Feds Walk into a Building and Demand Everyone's Fingerprints to Open Phones

Re:Feds Walk into a Building and Demand Everyone's Fingerpri... by toomanybeersies on Sunday October 16, 2016 @05:27PM (#12721077)

I heard fingerprints described as "Authentication, not authorisation", which I think is a better description of the role they play (on the iPhone, at least), and the role they should play.

They authenticate who you are, they aren't trivial to fake. However, they shouldn't authorise access to a device on their own. Your fingerprint works as a somewhat more secure, medium term swipe-to-unlock for your phone.

[ Parent | on HN ]

Re:Feds Walk into a Building and Demand Everyone's Fingerpri... by rdtsc on Sunday October 16, 2016 @10:00PM (#12722235)

> I heard fingerprints described as "Authentication, not authorisation",

I understand once you've authenticated who the user is, authorization is just a mask of what they are allowed to do. It is like saying "after you've given your username (GMail account) to Google, it should allow you to read your email. If you happen to be an administrator for Google Business account you can also see other accounts or settings etc".

So hopefully you meant that you just use your fingerprint in place of typing out your username not in place of typing your username _and_ password.

[ Parent | on HN ]

Re:Feds Walk into a Building and Demand Everyone's Fingerpri... by raphman on Monday October 17, 2016 @12:48AM (#12722751)

One could see fingerprint and user/pw as two different roles - with different levels of authorisation.

(Somehow similar to sudo which asks for the user's password the first time but assumes that the logged in user is allowed to execute further sudo commands without pw auth. Even if sudo does not really implement two different user roles here.)

[ Parent | on HN ]

Re:Feds Walk into a Building and Demand Everyone's Fingerpri... by joshuahutt on Sunday October 16, 2016 @06:36PM (#12721437)

Authorization typically means what actions the authenticated user is allowed to perform, not that the authenticated user has herself conveyed some kind of approval.

[ Parent | on HN ]

Re:Feds Walk into a Building and Demand Everyone's Fingerpri... by dagss on Monday October 17, 2016 @03:02AM (#12723136)

Careful, authentication / authorization have specific definitions in software development which are at odds with what you say. A username/password together would be authentication.

[ Parent | on HN ]