Re:The Pixel 4’s face unlock works on sleeping people
by dwaite on Friday October 18, 2019 @05:51PM
(#21295366)
Biometrics are not an extension of #2.
You really are categorizing authentication factors by their weaknesses:
- Knowledge factors can be discovered/guessed and duplicated
- Possession factors should protect against guessing and duplication, but can be physically stolen
- Inherence factors should protect against guessing, duplication and physical theft, but cannot be replaced
Writing down a password doesn't make it an effective physical factor, just like embedding an NFC chip in your arm doesn't make it an effective biometric.
Re:The Pixel 4’s face unlock works on sleeping people
by throwaheyy on Friday October 18, 2019 @06:01PM
(#21295406)
Face print and fingerprint are definitely #2, something you have. Both can be easily copied. #3 would be your DNA sequence perhaps.
Similarly, SMS authentication is not #2. The mapping of your phone number to your phone is not something you possess, it is sitting in some phone company system somewhere and it can be changed.
You'd be in just about the same place if instead of saying "you need biometrics" you said "You need 2 devices".
Even number 2 can be done wrong. 2 Doesn't work if the thing you have is a knowledge based thing. 2 only works if in the case that it responds correctly to a stimulus. Think things like RSA.