On: Google Declares War on the Password

[ufo]

IMO, the big problem with biometric is that it is non revokeable.

[SoftwareMaven → ufo]

Sure it is, the same way a password is revocable: pull e "hash" out of the database you compare against.

[jrockway → SoftwareMaven]

How does IT issue you a new fingerprint?

[bonaldi → jrockway]

Well, in most cases there are nine other digits you can use. That's probably a reasonable amount of redundancy.

[jrockway → bonaldi]

I change my password more than 9 times a year, and I plan to live for more than one year.

[bonaldi → jrockway]

That's not IT issuing you a new password, that's you changing it. The point is that biometrics are perfectly feasible as one of the two factors (instead of something you know) and can still be revoked.

[jrockway → bonaldi]

I also don't leave my password on everything I touch.

Biometrics are a terrible idea. Password + token is much safer and infinitely revokable. And the server can even tell when an HOTP device has been cloned.

[SoftwareMaven → jrockway]

That, and not the revocability, is the core of the problem. It also comes back to a foundation of security: something you have and something you know.

Personally, I think most biometrics are bunk, unless you use multiple (fingerprint, iris, etc) along with some kind of password.

[DigitalJack → jrockway]

Super Glue and Silly Putty

[pyre → jrockway]

A white-hot knife to the finger?

[tedunangst → ufo]

It's really only workable when authing to the device. Not over a network. I'd basically assume that anyone can forge your biometric info, so it's only applicable in scenarios where the forgery is hard to execute.

[kamjam → ufo]

And it also leads to issues like Minority Report, where instead of someone stealing your wallet, they steal your eye balls :(

[hnriot → ufo]

of course it is, you use the biometric signature to sign certificates that you can revoke.