News for hackers. Stuff that matters.

A comment on Logins are Dead, and Mobile Killed Them. Parent comment

Re:Logins are Dead, and Mobile Killed Them by Cloven on Friday July 13, 2012 @03:03PM (#4241312)
The good thing about the AppStore password timing out after 15 minutes is that you can hand your child the ipad/iphone/etc. and not get a surprise $5,000 itunes bill.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by untog on Friday July 13, 2012 @03:35PM (#4241475)
That's an edge case, though. Why not make it a configurable option?
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by bmj on Friday July 13, 2012 @04:12PM (#4241630)
This is definitely not an edge case. How many kids do you see at the grocery store with their noses in an iPhone will their parent(s) shop?

That said, it would be nice to have the option of telling the app to cache your credentials.

[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by untog on Friday July 13, 2012 @04:16PM (#4241649)
Edge case was perhaps the wrong term. It certainly is not a majority case. As I said- make it an option, everyone is happy.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by sirclueless on Friday July 13, 2012 @11:31PM (#4243029)
Not the person who turns on the option to make their life easier and then complains because their kid spent $400.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by untog on Saturday July 14, 2012 @07:36PM (#4245642)
?! Are you suggesting that everyone should be denied the choice because some people are unable to make informed decisions?
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by yuliyp on Saturday July 14, 2012 @02:36AM (#4243377)
This is confusing authentication and authorization. Is this phone legitimately tied to this Apple ID? Yes. Is the owner of the account authorized to make such a purchase? No.

A short appstore PIN could solve this much more easily.

[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by radq on Saturday July 14, 2012 @03:21AM (#4243456)
I'm not so sure having _yet another_ PIN for users to remember would be a good idea. And besides, a short PIN would be far easier to deduce by looking over a person's shoulder.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by coob on Friday July 13, 2012 @08:09PM (#4242581)
It is a configurable option (Settings -> General -> Restrictions)
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by extempore on Saturday July 14, 2012 @06:16AM (#4243757)
Yeah, it's configurable between "Demand my password again if 15 minutes has passed" and "Demand my password again immediately." You can tell you're going in the wrong direction when you first have to "enable restrictions" hoping to relax the restriction. I take it you've never actually tried to configure this option.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by chris_wot on Sunday July 15, 2012 @03:49PM (#4247872)
Holy not an edge case Batman! That is most definitely a very common reason to timeout the password...
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by moron on Saturday July 14, 2012 @12:32PM (#4244613)
Oh my god that is so not an edge case.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by dmitriy_ko on Friday July 13, 2012 @09:00PM (#4242691)
How about using fingerprint scanner for authentication? Or face recognition using front-facing camera? It's 2012 after all.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by _morgs_ on Monday July 16, 2012 @03:17AM (#4249698)
The Samsung Galaxy S3 has face recognition. It can be unlocked using a photo of the user. Google Images search, point cam at laptop, bingo you're in.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by nileshtrivedi on Wednesday July 18, 2012 @09:27PM (#4263958)
They "fixed" this in JellyBean.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by einhverfr on Friday July 13, 2012 @10:55PM (#4242949)
too many false positives.

Now, an SD card with a certificate plus face recognition might be ok ;-)

[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by ricardobeat on Saturday July 14, 2012 @12:51AM (#4243167)
Why an SD card? The phone itself is already a portable device you control.
[ Parent | on HN ]
Re:Logins are Dead, and Mobile Killed Them by einhverfr on Saturday July 14, 2012 @01:24AM (#4243228)
It depends on the app but at least in the areas I work (business apps relating to tracking money) I wouldn't assume that device authentication is sufficient.

But for biometrics, keep in mind that biometric systems are currently seen as the most subject to false positives of any authentication system out there with the possible exception of improperly maintained and insufficiently strong passwords.

[ Parent | on HN ]