Comment by hospadar | Hacker News Reader

Comment by hospadar | Hacker News Reader

I went to a really interesting talk about biometrics from the guy who ran (runs?) the HUGE biometric ID program that India runs (Aadhaar). A point I remember him reiterating several times is that biometric ID is useful to uniquely identify human meat-bodies (my paraphrase), but that it's fairly weak if you're using biometrics for authentication.

His idea being that your biometric data is not really secret (i.e. in the case of fingerprints or face, it's attached to your body and easily observable), and also that it cannot be changed (easily, with today's technology). If someone gets their hands on your fingerprints or retina scan, you can't "change your password".

His point was that biometrics are really useful for stuff like KYC when you get a bank account (where bank employees can feel pretty sure that they are really scanning your eyeball and not a picture of your eyeball reproduced for the camera), but not such a good idea for stuff like "are you allowed to access this ATM machine?". Also, while identity theft sucks, getting your password stolen is painless, whereas someone chopping off your thumbs to squish them up to an ATM machine is a less pleasant experience.

Biometrics are an username, not a password.

Except on hundreds of millions of iPhones around the world. Apple has shown that the distinction is more nuanced. There are cases where biometric use is legitimate.

Signing into an account on a remote server? Probably not. To access the secure enclave on a device that is with you for 100% of your life? Probably fine.

In a sense it’s two factor authentication with the other factor being the phone itself

The only "nuance" here is that weak security is "probably fine" in many situations. It should still be acknowledged as weak security.

Most houses don't have locks appropriate for bank. Many people do get by with weak passwords in many situations.

But acknowledging the weakness of this sort of security is still important because a given person has to consider the threat they face (activists who may face repressive state should what good and what bad security is still) and because new exploit method can appear.

Most banks don't have locks appropriate for banks.

> To access the secure enclave on a device that is with you for 100% of your life? Probably fine.

The notion, however, that a device shall be with you for 100% of your life is not fine at all. It's totally dystopian.

I think op means with you, rather than someone else.

It doesn’t work like that.. you always need your password

this is the best one-line explanation I have come across.

All the people above you are going on and on about things that can't be captured in one line. lol.

To me, even that’s a poor comparison, since usernames can change per platform, multiple usernames can be created per user, etc.

I wish people would stop saying this because it is clearly wrong. Biometrics have different security properties to both usernames and passwords. They're another category. They aren't the same as usernames.

In some cases they are totally appropriate as passwords. For example fingerprints & face recognition for building access.

(And before you say "but someone could copy your fingerprint from a glass and wear a prosthetic mask that looks like you!" think about how you would break into "password" style building security - PINs and access cards.)

> [Biometrics are] another category. They aren't the same as usernames.

If one still finds themself disagreeing with this, consider the difference between what it means to choose a new username and what it means to choose a new face.

> For example fingerprints & face recognition for building access.

Huh, why is that fine for building access? Someone can enter your house by just having a copy of your fingerprints or face data?

I didn't say all buildings, but in any case someone can enter your house by smashing a window or copying your key or picking the lock or breaking the door or...

Don't imagine that all security has to be mathematically perfect, especially in the real world.

This 100%. I really wish this was more widely understood. Imagine having a password that you can not change? What happens when it is compromised? Biometrics should NEVER be used as passwords.

imo they shouldn't be used as usernames either. What if I have an accident and burn my fingertips off? Or even worse, I have a facial injury that ruins the username?

Hadn't thought of that to be honest, but it's a good point.

> Also, while identity theft sucks, getting your password stolen is painless, whereas someone chopping off your thumbs to squish them up to an ATM machine is a less pleasant experience.

This is not a real distinction if they are physically present and willing to use that level of violence. It reminds me of the password XKCD -- doesn't matter what your password is or how recently it's been changed if they're willing to beat it out of you with a wrench.

Reply on news.ycombinator.com