undefined | Better HN

0 pointskortilla6y ago0 comments

You highlight flaws in faceid, etc but passwords also have flaws.

- Fingerprints can be lifted from pictures. - Passwords can be forgotten and thus have seriously flawed reset schemes that often fallback to something as simple as having the right phone or backup code. - passwords can be lifted by keyloggers - passwords can easily be phished - passwords can be shared

Authenticating access can come from 1 or more of: something you know, something you have, something you are.

They each have flaws. They all do the same thing.

0 comments

NeedMoreTea6y ago

They don't do the same thing. All the flaws in passwords can be avoided, the semi-public state of biometrics cannot.

Authenticating access, if you follow standard security practice, should be at least two of, and preferably all three of: something you know, something you have, something you are. Not one or more.

kortillaOP6y ago

There is no axiom that the flaws of biometrics cannot be avoided. “Something you know” is in fact a biometric property of the brain that can easily be transferred.

Touch ID combines something you have with something you are. It’s easily better for 99.9% of the threats out there that result from weak passwords shares across sites and users trained to type them into anything that resembles the real logon page.