I want this, and also the ability to secure different areas of my phone.

I want to be able to set touch or PINs for certain apps, so that I can have multi level security. Why is there so much emphasis on one master password/touch ID/face ID instead of having multiple security checks?

All of my banking apps, among others (e.g. password manager), include options for both pin and touchID auth. Do we not already have what you’re asking for?

I think he's requesting it on the system level. For example, if iOS allowed you to force PIN+TID when opening a specific (not necessarily secure) app for the first time after an unlock. Intended for apps that don't necessarily have security built in already.

This is especially useful for when the app developer doesn't think there is a reason for them to develop such a system. For example, I don't want my son playing a zombie game, but I myself play it often. I could then lock him out of said game, but still give him my phone to use.

This isn't exactly what you are looking for, but have you tried Guided Access on iOS (or whatever the equivalent is on Android)?

Yes, that is the way I do it currently. It's a real pain though.

Which password manager are you using? 1Password doesn't support TouchID + PIN on iOS, but I wish they would.

I'm using LastPass on Android, and I have it set to require both my fingerprint and my LastPass password.

I've been wondering that too. If possible, it'd be nice to combine username, second-factor, and password, as they all perform different functions that people often ambiguate:

- Your username is who you think you are.

- Your second-factor (faceprint, thumbprint, keyfob) is who you claim to be.

- Your password is your proof.

Setting up a new device does require three factors: Username, Password and a 2FA on an existing device.

But even with a 4 digit PIN most people didn't have PINs set up on their devices, so increasing friction will not result in more security.

If you want max security now, you can simply turn off TouchID or FaceID and us a very long alpha numeric password.

Large public systems could do away with usernames if they assigned random, unique passwords to users out of a large keyspace. Usernames allow the keyspace to be smaller and the keys have less entropy making user chosen keys possible. But then we add key minimum entropy requirements (sometimes using only length as a proxy) in order to combat the freedom given.

Would be interesting to see whether username-less public systems suffer fewer intrusions. Some users would record their passwords in unsafe places, but they couldn't reuse a password eliminating password stuffing as an attack surface.

Of course, if you allow password resets you'd still have a kind of "backup" username presuming a person's email address could be used for the reset. But that wouldn't significantly weaken the security, arguably.

I also believe that TouchID + FaceID would be a good combo as well for the vast majority of users. Both technologies seem to be relatively foolproof and user-friendly. Upping the ante from a security perspective would be a good thing. Unfortunately, that won't come to fruition.

There still must be another mechanism to access it like a password. What if the camera fails? What if you get punched in the face that day?

That’s what it does right now - if Touch ID or face id fails you still have your password to fall back on. I think it may do this automatically if the touch sensor dies but you can always force it with the 5x quick taps on the power button.

It is, but GP is saying if the auto method is FaceID + password and FaceID doesn't work... then what? Clearly just the password isn't enough to get you into the phone.

We can have two options for unlock: (Face ID + PIN) OR (Alphanumeric Passphrase). The former for daily use and the latter as backup or for system restart.

I'm calling it that Touch ID will make a comeback: https://twitter.com/ernsheong/status/908018119595003904

How bout: Touch ID + Face ID. Hahaa

I'm not sure that Touch ID can come back in its current form. Phil stood on stage and told us Touch ID is 50,000 secure and Face ID is 1,000,000 secure.

I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.

Agreed. If you could make it so every single tap was scanned, you could make the phone so secure, yet so simple to use.

The phone could constantly monitor both Face ID and full-screen Touch ID at the same time, and if it detects anything funky going down it can panic and lock. Would close down attacks where someone grabs your phone off you while it's unlocked and quickly disables security.

But then people you hand your phone to wouldn’t be able to use it

Authenticating every touch sounds way overkill. And your friend can't help you navigate around anymore :( Some human element is lost.

> I think the only way for Touch ID to come back is for it to cover the whole display, so it can authenticate every touch.

Touch ID only works on the first try about half the time for me, I would love to bring that experience to all my interactions with my phone.

You could set it up that at least one fingerprint has to be recognised correctly every X seconds.

I highly doubt this would be possible for a long time, but it would be interesting if Apple could equip the entire display a TouchID sensor. If you could scan all of our fingertips, then you could theoretically "sign" every interaction with the display.

Exactly what I'd like as well. I'd like to be able to use one of two methods to unlock: a fingerprint and a modest PIN (with lock-out after a couple of tries), and a long passphrase (also required at boot).

The problem is that the PIN is always dominant over Face ID or Touch ID. Face ID doesn't work? Use your PIN. What happens if you use local 2FA and your Face ID doesn't work? You can't enter the PIN, because that would effectively render 2FA useless. This would probably require some master PIN, which makes things more complex, and increased complexity correlates which reduced security.