed when I realize it won't work. I've probably done that 20 times so far.
I really wish I could do "per context security" -- requiring multiple discrete factors based on action and threat. That would be a huge innovation for the iPhone, which would sell the next billion phones, if integrated with Internet services and apps. In my house, maybe not require anything, or just a thumbprint. In my car, same. In a coffeeshop, normal passcode after a few minutes, unless the phone has just accelerated highly, in which case a much higher passcode. At Customs in China, a passphrase held out of country. etc.
A bigger deal than Siri, if slightly less of a deal than Retina, and something a team of 2-5 people could implement before iOS 8. I'd even be willing to work at Apple to do it.
Any good thief is going to swipe a phone and worry more about getting away and less about unlocking it which they will do later. Furthermore, unless you're jailbroken and have changed your default sudo credentials then your data isn't all that secure anyway against someone with a computer and rudimentary software. All of which can be done while the phone is off or in an area with no service. That would also serve to defeat find my iphone as well.
I wonder though, is there a biometric facet that can surmount the bar of unreplicable uniqueness? Contact lenses can fool iris scanners. Perhaps we should make a dental impression sensor?
I don't understand why people keep repeating this. As long as fingerprints are an optional authentication mechanism, you absolutely have an option if your fingerprint is compromised: switch to a passcode.
At some point in the perhaps-not-too-distant future, we will likely have very sophisticated brain-scanning technologies, and combined with advances against biometric methods, basically any form of authentication will be useless.
I have absolutely no idea how to get around this, and can only hope that our society has advanced enough by that point that we don't need to keep any secrets at all. Not much chance of that really, IMHO...
Synopsis: an evil government steals the private thoughts and passwords of its citizens, most of whom are unaware of the threat. A few paranoid individuals come up with increasingly bizarre biometric passwords, but the government has secretly approved unauthorized (and speedy) cloning to bypass these protections.
Finally, the freedom fighters use the government's own technology against it, replicating the president's bio-metrics in order to shutdown and disclose the program.
No meaningful political change occurs.
What really scares me, though, is when we get to the point of not just being able to read thoughts, but being able to write them. How would you ever know that your memories and emotions have not been tampered with? As far as you know, you've always loved your corporate overlords, and would never do anything to work against them...
The protagonist is unable to make a physical record, and so must trust his brain retain any proof of the government's wrongdoing.
However, the brain is a poor vessel for this - it can be manipulated and tortured to discount information. And so, Winston ends up loving Big Brother.
Paper and bits are what we rely upon; there is a reason eye-witness reports are trusted so little in comparison to physical evidence.
Agree with the rest of your comment. Cocktail "something you are" with "something you know" and "something you have" for potent results.
And the police have them. And the US government has (flew there twice) them. Isn't the "something you have" in 2FA ideally meant to be something that only you have?
If apple uses this, and google follows, and facebook, twitter, linkedin, my paypal and CoolAppForYorFone(TM) and everything else, then if CoolAppForYourFone(TM) scans my fingerprints, then they have access to everything on all other accounts which use this info.
Once it becomes common, then on street corners, salespeople will ask your opinion on things, "Hi! We're doing a survey this week for Vodaphone - just a quick question - do you think people with android phones or iPhones have sex more often?" and ask you to give a fingerprint to sign it. And most people will.
Or "Hi! We're giving away 20 euros free credit today at PhonesForYou! Just place your finger on the scanner here, and tell us your phone number and we'll send it through!"
We're already trackable enough, why make it easier for scammers with scanners?
They have all the essential features of passwords, they are just weak passwords.
Fingerprints can't be changed if compromised, and so they don't have the essential features of passwords.
There is a difference between a weak password and not-a-password.
Sure they can, it's just really, really painful ;)
Part of the problem is that Apple's iOS has no username, just a password. Thus, one of the differences with a fingerprint 'password' that I haven't seen much discussed is that it would make him harder to share that tablet with his wife, since they can share one four-digit passcode, but not (as far as I know) two different fingerprints. The fingerprint makes it much harder for the popular family use cases between letting one person in and letting everyone in.
