Web Authentication: Proposed API for accessing Public Key Credentials

Re:Web Authentication: Proposed API for accessing Public Key... by throwawayReply on Tuesday April 10, 2018 @11:23AM (#16802012)

1. A fingerprint is something you cannot change, cannot revoke if leaked and cannot be unique across different sites.

2. A fingerprint hash isn't a cryptographic hash because you need to be able to match to nearby matches. A small variation in input needs to have a small variation in the hash so a distance function can be applied.

Those are terrible properties for a password.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by dspillett on Tuesday April 10, 2018 @11:42AM (#16802187)

> A fingerprint is something you cannot change

Many builders/carpenters/etc will tell you this is not true. People who work in abrasive environments sometimes without proper protection often temporarily have no fingerprints as they are "warn off".

Many injuries can effectively modify or remove the too, at least temporarily.

This makes them bad usernames as well as bad passwords.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by gfo on Tuesday April 10, 2018 @12:10PM (#16802431)

> People who work in abrasive environments sometimes without proper protection often temporarily have no fingerprints as they are "warn off".

Do they come back in the same form as they previously were?

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by marzell on Tuesday April 10, 2018 @04:20PM (#16804932)

Either way, this is a terrible argument toward good security. "Oh, someone got a copy of your fingerprint? No problem! There's a belt sander right over there!"

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by underbluewaters on Tuesday April 10, 2018 @12:25PM (#16802577)

This is a sore point with the new iphones for me. It happens at least once a week with routine hobby-farm work. I'm really looking forward to getting faceid.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by Tharkun on Tuesday April 10, 2018 @12:32PM (#16802661)

Interesting. I wonder if anyone has studied what it would take to render fingerprints useless? Like N minutes/day of sanding with Y grit sandpaper?

Additionally, I was under the impression that some fingerprint readers looked at the blood vessels rather than the actual prints. Not sure how that would be affected by abrasion. Perhaps this is a misunderstanding on my end.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by cpeterso on Tuesday April 10, 2018 @03:05PM (#16804139)

An example that can affect many people: my iPhone can't read my fingerprint when I'm sweating at the gym.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by andrewstuart2 on Tuesday April 10, 2018 @11:36AM (#16802116)

IMO, you don't even need any arguments beyond #1. Your fingerprint can't be changed and it's public information. You leave traces/copies of it everywhere you go. Just because it's more difficult to read now doesn't mean that technology won't make lifting and reusing your oily prints trivial someday.

Would you create a rubber stamp of your passwords, slather it with oil, and then go around stamping it on everything you own and everywhere you go?

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by ng-user on Tuesday April 10, 2018 @12:33PM (#16802673)

This is the current case with SSN's in North America. A unique identifier being treated as a password cannot act as a password.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by paulcole on Tuesday April 10, 2018 @11:43AM (#16802192)

But you have 10 of them (20 counting toes). Why can't you just cycle through them as needed?

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by paulie_a on Tuesday April 10, 2018 @12:22PM (#16802543)

"Press your toe here" has to be some of the worst ux ever

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by estebank on Tuesday April 10, 2018 @09:07PM (#16807213)

I see that you haven't used git.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by todd8 on Tuesday April 10, 2018 @11:57AM (#16802314)

You can just keep your socks on to protect your login toeprint when not in use.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by volkk on Tuesday April 10, 2018 @12:18PM (#16802496)

furthermore, you can combine your fingers/toes in specific unique combinations. it's foolproof

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by neolefty on Tuesday April 10, 2018 @04:15PM (#16804882)

I like it. Two factors in one! Even allows panic passwords.

[ Parent | on HN ]

Re:Web Authentication: Proposed API for accessing Public Key... by eafkuor on Tuesday April 10, 2018 @02:44PM (#16803945)

And let's not forget that some people don't have fingerprints

[ Parent | on HN ]