Hacker News new | past | comments | ask | show | jobs | submit login

Fingerprints are tokens, just like usernames and passwords.

Oddly enough, from a trust calculus standpoint usernames are not particularly valuable; we could do away with them entirely and the logic of authentication wouldn't change (though usernames add some very nice logistics that from a practical standpoint we don't want to give up).

At a very basic level, a single token suffices to authenticate: something you have, know, or are does prove you are who you claim to be (usernames just give a convenient handle to that). So, a 1TP from a fob, a password, or a fingerprint at a very basic level is enough.




Huh? Usernames are essential as they scope the credential.

If you just uttered the magic word to a service logon page, anyone uttering the word gets in.

You see the weakness in this type of scenario with Touch ID. If my wife's fingerprint is on my phone, she can access my Touch ID enrolled banking app.


> anyone uttering the word gets in.

Right. That's how a speakeasy works. It's the most basic form of authorization




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: