Fingerprints Are Usernames, Not Passwords (2013)

Something I feel that's always missed in these discussions is context: Who is the adversary you're attempting to protect against?

Your kids screwing around with your phone? TouchID does the job.

Random people screwing around with your phone if they find it? Same thing.

Government gets ahold of it? Yeah.. notsomuch.

Considering that the primary adversaries of an average smartphone user are other mere mortals, not dedicated spy agencies, a fingerprint login strikes a very good balance between usability and security.

Consider the alternative - either requiring a standard alphanumeric password on unlock (just about zero usability), or a 4 digit pin code (less usable than the fingerprint while providing identical, maybe slightly less security than that option), or more likely than not, no password of any kind, the whole touch ID thing is a massive jump forward in the security posture of the average iOS user.

Most iOS users I know have it enabled simply because it means they don't have to keep re-keying their app store password.

I always get the sense of cognitive dissonance when I read security researches and advocates write about passwords and fingerprints. If you have access to my device, you have access to my physical person, and my physical person will freely give up any password because no secret I have is worth my life. This isn't Hollywood, I'll give up my password with even the hint of physical violence that could maim or otherwise affect my quality of life.

Fingerprint readers, as Apple uses them per device backed by a strong high entropy password, are good enough for securing the average persons access to a device.

My physical security, something much more dear to me than my secrets, is protected not by keys and tumblers, but by a 1/4 inch of glass that can be cut through in seconds with $5 from the hardware store. Even the key and lock can be circumvented with a rubber mallet and a bump key, or a set of picks. So why use them? Because locks keep honest people honest, and those looking to cause you harm will cause you harm, regardless of what digital security you use.

His argument proves too much. If he thinks fingerprints are too insecure to be allowed, then he must think the same of low-entropy passwords. Yet I don't see him advocating that Ubuntu force users to choose high-entropy passwords and rotate them regularly. If he's fine letting users choose a low level of security by picking simple passwords, why not also let them choose to auth with fingerprints?

Also, I think he misconstrues the purpose of Touch ID. It's not meant to completely replace passwords.

There are three categories of authentication methods:

1. Something you know (password, combination, challenge responses).

2. Something you have (crypto token, phone, key).

3. Something you are (fingerprint, face, DNA, etc).

Methods can be combined for added security. All three have advantages and disadvantages. Passwords are typically chosen by users, making them weak. Good crypto tokens are hard to copy, but loss or theft can mean getting locked-out. Biometrics are convenient, but can't be revoked. Also, some activities can make them hard to read.[1]

Apple uses all three authentication methods in the iPhone. Touch ID is for basic access. The passcode is for admin-level functionality like erasing or restoring the device. Lastly, physical access to the phone is required to decrypt important data such as Apple Pay's Device Access Numbers. This gives typical, non-technical users a sane combination of security and convenience. If thieves and scammers start copying fingerprints, Apple will change their auth mechanisms.

1. I love Touch ID, but it takes a while to work again after I rock climb or lift weights.

I don't think many (outside of perhaps Apple PR?) have argued that fingerprint security is great, absolutely speaking. Relatively speaking, however, it is great, as many phone owners would otherwise not have any sort of locking security on their devices at all. Yes a fingerprint unlock is hackable, but it's a lot less hackable than your phone being open from the get go.

Everything about this article is well-intentioned — and wrong.

"much as a your email address or username identifies you, perhaps from a list."

Your email address or username may identify you, but it also may not. Your fingerprint absolutely identifies you and only you.

"For authentication, you need a password or passphrase. Something that can be independently chosen"

A password is a secret phrase. We're used to thinking about passwords in terms of strings, but anything secret that I know about would serve the definition. In fact, like a character-based string password, I can even make a copy of my fingerprint password and store it somewhere if I wanted a backup.

A fingerprint is both a username and a password. Trying to hold some analogy between Touch ID and traditional username/password combinations doesn't hold and it completely misses the point of the innovation.

That's why it's convenient, and skepticism of civil liberties aside, convenience means better security because people will use it.

Dustin Kirkland gets it.

Simplifying his post, there are 3 reasons biometrics are terrible for authentication:

1. Every piece of biometric data is inherently public. (Fingerprints, facial geometry, hand geometry, even DNA)

2. Biometrics require an error threshold as our bodies are always changing (that's like typing a 20char password and having only 15 of them be correct. That's fine! Let them in anyways with 5 incorrect characters)

3. Key revocation. I can change my passwords and locks if you get a copy of my passwords or keys... but once you have a copy of a biometric identifier I cannot use that again for the rest of my life.

Well done, Dustin.

This article is from 2013. While things didn't change a lot (this years TouchID was broken as well IIRC, though I've heard it got a little better), it's hardly news.

Also, I don't think even Apple advertises its fingerprint scanner as a replacement of passwords. It is a replacement of 4-digit PINs, and for that it is far more secure. While members of CCC have the knowledge of lifting a print, most people do not have this knowledge or tools. And if you notice your phone is stolen, you can always log in to icloud.com (with your password, you cannot use TouchID there) and lock down/reset your phone immediately.

How about the user gets the option to add NFC pairing so strengthen the security of the fingerprint. Once the user sets both up, then he won't be able to login until both are recognized for authentication. It should be hassle free if that NFC pairing comes from a smartwatch or smart-band and he just picks up the phone with that hand. The NFC authentication should happen automatically without thinking about it.

The NFC would essentially function as an OTP 2nd factor (or FIDO U2F if that's better) to the fingerprint being the "password".

In the case of Touch ID, please consider that in order to circumvent it, you not only have to be able to fool the Touch ID sensor, you also have to have physical access to the device.

As with many things, it depends heavily on what you're using it for. Not as pithy for a title though, I suppose.

No amount of information entered into a computer fully proves it's you and not someone else. A fingerprint provides some information, as does a password.

This sounds like a fairly useless distinction, but hopefully this will make sense:

If all we're doing is trying to prove we're us and not someone else, why do we need a username at all? What added bonus is gained from having a completely public bit of information?

Well that's because:

1. People are bad at picking passwords, if everyone picked a 2000 character random password and kept it secret we'd not really need anything extra 2. You can't inform people if they've picked the same authentication as someone else, so you prefix it with a per-user unique value which you let people know will be public

I don't really see fingerprints as a username or a password. They're just another hint to the system that it's probably you, and you can use any combination of those three depending on what you actually care about.

For example:

I don't have a username on my phone to unlock it, just a password.

I have a username and password for HN.

I have a username, password and physical auth device for work-related logins.

The latter two are fairly obvious as differences in how important it is that I'm verified to be me, the former is because I mostly want my phone to distinguish between me and my pocket.

> But biometrics cannot, and absolutely must not, be used to authenticate an identity.

This is incredibly context dependent.

My pithy one liner:

All absolute statements are flawed.

I agree with the below comments. These types of papers are always emphasizing rigor over actual experience.

Many types of "100%" security fail because of this disconnect. Forced rotating passwords or long ones with required symbols and number? Most people choose to have easy to remember ones (e.g. pass1, pass2, pass3,) Or it's so difficult to memorize that they'll write it down somewhere nearby.

The points are important, but they're directed at consumer products. I wonder how the same person would look at bike-locks...which even with the most expensive locks are only a deterrent given the right tools.

Fingerprints are not bad for local authentication. For instance if phones become more used for payment I would expect my phone to contain a secret key for payment that is unlocked easily which a fingerprint could do. So in order to compromise this they would need to get both my private key and my fingerprint. If my private key were compromised, I could then get another key. The article is right though that fingerprints should not be used as the sole means of auth though for the sheer reason that it cannot be changed.

Fingerprints aren't passwords. They also aren't usernames. They're fingerprints, and they have different characteristics from both usernames and passwords.

Rather than try to shoehorn fingerprints into our existing terminology, let's look at what fingerprints can do and what implications they provide, and then use them accordingly. The article sadly fails to do this.

Just no. Since old times fingerprints were used as a unique signature, not an unique id.

Unique id could be something as silly as

  sha256(concatenate(full-name,date-of-birth,place-of-birth))

or just any unique number, like cell phone number.

Again, a fingerprint or an image of a retina is a signature or password not an id or username.

Can a fingerprint even be used as an encryption key? I'd imagine that the reader doesn't generate the exact same data on every scan, and to get a "yes/no" requires seeing if the scanned print is within a certain margin-of-error of a stored print.

Typically security involves three things:

* Something you have (like an access card or badge)

* Something you know (like a password)

* Something you are (like a fingerprint, iris scan, or a simply a photo)

Fingerprints are bit weird as you do in fact leave them around everywhere. Like iris scans I would qualify them as better photographs.

Passwords are not passwords, they are usernames. It's a part from the combination to identify you, while unlike usernames, it's hidden by design. Fingerprints are like passwords, they can't be easily copied and be reused somewhere else, for now.

I think fingerprint should still require a password after a duration. I'd be fine with using my fingerprint to login if I have recently logged in in the last few hours.

Good post, this is so true. Fingerprints should only be used as id, if at all. Like 'icebraining' said: Passwords can be compromised and must be changeable.

Why not both?

First, a fingerprint is unique, also serves as _identification_.

Secondly, a fingerprint is secure to a very high degree - cannot be easily stolen and duplicated, always is with you and so on. Thus, it serves as _authentication_ too.

EDIT: to the downvoters and critics: what you describe is using an _excess_ of effort to get my fingerprint ( technically, using force, etc ) . If I see a password, I can use it immediatelly, if you see my finger, there is a long way ( in terms of steps) until you can use the fingerprint attached to it. And btw, I am not defending Apple here.

We know, apple knows, everybody knows. Marketing.

This feature gives them some great marketing, and it works.