Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ...
by Eridrus on Sunday May 07, 2017 @10:59PM
(#14288947)
Fingerprints can certainly be "amputationware" if you refuse to give up your passcode and your threat model has a credible threat of amputations.
For most people, having their unlocked phone snatched out of their hands on the street[0] is a far more credible threat and somehow we don't have everyone saying you shouldn't unlock your phone outside.
[0] https://www.theverge.com/2016/12/2/13819288/uk-police-encryp...
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ...
by xellisx on Friday May 05, 2017 @01:01AM
(#14271220)
Yeah - I was going to saw something about people with extreme eczema suffers (Which I happen to be one), can have issues with skin just splitting open on tips of the fingers. This is the reason I don't use my finger print scanner on my phone...
Re:Thieves drain 2FA-protected bank accounts by abusing SS7 ...
by tdist on Friday May 05, 2017 @08:39AM
(#14272946)
Do note however, that masterprints are not applicable for all current solutions.[1] Their statement is of course biased, but they nevertheless point out a significant flaw in the referenced study.
[1]: https://corporate.fingerprints.com/en/newsroom/faq-regarding...
Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home.
But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern from the reader well enough, it can be fooled. (Yep, done already.)
My personal take on fingerprint authentication is that they are not passwords. They are usernames.
0: http://engineering.nyu.edu/press-releases/2017/04/10/so-you-...