As with all things security, it depends entirely on your thread model and the value of what you’re trying to protect.
Biometrics can be a much more secure option than using a PIN or password, depending in circumstances.
For example: when I’m working on my laptop on the train or in a coffee shop and I need to log into some website I’d rather use my fingerprint to unlock the passkey than type in a password in a public place where I have no idea who is observing me entering my password.
Same goes for paying with your phone, you can either enter your phone PIN in a crowded supermarket or you unlock with FaceID.
Also, for phones, for a lot of people the alternative to biometrics wouldn’t be a PIN, it would be no authentication whatsoever. Biometrics lowers the barrier to having a form of authentication at all.
Full password Android user representing here… It’s surprising how few people bother to even stop any amount of snooping on their phones. but I guess it’s only surprising in that I wished more from society in general.
If it is low detail enough to consistently ‘work’, it isn’t complex enough to be better than something like a chip and pin approach.
They are repeatedly bypassed with easy hacks like silly putty and photographs. People’s biometrics are not unchanging. Burned fingers, swollen eyes, and sore throats are things that can change enough to make biosecurity unreliable. That is before cold and heat and how they effect biological things!
That is all before you take into account the fact that some people don’t have whatever is being used. Have fun using eye based biosecurity on someone with cataracts or is missing their eyes entirely due to injury or just being born without them fully developed. Or they have a physical issue that makes it hard for them to interact with the bio reader. Stephen Hawking needing to lean towards a mounted eye scanner would be impossible for example.
So either you have mediocre security that allows for a lot of false positives to get through or you end up having to add a bypass system for when it fails, and now you have two ways that security can be defeated! A non-biological solution with two factor authentication of an item and a PIN or other knowledge piece is far more secure than biosecurity can ever be.
So already insecure, but in addition to that anyone with physical access to the person can force them to do the biosecurity. Police are able to force someone to put their finger on their phone, or look at the screen for a face unlock. Maybe they aren’t legally able to, but it is a good example of not being secure.
They aren’t 100% reliable and it has its’ challenges based on its implementation but I wouldn’t consider it fundamentally insecure. It’s as secure as a NFC token, TOTP, or a push notification as a form of authentication. It’s like birth control, no method is 100% safe and effective, but plain username and password auth is like pulling out, anything is better than that.
Exactly, it’s fundamentally insecure.
As with all things security, it depends entirely on your thread model and the value of what you’re trying to protect.
Biometrics can be a much more secure option than using a PIN or password, depending in circumstances.
For example: when I’m working on my laptop on the train or in a coffee shop and I need to log into some website I’d rather use my fingerprint to unlock the passkey than type in a password in a public place where I have no idea who is observing me entering my password.
Same goes for paying with your phone, you can either enter your phone PIN in a crowded supermarket or you unlock with FaceID.
Also, for phones, for a lot of people the alternative to biometrics wouldn’t be a PIN, it would be no authentication whatsoever. Biometrics lowers the barrier to having a form of authentication at all.
Full password Android user representing here… It’s surprising how few people bother to even stop any amount of snooping on their phones. but I guess it’s only surprising in that I wished more from society in general.
Can you explain how?
Ask OPM how they plan on getting my fingerprints back.
How are biometrics fundamentally insecure?
If it is low detail enough to consistently ‘work’, it isn’t complex enough to be better than something like a chip and pin approach.
They are repeatedly bypassed with easy hacks like silly putty and photographs. People’s biometrics are not unchanging. Burned fingers, swollen eyes, and sore throats are things that can change enough to make biosecurity unreliable. That is before cold and heat and how they effect biological things!
That is all before you take into account the fact that some people don’t have whatever is being used. Have fun using eye based biosecurity on someone with cataracts or is missing their eyes entirely due to injury or just being born without them fully developed. Or they have a physical issue that makes it hard for them to interact with the bio reader. Stephen Hawking needing to lean towards a mounted eye scanner would be impossible for example.
So either you have mediocre security that allows for a lot of false positives to get through or you end up having to add a bypass system for when it fails, and now you have two ways that security can be defeated! A non-biological solution with two factor authentication of an item and a PIN or other knowledge piece is far more secure than biosecurity can ever be.
So already insecure, but in addition to that anyone with physical access to the person can force them to do the biosecurity. Police are able to force someone to put their finger on their phone, or look at the screen for a face unlock. Maybe they aren’t legally able to, but it is a good example of not being secure.
I couldn’t have said it better.
Not to mention that a company could easily harvest this information, just look at FTC for example.
Well I could have, but simply chose not to.
Me too!
They aren’t 100% reliable and it has its’ challenges based on its implementation but I wouldn’t consider it fundamentally insecure. It’s as secure as a NFC token, TOTP, or a push notification as a form of authentication. It’s like birth control, no method is 100% safe and effective, but plain username and password auth is like pulling out, anything is better than that.