News for hackers. Stuff that matters.

A comment on The inception bar: a new phishing method. Parent comment

Re:The inception bar: a new phishing method by baddox on Sunday April 28, 2019 @05:25AM (#19770178)
Similarly, the iPhone X requires double-pressing the power button to complete a purchase using Face ID. Previously, with Touch ID, the authentication action itself was also sufficient to establish intent (placing the finger on the sensor). But with Face ID, any app could just pop up the purchase window and Face ID would see your face.

Incidentally, this is why Face ID is strictly worse than Touch ID in my opinion.

[ Parent | on HN ]
Re:The inception bar: a new phishing method by joe5150 on Sunday April 28, 2019 @06:16AM (#19770312)
how is it worse? touch id’s serving as authentication and approval for payment was actually exploited as a scam. I don’t see how this could be done with face id.

https://www.wired.com/story/iphone-touch-id-scam-apps/

[ Parent | on HN ]
Re:The inception bar: a new phishing method by baddox on Sunday April 28, 2019 @04:06PM (#19773370)
That’s fair. I never encountered anything like that. In my experience Touch ID was faster, more reliable, and more versatile (e.g. able to be activated with the phone lying on a table without peering over it with my face).
[ Parent | on HN ]
Re:The inception bar: a new phishing method by hvidgaard on Monday April 29, 2019 @07:16AM (#19777345)
I happen to be in a situation where I have a phone with Face ID and one with Touch ID.

Touch ID with wet or slightly dirty fingers are not good. I've been doing some gardening over Easter and Touch ID is barely working because my fingers are more rough than they normally are.

Face ID on the other hand, works just as expected. It doesn't work optimally if I'm lying down, but that's not a problem for me personally.

[ Parent | on HN ]
Re:The inception bar: a new phishing method by fgkramer on Sunday April 28, 2019 @06:05AM (#19770282)
Maybe is up to implementation? I've got an X and the intent to pay pops up the native pay modal, which still requires you to double press the power button AND to be authenticated. So what you say never really happens.
[ Parent | on HN ]