Edit: OK, cool, my comment is invalid.
I can see it working just fine from the context of a single and otherwise unattached individual. That'd be OK.
...until you have an accident and someone needs to figure out who to contact...but they can't get into your phone.
...or, until you lose your phone and whoever finds it actually wants to figure out who you are in order to return it.
...or any number of other scenarios where you actually want other people to access the device.
There's also the angle of trust. What's your significant other going to think when he/she can't get into your phone without your fingerprint?
Again, I can see it being a really convenient tool for some people. Not sure it is a universally useful thing.
I, mostly unsuccessfully, ban the children from having passcodes on their devices so that I can do backups, act as communal spy for various parents etc. They, on the other hand, mostly add passcodes (then change them regularly) so that their siblings don't go onto their phones and change the wallpaper to amusing photos, delete Minecraft etc.
Having Touch ID whereby only they, me and their mother can access their devices is manna. And it makes confiscation substantially more meaningful, assuming you can switch individual prints on and off.
I can't wait, although, as I'm too cheap to ever buy them the latest gear, it'll be a couple of years before this particular paradise occurs.
With regards to the kids ignoring your requirement to not have passcodes. Well, what can I say, my kids do as i say, perhaps a different approach is in order? For example, my kids know they should not play any computer games during the week. On Saturdays they can play as much as they want. During the week it's academics, mindstorms and good old-fashion go outside and get dirty play. I've never had to enforce the rule. In general terms i think kids respond well to rules and schedules so long as these things are fairly and consistently applied.
I am not seeing the distinction. What exactly is the difference between an "identification" and an "authenticated identification"? With the family tablet, the fingerprint is still acting exactly like a password, and the reason the author is okay with it is because it's a password that's not protecting anything terribly important. Why not just have profiles that are selectable without any authentication? That would probably also work for a family tablet, but the fingerprint might be preferable to protect some info from your family members (even completely innocent things like shopping for gifts). Of course your family members could easily lift your fingerprint and bypass the biometrics, but it doesn't matter.
Of course, there are civil liberties at issue as well, since Apple could
potentially share the information collected with governments.
http://truthseekerdaily.com/2013/09/exclusive-apple-admits-iphone-5s-fingerprint-database-to-be-shared-with-nsa/
It may be an imperfect filter, but just you can't waste your time giving credence to an article on "www.gunsgunsguns.com" about why civilians need automatic weapons, or every other crackpot link.
The answer is: pretty easy.
Both phone locking technologies are not about securely protecting data, they are about preventing the phone from casual looks when you are away for 5 minutes and left your phone. And TouchID does a better job for this case.
1) Unlock using multiple fingers; 2) Unlock using the same finger repeatedly, but with different pauses between taps, e.g. two short taps, followed by one long tap; 3) Unlock using finger gesture, for example press your thumb, then move clockwise 45 degree; 4) Unlock using a single finger, the iPhone sends a passcode to your iWatch with which you can use to enter.
Such uses of fingerprint would be much more secured, yet still relatively convenient. Losing your fingerprints wouldn't really be a big problem. You only need to change the sequence.
To further the idea, iOS may offer multiple accounts. Family members may have access to a "guest" section, whereas the phone owner has full access. Fingerprints can be used to unlock the appropriate accounts.
If you think someone where you work/live might have to tools to lift your fingerprint from a beer bottle or spacebar, you probably have more serious problems than the contents of your iPhone.
I'm sure security nuts will put their iPhone in a shielded box with a coded lock on it, in addition to using (and painfully entering on each unlock) a high entropy passphrase that's as long as possible.
More power to them.
TouchID is a good enough to prevent my daughters from seeing the naughty texts I send to my wife (none of your business either), and that's more or less the level of security TouchID is designed for.
