The fix will just have to be building a profile of what screen protectors look like to the sensor and rejecting registrations that look like them with a helpful message about screen protectors.
I was able to register my nose to unlock the phone via the "fingerprint" sensor. Interestingly enough, it will reliably unlock with my nose, but not with either of my daughters' noses.
Something you have.
Something you are.
Something you nose.
Is this an example of AI gone bad, or something else?
That’s a total f’n failure, not just “a bug.” You only release such things after super duper thorough testing.
The process described above proved to be somewhat unreliable as the depth of the ridges created by the toner was a little too shallow. Therefore an alternative process based on the same principle was utilized and has been demonstrated in an extended video available here. First, the residual fingerprint from the phone is either photographed or scanned with a flatbed scanner at 2400 dpi. Then the image is converted to black & white, inverted and mirrored. This image is then printed onto transparent sheet at 1200 dpi. To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use."
I'm not sure I would classify a process like that as being similar to putting a screen protector on.
Hah, this was the first thing I tested with Face ID when I got my iphone 10. If you look at it with your eyes closed then it won't unlock. Open your eyes and it instantly unlocks. It spent about five minutes playing peek-a-boo with it.
I've been here 10 years and it hasn't become like Reddit yet. Every person saying that HN will become like Reddit has been wrong so far.
I’ve personally feel/seen some erosion but it’s hard to quantify and measure.
On HN jokes do get up voted - if they're original, related to the topic and actually funny.
Random person tries to get in (eg phone was stolen in the subway, ...): biometrics work, password works.
Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works.
Government respecting your rights tries to get in: biometrics is completly broken, password works.
Government that don't respect your rights tries to get in: https://xkcd.com/538/
Although in that last case, as-in the case of Government respecting your rights but the court order you to give access, password still allows you to have the ability to block/brick/wipe the phone.
All of this of course is if you have a good password hygiene, but if you don't I don't think you have a claim to complain about weak security models.
I do disagree with a couple of your conclusions though, because the attacks you describe are all targeting you as an individual. There's a much broader class of attacks that should be worrisome -- adversaries seeking _any_ compromise of _any_ individual. Like getting a dump of passwords from neopets or something and trying all those passwords on Chase.
For that kind of adversary, password is vulnerable, and biometrics is secure. And that kind of adversary is by far the most dangerous and prevelant. Especially biometrics in the Apple secure enclave model, where the key material is secured by the biometrics but is very strong -- far stronger than a password can be.
The applications I'm familiar with, the password takes precedence. It doesn't require password and fingerprint.
The thing is, if you add an extra factor, either you are required to use all of them, in which case it increases the risk of being wrongly locked out, or you are required to use any of them, in which case it increases the risk of the wrong person getting in.
I found it functionally impossible to secure the android against my girlfriend as she could watch me enter any code or password multiple times.
She was not able to get into the iPhone, because the biometrics prevented her from being able to view the passcode being entered.
Summary: biometrics are a reasonable substitute for a trusting relationship. :)
From a usability perspective, passwords are a nightmare, TouchID is a bit better (e.g. dry or wet fingers don't reliably work), FaceID is quite usable.
Apple seems the only company worth criticizing in this space.
>Close person tries to get in (significant other, coworker, ...): biometrics is flawed, password works.
>Government respecting your rights tries to get in: biometrics is completly broken, password works.
The first is fully incorrect, the second far too generalized and heavily incorrect. PINs/passwords are far, FAR more trivial to skim then biometrics. Even mere shoulder surfing isn't hard, but in a world with approaching ubiquitous hard to notice downward looking cameras if you ever input a password anywhere that isn't physically secure, and with no one looking, you can easily have it compromised. And it of course takes essentially zero resource expenditure and offers zero visibility to merely use the password once it's acquired.
If it's at a random incident and a first-world type government wants to look, you can trivially disable biometrics on any decent implementation without even looking. So lack of biometrics buys you nothing. If it's a sting against you specifically then they can shoulder surf/camera it (remember the constant improvements in drones, are you REALLY not being watched well away from buildings even?) or just wait for you to unlock it and then swoop in and try to physically grab you while it's unlocked anyway. The scenario space where it'd make a difference is very, very minimal. Really, you want both: a strong password and biometrics for public usage. And for scenarios like border searches they can lawfully cause you enough inconvenience regardless that standard passcode is still not really the right response anyway. A burner, clean+remote load later, or alt-codes or the like would be the right way to go, though sadly I think only the first two are available right now.
>Government that don't respect your rights tries to get in: https://xkcd.com/538/
Possibly the dumbest xkcd ever made.
At best, biometrics are good as a username to identify who you are, but not that you consent to login.
At best, todays biometrics are a trade off in security for convenience, partially because most can be faked.
I look to modern banking startups for biometrics use because money and personal data are similarly valuable and sensitive. If they aren't using it, it's not secure, or ready.
We are somehow ok with touch and faceid without some form of 2FA.
