Hacker News new | past | comments | ask | show | jobs | submit login

I think convenience is important in this comparison because that generates a context in which TouchID is actually more secure, because it's more likely to be used than remembering and typing a passcode/phrase. Apple have shown the usage stats. There is also the inconvenience for attackers of reproducing a fingerprint through an elaborate process, which again makes TouchID more secure (in my opinion) in practice than a password/phrase.

While theoretically less secure, I would say TouchID in practice is more secure for average users. But in the case where there is the motivation I would agree with you.




Right, and I don't think the author necessarily disagrees with the idea of including TouchID in Apple products as an alternative to 'completely unlocked'.

As the author indicates, "This isn't a knock on Apple, as Thinkpad have embedded fingerprint readers for nearly a decade. My intention is to help stop and think about the place of biometrics in security."

The danger is viewing biometrics as a secure alternative to passwords; it's not. But comparatively few people are technically inclined enough to realize that; with Apple embracing it for convenience, we run the risk of people not understanding the security implications; the author saw evidence of that when asked to implement biometrics for file encryption, which is a terrible idea.


I think I remember the issues: good passwords are arbitrary, hard to guess, can be changed at any time, are used for one purpose only. Biometrics (fingerprints) are none of these things.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: