News for hackers. Stuff that matters.

A comment on Fingerprints can be hacked. Parent comment

Re:Fingerprints can be hacked by Tagbert on Monday November 22, 2021 @07:32PM (#29313298)
In the case of Apple’s TouchID, the fingerprint is less a password and more of a session extender. You need to login with ID and password to establish a session. Then the fingerprint gives you access to that session. Once the session ends, you need to reestablish your credentials.

This obviously not as secure as a system when you must use your credentials frequently to maintain access, but it seems entirely appropriate for the level of security needed by most individuals on their phones. Especially as the alternative is often a super simple password or even no password at all. TouchID makes a moderate level of security palatable enough for people to actually use.

[ Parent | on HN ]
Re:Fingerprints can be hacked by monopoledance on Wednesday November 24, 2021 @06:09AM (#29328834)
Potatoes, potatoes, or something.

So far I haven't encountered a device where a fingerprint was used to unlock disk encryption, so your objection is actually implied, I think. Especially, with the increasing uptime of Apple's new hardware, a running session is what you more often than not got these days.

No matter how you twist it, biometrics are fundamentally flawed and not even Apple can magically fix that. At least one component of access needs to be a secret, which cannot be extracted without cooperation, or "cooperation".

[ Parent | on HN ]