News for hackers. Stuff that matters.

A comment on Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8. Parent comment

Re:Chaos Computer Clubs Breaks Iris Recognition System of th... by digi_owl on Tuesday May 23, 2017 @01:51PM (#14403415)
AS i have come to understand it, biometrics is a good identifier (telling who you are) but a lousy authenticator (telling that you are allowed).

The use of biometrics on mobile devices somewhat mix this, with the assumption that if some user was authenticated within a certain time frame (via a pin or some other knowledge bound check), a simple id is enough to extend that authentication.

[ Parent | on HN ]
Re:Chaos Computer Clubs Breaks Iris Recognition System of th... by falsedan on Wednesday May 24, 2017 @11:09AM (#14410549)
> authenticator

Authorization is the counterpart to Authentication: authentication proves who you are (with passwords/tokens/biometrics aka something you know/have/are), authorization controls what you can do (with permissions/ACLs/roles/etc.)

To put it another way, the bouncer at a club checks your photo ID to see that you match it (authentication via something you are), then uses it to see if you can enter (authorization by checking your birthdate against a cut-off/name against a guestlist).

[ Parent | on HN ]