When your password leaks:→ Change your password→ Problem solved
-
@ill_logic @jfml @capitainesam every proper implementation hashes the fingerprint, just like you don't store clear text passwords in the shadow file...
The question is, is this a proper implementation on phones...
@celeste_42bit @ill_logic @capitainesam But does this (hashing of the fingerprint) help with the problem that if it get leaked I can basically never use it again? Using your fingerprint is like having a password you can't change does the hashing change anything about this?
-
@celeste_42bit @ill_logic @capitainesam But does this (hashing of the fingerprint) help with the problem that if it get leaked I can basically never use it again? Using your fingerprint is like having a password you can't change does the hashing change anything about this?
@jfml @celeste_42bit @capitainesam If I somehow get your fingerprint, I can figure out the hash. But if I steal the hash I *can't figure out your fingerprint. Hashes are cool like that. So in principle you should still be able to use it.
* Now the caveat is that it has to be done right. And perhaps someone can find a way to break these systems over time. This has happened with password database systems. Also I don't know anything about biometrics in particular, just the principles at play here.
-
@jfml @celeste_42bit @capitainesam If I somehow get your fingerprint, I can figure out the hash. But if I steal the hash I *can't figure out your fingerprint. Hashes are cool like that. So in principle you should still be able to use it.
* Now the caveat is that it has to be done right. And perhaps someone can find a way to break these systems over time. This has happened with password database systems. Also I don't know anything about biometrics in particular, just the principles at play here.
@jfml @celeste_42bit @capitainesam (BTW I don't use biometric logins)
-
@jfml @celeste_42bit @capitainesam If I somehow get your fingerprint, I can figure out the hash. But if I steal the hash I *can't figure out your fingerprint. Hashes are cool like that. So in principle you should still be able to use it.
* Now the caveat is that it has to be done right. And perhaps someone can find a way to break these systems over time. This has happened with password database systems. Also I don't know anything about biometrics in particular, just the principles at play here.
@ill_logic @celeste_42bit @capitainesam Ah, ok, thanks for the explanation, that makes sense.
-
@ill_logic @celeste_42bit @capitainesam Ah, ok, thanks for the explanation, that makes sense.
@jfml @ill_logic @capitainesam Yea, Hashes are designed to loose data by design.
You can, for example, hash a 1000 page book, and the 265bit hash will still only have 265bits. It's unique for the book, but due to the obvious massive data loss, the book is not recoverable from the hash.
But same here, I have very little understanding of how biometric locks actually work. Just the absolute basics.
-
Won't the law require you to to biometric ID?
@charlesdelavalleepoussin @capitainesam If it's a paid service that might count as automatically verifying any user as being an adult if it only allows payment methods that aren't accessible to minors
-
When your password leaks:
→ Change your password
→ Problem solvedWhen your biometric data leaks:
→ You can't change your face
→ You can't change your fingerprints
→ The compromise is permanent
→ Your biometric data is in breach databases foreverThis is why facial recognition for age verification is dangerous.
@capitainesam
Interesting point of view.
Department of Witness Protection for leaked biometrics? -
When your password leaks:
→ Change your password
→ Problem solvedWhen your biometric data leaks:
→ You can't change your face
→ You can't change your fingerprints
→ The compromise is permanent
→ Your biometric data is in breach databases foreverThis is why facial recognition for age verification is dangerous.
@capitainesam Fun bit of trivia for fingerprints is that there are known approaches of using fingerprints to generate pub/private style keypairs, so you can use that biometric in a safer manner (in theory). In practice your point absolutely stands.
-
When your password leaks:
→ Change your password
→ Problem solvedWhen your biometric data leaks:
→ You can't change your face
→ You can't change your fingerprints
→ The compromise is permanent
→ Your biometric data is in breach databases foreverThis is why facial recognition for age verification is dangerous.
@capitainesam IF we could trust that a 1-way transform of the data is stored rather than your raw fingerprints & a jpeg of your face/passport, things would be slightly better
unfortunately, biometric ID is being pushed by untrusted parties
-
@dancingtreefrog
Why copy? Just get the finger. With or without the human hanging on it.@Mercutio @dancingtreefrog @capitainesam @patterfloof
In my head now:KRYTEN: Logically, sir, there is only one way you could have possibly
have opened that door. I feel quite nauseous. Where is it?
LISTER: Where's what?
KRYTEN: Oh, sir!! You've got it in your jacket!!
LISTER: I got us out of the hold, didn't I?
KRYTEN: Sir, you are sick! You are a sick, sick person! How can you
possibly even conceive of such an idea? -
J jwcph@helvede.net shared this topic
