|
United States24776 Posts
I was reading this which got me thinking about the idea of having our devices scan our fingerprints (or other biometrics) not just for logging into your device, but also for use as online passwords. I don't understand the details of how this will work, at all. However, this seems like a terrible idea (and one that several big companies seem to be behind).
As things stand, a silly mistake on my end, or a security breach online, can result in crackers/hackers getting some of my passwords. Once they have them, they can log into any services I have where they know both the username and the password (some services have multiple layers of protection, though). If logging into say, paypal, required me to scan my fingerprint on a device attached to my computer, it might seem to make it much more difficult for a malicious user to gain access to my account since it's easier to enter in a stolen password than it is to enter in a stolen fingerprint.
However, sooner or later, someone on our side (innocent people) is going to screw up somewhere and bad people will get access to the data that is sent from our fingerprint reader to a login page, and they will now have the digital equivalent of your fingerprint. They can then replicate it and use your digital fingerprint to log into other services you have an account with, as well. This creates two problems:
- You are essentially using the same password for every website now, your fingerprint, instead of a variety of works/phrases, so this cracker/hacker can get access to almost anything.
- You can't simply change your password once you receive word of a security breach like everyone is doing with heartbleed... you only have one set of fingerprints (except for Will Smith in MiB perhaps)
I'm sure some of the people involved in the development of using fingerprints for passwords have given this some though, and have some answers. But it seems to me like the core issues will still be there, and this won't really be any better for us than our current password and identity validation system.
 
|
This seems to go in the same direction as when parents had gps chips implanted in their kids finger which resulted in kids getting their fingers cut off when they were kidnapped.
|
On April 16 2014 20:46 Kleinmuuhg wrote:
This seems to go in the same direction as when parents had gps chips implanted in their kids finger which resulted in kids getting their fingers cut off when they were kidnapped.
What the fuck. I never heard of this. Thats sick.
And yes fingerprints for passwords is a stupid idea, there are just too many ways of gaining that information or replicating it.
|
I believe most credible security experts are against biometric passwords for those very reasons. At best a fingerprint seems like it'd be a viable replacement for something like an RSA token (think the blizz authenticator) in cases where you want some extra security, but not enough to hand out an RSA dongle to everyone. In that case your fingerprint is the "something you have" part of the security, but something you know is still required for account access.
A third problem not mentioned is it's a bit discriminatory against people who can't use their hands (either because they don't have them or due to other conditions that reduce motor skills).
Uh also people who have recently lost limbs may find themselves locked out of their accounts. Even a big enough scar on a finger could do it.
|
Pandemona
Charlie Sheens House51493 Posts
|
meh you wrote this disregard
|
Seems like a bad idea indeed ><
|
Fingerprint scanners only work in person. Over the internet they're actually worse than standard passwords. It's just too easy to send a fake fingerprint.
|
I always thought this would be awesome for Passports, complimented with some type of security questions, but much beyond that it seems limited. No one is going to walk into an airport with a severed finger.
There is also the whole issue of having that kind of information on record with governments which I wouldn't care to delve into.
|
I work at a University It department and we have had laptops which you can log into with fingerprint scanners. Unfortunately the fingerprint technology is too poor for it to useful. You can attempt multiple times and basically lick your finger to use the wetness to access a machine that is not yours.
If the technology becomes better it still has all these problems you wrote about:
1. Having the same password everywhere is a very bad idea as you stated. An IT department will have multiple user accounts to prevent abuse of all them if one becomes "cracked" by a malicious user.
2. Forced password changes are a integral part of IT security.
Possibly you could integrate something like fingerprint scanners with an authenticator token (think battle.net Token) but that still leaves the problem of you having an account, that cannot change your password for. Come to think of it the IRIS scanners probably will face the same challenges, if it wants to become the defacto standard and not just an additition to normal account security.