But right now I doubt the fingerprint sensors will go away soon, nothing really beats them in terms of convenience.
The Pixel 4 does not have a fingerprint reader....
https://www.newscientist.com/article/mg21128225-100-fingerpr...
Nevertheless it probably won't ever be completely reliable short of installing a hypodermic needle with the sensor to take a blood sample every time :)
now I just use the 8 digit pin to login
Just like "something you know" can have different strengths, "something you are" can too and changes in technology and threats will enable new options alongside new attacks as we go along. It's a process.
Not only can "something you are" change (in some instances), it can also be something that can be difficult for technology to not recognize correctly. A username or password must be correct (unless you're Facebook and do that goofy thing where you allow both the upper and lower case versions) but a biometric is more fudgable.
Of course, the something you are necessitates a biometric system that itself can be trusted to be secure.
I'm somewhat surprised because it's definitely not new, I don't know what the exact genesis of that particular cryptographer's verse is but my vague recollection is I first heard it the late 90s, and the idea of extracting bits showing identity from physical qualities unique to a person certainly dates back a long ways. "Something you are" can cover a lot of possibilities too, and with vastly more variety and subtlety than I think a lot of people consider even in security fields. For example, there was recently a genuinely very interesting idea of measuring bottoms. As in, your actual behind/ass, via sensors in chairs. It should be unsurprising if you consider it, but of course the patterns of musculature/fat/bone structure are fairly unique to you for any part of your body if you have sensitive enough tools. It's a transparent measure for certain use cases like a workstation or the like since you're sitting down anyway, and hard to clone from afar since our butts are typically covered and subdermal is challenging without near contact. Another place if you want to look for cutting edge possibilities is advertising/surveillance. Near anything used for tracking fingerprinting could in principle be used for authentication too, and again there are potentially a lot of bits of entropy to be found there. Our gaits as we walk, our patterns of typing, our micro muscle movements, all sorts of things aren't so generic to a powerful enough system. "Biometrics" is to some extent at the stage of 80s or early 90s passwords, something to keep in mind in these discussions when people complain about them. 8-character alphanumeric passwords protected by crypt aren't exactly good these days either, but auth tech moved on even as tech benefitted attackers. In the future biometrics will undoubtedly consider far more than our current early generation systems, up to and including implants.
FWIW, I have (more rarely) seen a few other classes of factor suggested that do make sense, and are arguably distinct categories. One is spatiotemporal, ie., "somewhere/somewhen you are". This is used de facto by any sort of air gapping or "this system can only be accessed from this one place and console" or the like. It could though be taken advantage of far more thanks to more ubiquitous high resolution GPS and the like in our systems. Having certain kinds of data only become accessible in the right place/time could be very useful.
Another fuzzier category is "something you do", as-in observing the actions you take. I felt at one point that this was merely another way of measuring "something you are", but I can see the idea that it'd be distinct because it's about revealing your direct state of mind, whereas at least for the foreseeable future "something you are" tends to focus on more bulk matter aspects of your being. Technically state of mind is physical too, there is a specific vector state of axons and neurons and firing patterns that represent it, but it might make sense still to distinguish that from physical body structure or even implants. Whatever the case though it's still an interesting consideration, and makes a lot of sense in old school counterops. Sometimes the first sign of someone who "shouldn't be authenticated to use this" has been "they were 'acting funny'" after all.
And can be compromised without theft, coercion or any other trace.
> One can be swapped out if compromised or get lost.
Which makes something you are strictly worse than something you have.
> undergoes slow changes over time
You are lacking an argument for anything attached to this point.
> ...it makes sense to split it into two categories
So you are arguing that because something is strictly worse from a security standpoint, it should be categorised as a new category? Have I summed up your position correctly?
There are usability benefits which would exist similarly by attaching something which couldn't be easily compromised to your body. For example a chip under your skin or just carrying a watch on your wrist which you could authenticate with after putting it on and which would un-authenticate automatically when it is taken off. Nobody would argue that you are your chip or your watch.
Something you know is different because there are no plausible ways aside coercion and similar for extracting such secrets in idle, and the other alternative is to get compromised on usage. It's about the threat models.
Something you have can have strong copy protection like a yubikey and can be given away.
FWIW, I don’t think anyone has done this credibly yet.
I don't recall seeing one. Do you have a link?
Usernames can be guessed remotely, fingerprints can't really.
Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
[1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...
> fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland.
Replace silicone with some other flesh-like material that's conductive.
Does this take just a "wee bit of motivation"?
It just says “simply look at your phone to securely unlock it.” They make no claims about how secure it is.
In fact there are already articles showing how the unlock feature works while you’re asleep: https://9to5google.com/2019/10/16/pixel-4-tidbits-face-unloc...
To my knowledge, Apple is the only vendor that actually made in-depth claims about the security of their face unlock solution. They’re the only vendor that assumed anyone cared.
Android OEMs are working off a feature checklist and that’s about it.