SoylentNews is people
SoylentNews
from the isn't-it-about-time-to-move-on dept.
Submitted via IRC for TheMightyBuzzard
A global study from IBM Security examining consumer perspectives around digital identity and authentication today, found that people now prioritize security over convenience when logging into applications and devices.
Generational differences also emerged showing that younger adults are putting less care into traditional password hygiene, yet are more likely to use biometrics, multifactor authentication and password managers to improve their personal security.
With millennials quickly becoming the largest generation in today's workforce, these trends may impact how employers and technology companies provide access to devices and applications in the near future. Overall, respondents recognized the benefits of biometric technologies like fingerprint readers, facial scans and voice recognition, as threats to their digital identity continue to mount.
Source: https://www.helpnetsecurity.com/2018/01/29/authentication-today/
(Score: 5, Informative) by Apparition on Tuesday January 30 2018, @05:16AM (5 children)
As someone who has been the victim of credit card fraud five times, and victim of the Chinese government helping itself to my name, address, telephone number, Social Security number, fingerprints, and God only knows what else [wired.com], I have to say no thanks to biometrics. Biometrics may make a passable identifier to replace logins with, but passwords? No.
(Score: 2) by DannyB on Tuesday January 30 2018, @05:03PM (4 children)
If you use biometric for the ID (but not the password), and then require a conventional password*, you have 2-factor authentication.
There are only 3 factors to choose from:
1. Something you know. (eg, a PIN, Password, Unlock Pattern, Proper sequence of cat pictures, etc)
2. Something you have. (eg, ID Card, possibly with mag strip or chip, a house key, a fob or usb stick or device)
3. Something you are. (eg, fingerprint, retina scan, image of your face, semen sample1 )
Biometrics are okay as long as it isn't the only factor being used. Which has obvious security problems with images of your face, retina, or Mythbusters lifting fingerprints, etc. Not to mention the fact that you can't change your biometrics, or at least it is usually undesirable to do so.
-=-=-=-=-=-=-=-=-=-
1this limits the number of authentications done per day, and isn't sexist, no, not one bit
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
(Score: 3, Informative) by darkfeline on Tuesday January 30 2018, @09:00PM (3 children)
No you don't. Your biometrics is public info, anyone can gather that information and replicate it.
I feel like that third factor is only thrown in there as a marketing ploy to push the rampant fingerprint authentication that is in every smartphone now.
"Something you are" is a horrible authentication factor. Almost all of it is public info by virtue of you existing, most of it can be trivially replicated, and worst of all you cannot replace it if it is compromised, which see first point.
Password and a key token. Done. Empirically shown to be very secure and relatively low inconvenience.
Join the SDF Public Access UNIX System today!
(Score: 3, Insightful) by DannyB on Tuesday January 30 2018, @09:24PM (2 children)
I am in agreement with the parent poster that biometrics are not a replacement for the other two factors. (He says the password.) But I'm okay with biometric in addition to other factors.
And your user name or user id (one of the typical fields along side password) is NOT one of the factors. Because anybody can know your user name / user id.
Biometric IS useful for certain applications. I find it incredibly useful to unlock my phone. It is my choice to enable that for my convenience. In this case, it is effectively "a button" to turn on the phone, but it only responds to my finger.
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
(Score: 2) by darkfeline on Wednesday January 31 2018, @06:36PM (1 child)
Biometrics is not okay as an additional factor. Biometrics functionally can only play a role as an identifier, which as you say, is NOT a valid authentication factor. Because anybody can know and reproduce your fingerprint/face, etc.
>I find it incredibly useful to unlock my phone.
Naturally, because it is convenient, not secure. It is even more useful to not lock your phone at all and proportionally less secure.
Join the SDF Public Access UNIX System today!
(Score: 2) by DannyB on Wednesday January 31 2018, @08:04PM
Actually it is inconvenient to not lock your phone. Too often the phone gets activated in your pocket and then all sorts of havoc ensues. So on my previous phone I used an unlock pattern. I got so used to it that every single time I wanted to use my phone, I had to swipe the pattern. Then I got the fingerprint reader and all was wonderful.
I don't think of it as secure. If I really were after secure I would be using a real password. I find the fingerprint "button" convenient, because it is like going back to just having a simple unlock button that you press, but it is the fingerprint reader. A touch and the phone wakes.
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.