For the moment passwords are here to stay it seems.
|
Using a fingerprint as a password is ultimately little different from having a very complex password that you carry around with you (tattooed on your chest maybe). I don't see the appeal at all, other than increasing the complexity of the typical password (is this really a concern? how often are security breaches due to password guessing?).
|
On April 17 2014 01:18 Alzadar wrote:
Using a fingerprint as a password is ultimately little different from having a very complex password that you carry around with you (tattooed on your chest maybe). I don't see the appeal at all, other than increasing the complexity of the typical password (is this really a concern? how often are security breaches due to password guessing?).
Brute force is a still a very common method of obtaining data, generally it is a weakest link kind of thing. If you have valuable data, someone, somewhere on your network has a password that is six characters and all alphanumeric with no special characters.
|
On April 17 2014 01:28 ThomasjServo wrote:Show nested quote +On April 17 2014 01:18 Alzadar wrote:
Using a fingerprint as a password is ultimately little different from having a very complex password that you carry around with you (tattooed on your chest maybe). I don't see the appeal at all, other than increasing the complexity of the typical password (is this really a concern? how often are security breaches due to password guessing?). Brute force is a still a very common method of obtaining data, generally it is a weakest link kind of thing. If you have valuable data, someone, somewhere on your network has a password that is six characters and all alphanumeric with no special characters.
Can't you only brute force effectively if you have some other breach (stolen password hashes)? Most online systems don't allow unlimited password attempts.
|
You could have 10 passwords though! That's more than the 4-5 I use... Plus I could imagine a system where you'd log in by inputting your fingerprint AND doing a little motion on the sensor, like an X of a squiggly line or something like that.
That said, I don't mind typing in passwords.
|
I have 7-8 passwords that I rotate on all my accounts every 4-6 months, and I have different passwords on all my accounts.
Then again, I have been hacked and had issues with security in the past so I am a little paranoid XD
|
On April 17 2014 02:56 Alzadar wrote:Show nested quote +On April 17 2014 01:28 ThomasjServo wrote:On April 17 2014 01:18 Alzadar wrote:
Using a fingerprint as a password is ultimately little different from having a very complex password that you carry around with you (tattooed on your chest maybe). I don't see the appeal at all, other than increasing the complexity of the typical password (is this really a concern? how often are security breaches due to password guessing?). Brute force is a still a very common method of obtaining data, generally it is a weakest link kind of thing. If you have valuable data, someone, somewhere on your network has a password that is six characters and all alphanumeric with no special characters. Can't you only brute force effectively if you have some other breach (stolen password hashes)? Most online systems don't allow unlimited password attempts.
At certain points of course, but the top comment in an /r/askreddit thread today sums up the actual inner workings of most systems nicely. But even for putting in credit card information there are points where systems won't try to stop what is being put in, not all of course but not everyone uses Gmail, or comparatively up to date services.
"Hackers" of Reddit, what are some cool/scary things about our technology that aren't necessarily public knowledge? [Serious]
As someone who has programmed since the late 80's the scariest thing is just how flaky everything is.
It's turtles all the way down except the turtles are horribly written unmaintained code that no-one commented and the guy who wrote it left the company 5 years ago to take up yak farming.
Our entire modern economy and to some extent society is entirely dependent on systems that where written by people like me.
That is fucking terrifying.
My favorite analogy is how a lot of these systems are like a severely overload surge protector once you're in.
That is kind of what I am getting at with the weakest link in your company or network. The vast majority of people that are trying to obtain valuable information do so in surprisingly simple ways, like calling you and pretending to be a CSR for a major corporation, send mass emails from domains like @Bestbuy.biz.com (some peoples spam filters still don't catch these, I hear about them daily), or even text messages sent out to almost any phone number that will take it.
Get a rube to volunteer information, and use it in every way you can think of. Email/Password combinations, how many sites can this work on? What information can I get at, can I translate it into more money for the time I am investing in using your information. It all ties in nicely with social media literacy.
|
The big problem is people reusing passwords (i do it too), because you have a bazillion different services you need, and then those sites managing to lose all their account data to criminals.
fingerprints actually dont help with that, they just create longer passwords and unless you need them NSA-proof, 2 or 3 normal words put together is allready save.
im not even using much stuff and i allready had 3 companies lose my data. Cant really blame all internet users when a multibillion dollar company like sony is losing a few hundred thousand client accounts inclusing billing information.
That should be fixed first and companies should be held responsible for the damage they caused. Right now, they just write a mail with "oopsie, we lost your account data, please change your password. And oh, if someone is using your bank account, that might be on us, but good luck proving that in court".
They need some monetray incentive to not have their interns manage account security.
then noone gets my important passwords and i dont have to remember 20 different ones in the first place.
|
I have a habit of not leaving my passwords lying around on every surface I happen to touch.
|
On April 17 2014 05:46 Deleuze wrote:
I have a habit of not leaving my passwords lying around on every surface I happen to touch.
You're strange. By the way, my name is ThomasjServo and I am a part of the new BT forum interaction team. Due to a complication with a payment processor and to ensure the on going, positive state of your account, I need to verify your log in information via personal message on this site.
|
On April 17 2014 02:56 Alzadar wrote:Show nested quote +On April 17 2014 01:28 ThomasjServo wrote:On April 17 2014 01:18 Alzadar wrote:
Using a fingerprint as a password is ultimately little different from having a very complex password that you carry around with you (tattooed on your chest maybe). I don't see the appeal at all, other than increasing the complexity of the typical password (is this really a concern? how often are security breaches due to password guessing?). Brute force is a still a very common method of obtaining data, generally it is a weakest link kind of thing. If you have valuable data, someone, somewhere on your network has a password that is six characters and all alphanumeric with no special characters. Can't you only brute force effectively if you have some other breach (stolen password hashes)? Most online systems don't allow unlimited password attempts.
If your data is sensitive enough, there's a different definition of "brute force" that may apply...
http://xkcd.com/538/
|
Cascadia1754 Posts
In my opinion, most biometrics should at most be used as an identifier, like your username, and not as password. Identifiers are things only you are, passwords should be things only you know.
|
On April 16 2014 20:25 micronesia wrote:
I'm sure some of the people involved in the development of using fingerprints for passwords have given this some though, and have some answers. But it seems to me like the core issues will still be there, and this won't really be any better for us than our current password and identity validation system.
The issue with stealing physical fingerprints is a real one (and is why using your fingerprint to lock your iPhone is great against burglars but terrible against the police, although miles better than a terrible 4 digit numeric code).
However, the fear that a security breach on one site that you authenticate with will leak your password to all other sites is in fact mitigated with the suggested fingerprint technology. Currently, most websites use a salted one way hash to store your password, so that given a password, you can generate a unique key, but given a unique key, it is very hard to find the password (unless your password sucks). But even so, breaking into the server and obtaining the hash still obtains relevant information about the password.
Fingerprint technology paired with a scanning device allows us to use "zero-knowledge" authentication, which means the website will know that you know the password, but no one watching or peeping on this exchange will have any idea of what is going on, and couldn't tell the difference between a real handshake and a fake handshake. So ideally, there would be nothing that could be stolen on the server side that will log you into other servers with their own authentication scheme. http://en.wikipedia.org/wiki/Zero_knowledge_proof#Abstract_example
|
Biometrics as the main access key to anything is not the way to go for any service and pursuing them is the path of tyranny.
First of all, its imperfect, your body will be stolen or reproduced. Does not require "you", which is the intent, but its not a wizard's spell from dungeons and dragons, magic doesnt exist
secondly, we're already monitored and measured by governments and corporations all day every day, a secure code in your head for a closed (non internet) network is safest and will always be closest to a vault with complex physical key system. Tying it to your body means everyone knows what your key looks like and where you keep it.
Really it just seems shortsighted at best, tinfoil-hat conspiratorial at worst. I'm sure it's appropriate as a layer or in some specific security circumstances, but holy shit it just does not seem to be a good idea in this day and age, to login to your phone computer and social media with your biometrics on the open web/telephony system.
|
|
|
|
|
|
EPT
