Frequent reauth doesn't make you more secure

Re:Frequent reauth doesn't make you more secure by xp84 on Thursday June 12, 2025 @08:00PM (#44264465)

I think if done right, typing that password should be more like a once a quarter exception rather than a daily occurrence.

Granted - there are blockers to getting there. IDK why for example, macOS can't use Touch ID from a cold boot, that's stupid, at least when there haven't been too many failed attempts or anything.

[ Parent | on HN ]

Re:Frequent reauth doesn't make you more secure by Retric on Thursday June 12, 2025 @10:01PM (#44265095)

Touch ID isn’t that secure. It’s fine for personal devices, but I wouldn’t trust it alone in a government or cooperate environment.

A ~1:50,000 error rate per finger added sounds fine, but lose a few laptops and have multiple valid fingerprints etc and the odds quickly look significantly worse. Or a janitor could end up trying to log into a significant number of machines etc.

[ Parent | on HN ]

Re:Frequent reauth doesn't make you more secure by zimpenfish on Friday June 13, 2025 @01:54AM (#44266033)

> macOS can't use Touch ID from a cold boot

Isn't that because the Secure Enclave (the only place which contains the Touch ID biometric data) is locked by your password?

"When a user's password is set up on an Apple Silicon Mac, the password is passed through a one-way hashing algorithm that produces a key used to encrypt the Secure enclave's key."[0]

[0] https://blog.greggant.com/posts/2023/04/14/the-security-encl...

[ Parent | on HN ]