CubitOom
CybersecurityAs soon as the word "convenient" is used, you know it will affect security.
Yep, they technically didn’t claim it was to make it more secure.
This is always the tradeoff. Security must always impose a cost.
Why do you think that? Public key authentication systems are invariably more secure, and a wide variety are also simpler for the end user to use.
It's a misconception that they are in opposition to each other. Why would they be? One's about knowing who's doing something and the other is about how much effort it takes to do it.
I think it depends. Some people might be inclined to use too short or simple password because they don't wanna constantly be typing a long password. It's much better to have a strong password and fingerprint/face rec for convince than just a insecure password.
In the USA, they can legally force you to unlock a device using biometrics.
Also, biometrics can be fooled in other ways.
Yes, but that's besides the point. If the convenient options for a normie user are
- Having a weak password
- Having a strong password and a fingerprint
Out of those the fingerprint with a strong password is way better option, imo.
In the USA, they can legally force you to unlock a device using biometrics.
Also, how does that work? Can't they legally force you to enter your password too? Or can you claim you don't remember it? If that works, can't you just have a band-aid on your finger or something? Surely they cannot force you to take it off and risk getting an infection on the large wound you just happened to get yesterday...?
Also, how does that work? Can’t they legally force you to enter your password too?
No, because forcing someone to enter a password is "compelled speech" and against the 1st Amendment. It's also testimonial, which means compelling that speech would also be self incrimination, which is against the 5th Amendment.
Don't ask me why forcing someone to make a hand gesture is not also compelled speech and not testimonial. The Constitution is mostly nonsense being interpreted by life appointed morons who interpret things however they like.
A normal user will most likely never encounter a situation where their weak password would be at risk, but are much more likely to having their biometrics forced by law enforcement or border control.
They will rip your bandaid off and force your finger or face to scan while holding your device.
Any weak password at all would have been better in a situation like that.
Oh wow, things really have gotten bad over there. For me personally, the much greater risk is that I forget my phone somewhere or someone steals it and in that scenario a weak password is the larger issue.
It seems there isn't a single correct answer here. The threat model is different for everyone.
Hot take: biometrics are often criticized for being less secure, but that ignores the deficiencies of passwords. Especially on phones, it's very doable to look over someone's shoulder while they're unlocking their phone or do the same with a camera. You can't do that with a fingerprint, at least not nearly as easily.
And yes, I understand that in the US (amongst others?) the legal situations with passwords and biometrics are different, but IMO that's more of a legal question, and not everyone lives in the US.
Android also has an "emergency lockdown" option, which disables biometrics for unlocking your phone - or you can shut it down (worst case scenario force shut down with a long hold on the power button) to get it into a BFU state, which is much harder to crack.
Apple has something similar where you hold the power + volume up for ~3-5 seconds and you get the Power/Emergency call screen but it also disables biometrics until after a successful PIN.
This is one more reason why I'm still on Android. Face ID is mandatory.
Why?
It's not like they're literally using your face or fingerprint as a password. They're not even storing them, just a hash tied to an hsm key.
I can't speak for OP, but in the US, you can be compelled to unlock a phone via fingerprint or face ID. You can't be compelled to give over your PIN. That violates the right against self incriminating.
Totally true. That's not the common threat most people need to guard against however. Additionally, at least on Android, the device is relatively eager to force pin usage if the stars don't align for biometrics
Almost any user are much more likely to encounter a situation where their biometrics are forced and not their password. Passing a border for example.
Biometrics should never be used instead of a password, only as usernames. A password can be changed, your thumbs can't.
