Re:Quick Tip: Enable Touch ID for Sudo (2020)
by quitit on Wednesday June 15, 2022 @05:39PM
(#31759802)
There is certainly merit to this line of thinking, however that is the scenario where the password is literally the hash of the fingerprint or facial read - this is a use case that's closer to a login name rather than a password.
To use touchid/faceid as an example:
- it requires that the password was recently entered
- it's not the password, but a means of accessing a temporary token
- that token is easily purged from memory by triggering SOS or failing touchid/faceid repeatedly
- a range of conditions will also automatically purge the token, such as usage that doesn't match the user's behaviour, unusual movement such as scuffles, certain combinations of location/time/movement, and of course not being used for several hours (this also seems to vary based on certain conditions.)
In this sense a biometric read can provide a useful level of security for most scenarios and definitely better than entering a 4-digit pin repeatedly, and infinitely better than gestural passwords which are comically easy to guess.
For secure applications it's not useful, nor is a 4 or 6 digit pin, but such implementations also engage a range of security enhancements such as internet/voip via an encrypted VPN, locked down device profiles, limited access to networks and so-on. Sometimes the discussion about biometric data use in authentication tends to over-borrow from this level of security need.
To use touchid/faceid as an example:
- it requires that the password was recently entered
- it's not the password, but a means of accessing a temporary token
- that token is easily purged from memory by triggering SOS or failing touchid/faceid repeatedly
- a range of conditions will also automatically purge the token, such as usage that doesn't match the user's behaviour, unusual movement such as scuffles, certain combinations of location/time/movement, and of course not being used for several hours (this also seems to vary based on certain conditions.)
In this sense a biometric read can provide a useful level of security for most scenarios and definitely better than entering a 4-digit pin repeatedly, and infinitely better than gestural passwords which are comically easy to guess.
For secure applications it's not useful, nor is a 4 or 6 digit pin, but such implementations also engage a range of security enhancements such as internet/voip via an encrypted VPN, locked down device profiles, limited access to networks and so-on. Sometimes the discussion about biometric data use in authentication tends to over-borrow from this level of security need.