Re:The inception bar: a new phishing method
by jsmith99 on Sunday April 28, 2019 @04:47AM
(#19770061)
That's why Windows can be set to require Ctrl+Alt+Del before login as it can't be intercepted by a fake login screen.
[ Parent
| on HN ]
Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face.
Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.
Re:The inception bar: a new phishing method
by joe5150 on Sunday April 28, 2019 @06:16AM
(#19770312)
how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id.
That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).
Re:The inception bar: a new phishing method
by hvidgaard on Monday April 29, 2019 @07:16AM
(#19777345)
I happen to be in a situation where I have a phone with Face ID and one with Touch ID.
Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are.
Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.
Re:The inception bar: a new phishing method
by fgkramer on Sunday April 28, 2019 @06:05AM
(#19770282)
Maybe is up to implementation? I've got an X and the intent to pay pops up the native pay modal, which still requires you to double press the power button AND to be authenticated. So what you say never really happens.
Re:The inception bar: a new phishing method
by mimi89999 on Sunday April 28, 2019 @07:09AM
(#19770471)
Yes, but it isn't very effective because if the computer is left with the login screen visible after Ctrl+alt+del opened in a full screen browser, users will simply proceed directly to typing their credentials. Then an endless logging in dialog could be presented, so that the user thinks it is a problem with the computer.
Hmm not if your users are trained to press Ctrl-Alt-Del again... The login screen would also allow them to order the OS to log off the current session too.