When your password leaks:→ Change your password→ Problem solved

[vrek@mastodon.social]

@trurl @dancingtreefrog @capitainesam thanks for the clarification. I have been avoiding Orson Scott card because of his actions at conventions previously, although I have read enders game. That said I'm due for a re-read of nueromancer.

[deusfigendi@troet.cafe]

@capitainesam

I would say you do the exact same thing:

If you used to use biometric for access control and your biometric is "leaked"…
You remove the biometric login and setup something else (password, certificate, passkey… just something else)

[_ryekdarkener_@mastodon.social]

@capitainesam

The damage is already done for years. Wouldn’t it make more sense to discuss how to mitigate it an to heal it in the next decades?

[marco_m_aus_f@freiburg.social]

@Mercutio @dancingtreefrog @capitainesam That is something good fingerprint readers will detect. You get way better chances of success with a copy. Needs a print on a surface, a bit of superglue and a printer.

[poptarts@gaygeek.social]

@Starcross @negative12dollarbill @capitainesam Wasn't that a plot point in many early gangster movies?
What's old is new again!

[spocko@mastodon.online]

@capitainesam This is a IMPORTANT POINT!
My question is about biometric data on your phone. What can you do to protect it? Is it always local or is it shared?
Should you never use it because people can get into it

[mousey@mastodon.seattlematrix.org]

@capitainesam biometrics for logins, not passwords!

[jade_the_yinglet@critter.cafe]

@capitainesam it's also why using biometric data instead of a password or a 2fa on an online service is a bad idea

[yura@udongein.xyz]

@Mercutio @dancingtreefrog @capitainesam you can also get a good quality photo of person's hands

[jfml@mastodon.art]

@celeste_42bit @ill_logic @capitainesam But does this (hashing of the fingerprint) help with the problem that if it get leaked I can basically never use it again? Using your fingerprint is like having a password you can't change does the hashing change anything about this?

[ill_logic@mastodon.social]

@jfml @celeste_42bit @capitainesam If I somehow get your fingerprint, I can figure out the hash. But if I steal the hash I *can't figure out your fingerprint. Hashes are cool like that. So in principle you should still be able to use it.

* Now the caveat is that it has to be done right. And perhaps someone can find a way to break these systems over time. This has happened with password database systems. Also I don't know anything about biometrics in particular, just the principles at play here.

[ill_logic@mastodon.social]

@jfml @celeste_42bit @capitainesam (BTW I don't use biometric logins)

[jfml@mastodon.art]

@ill_logic @celeste_42bit @capitainesam Ah, ok, thanks for the explanation, that makes sense.

[celeste_42bit@infosec.exchange]

@jfml @ill_logic @capitainesam Yea, Hashes are designed to loose data by design.

You can, for example, hash a 1000 page book, and the 265bit hash will still only have 265bits. It's unique for the book, but due to the obvious massive data loss, the book is not recoverable from the hash.

But same here, I have very little understanding of how biometric locks actually work. Just the absolute basics.

[zuthal@floofy.tech]

@charlesdelavalleepoussin @capitainesam If it's a paid service that might count as automatically verifying any user as being an adult if it only allows payment methods that aren't accessible to minors

[jlperuyero@masto.nobigtech.es]

@capitainesam
Interesting point of view.
Department of Witness Protection for leaked biometrics?

[fundamental@social.treehouse.systems]

@capitainesam Fun bit of trivia for fingerprints is that there are known approaches of using fingerprints to generate pub/private style keypairs, so you can use that biometric in a safer manner (in theory). In practice your point absolutely stands.

[patterfloof@meow.social]

@capitainesam IF we could trust that a 1-way transform of the data is stored rather than your raw fingerprints & a jpeg of your face/passport, things would be slightly better

unfortunately, biometric ID is being pushed by untrusted parties

[chloeraccoon@mastodonapp.uk]

@Mercutio @dancingtreefrog @capitainesam @patterfloof
In my head now:

KRYTEN: Logically, sir, there is only one way you could have possibly
have opened that door. I feel quite nauseous. Where is it?
LISTER: Where's what?
KRYTEN: Oh, sir!! You've got it in your jacket!!
LISTER: I got us out of the hold, didn't I?
KRYTEN: Sir, you are sick! You are a sick, sick person! How can you
possibly even conceive of such an idea?