However, those of us that set security on company devices are very interested in the quality of different methods, and are glad to as many learned opinions on the matter as possible.
I'd rather type my password in every time than leave my data unencrypted--and using a fingerprint is essentially leaving it unencrypted.
I'm sure you mean the "Apple is sharing fingerprints with the NSA" link...
And the matter of default assumptions is that you need evidence that they are false. Apple denying it is no evidence. But yeah, the point about the microphone and camera stands.
* And it is obvious, no point is arguing against that. When everybody makes the same assumptin the first time they have a new piece of data, the assumption is obvious.
The OP linked to an article which said that, which sourced from the article referenced by the link to the rebuttal I posted.
"And it is obvious, no point is arguing against that."
No, it's really not obvious. Apple made very specific claims about the functionality of their product. Unless you can prove those claims wrong, you're just spreading a conspiracy theory.
- A username is something you know.
- A password is something you know.
- A pinpad is something you have.
- A finger print is something you have.
The "swipe puzzle" things (I'm not sure what to call them.)? I've been able to see people enter them once and unlock their phone. Passcodes? Even if people used secure ones, with a combo of looking while they're entering it and the smudges it leaves, it's not that hard to get.
Those are the 2 most frequent models of password input I've seen, both flawed. Any ideas for a better one?
Usernames are how we indicate an identity to a computer. (Note "an" identity; identities do not one-to-one map to humans.) Identity is what we are trying to establish in the first place; if we simply knew you were authorized to use an identity we wouldn't need auth in the first place. Having a matching fingerprint is evidence that an authorized user is authorized to use that identity. Knowing a username is not. They are not the same thing. Fingerprints are not perfect auth, but they are auth of a sort; usernames aren't auth at all.
Considering that you leave your fingerprint everywhere you touch with your bare hands, is that really true?
Further note that possession of a password ("something you know") is also merely evidence, not proof. Also, "something you have" is not proof either; having a token is merely evidence, not proof. We have no method of proof. If that is the standard you are looking for, then I have some bad news: It is impossible to meet that standard. If we did have a direct method of proof-of-identity, we would not have to talk about evidence. We would simply use the proof.
Yes, it is possible to fool even a three-factor authentication system, with enough work. That's why its important to understand that security is not about absolutes; it's about raising the cost of penetrating the security above the value of the thing being protected. Which is also why fingerprint protection is just fine for rather a lot of iPhone users; what's the payback for cracking a fingerprint scanner, just to get access to a metaphorical Grandma's phone? If you are concerned that the value of what is on your phone exceeds the costs of penetrating the fingerprint scanner, then use more authentication. It's about costs & benefits, not absolutes.
Would someone care to explain how the observation that fingerprints are indeed a form of auth, but usernames are not (often they are fully, intentionally public information!) is false, and therefore the entire premise of the post's title is incorrect, with something other than the downvote button? I'd really like to hear the explanation of how that's not true.
Well, if said Grandma is rich and is sharing dirty selfies with someone she doesn't want Grandpa to know about... being able to steal and use that information will probably be worth much more than the value of the phone itself.
This is some really sloppy thinking you're engaging in here. Rewriting questions to obtain the desired answer is a very dangerous cognitive habit to get into.
I'd rather just have an NFC chip hidden on my body that I had to tap the phone on before entering a numeric value on a randomized keypad.
It also bypasses activation lock because phones sold overseas are usually sold to countries that do not subscribe to the national blacklisted imei database and this won't block the device on their network.
No they're not. A username is something you intentionally give out to other members of some community so they can identify you. A username is by definition not secret at all, and it must necessarily be easy for others to replicate. It is not easy to replicate a fingerprint.
Can we stop with this BS already?
Why do we not just use passwords to log into things? Why do we need a Username too?
The issue this article should be trying to shed light on is one of inadequate fingerprint scanners, not that fingerprints themselves are compromised. Make a scanner that requires epidermal prints, and go from there.