this post was submitted on 11 Oct 2023
290 points (98.0% liked)
Technology
59392 readers
2523 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
It's definitely more secure, since stealing someone's phone is much more difficult to scale up compared to stealing passwords.
I don't think that access to your personal data/email/files being dependent on a battery-powered electronic device is a great idea, to be honest.
That's why they invented chargers, eh.
But more seriously, there are recovery procedures if you lose a phone with or without a backup and if you are willing to share the keys with a cloud provider, you can also store them there and use them on any of your devices.
Or you can get something like a yubikey if the battery aspect is really that problematic for you.
The fact is that I fail to see something obviously wrong with outrageously long/complicated passwords managed by e.g. Bitwarden or the likes.
Long passwords can still be phished. Passkeys cannot. It's a huge upgrade.
My understanding of Apple Keychain is that every credential is useable from every device, and can be backed up and restored to a new device. Most importantly Apple doesn’t have access, although we have to trust them on that
It's not quite unique to a specific device. You can store your private key in a password manager or something similar, and then access it from other devices
Depends on your personal choice. You can definitely limit them to a single, hardeneddevice if you want the highest level of security.
For most users and most situations, a synced solution will be preferable.
Me, at the bank:
Robbers, as they enter the bank: everybody freeze
Me: ah shit
Robbers: everyone give me your phones
Me: aw hell naw
mission impossible style shootout
But it becomes much easier if you want to compromise a specific target individual
No, not really.
Even if you want to target a specific user, it doesn't become necessarily easier.
Unless you happen to target an individual that combines good password OpSec with shitty phone OpSec.
But I would expect those to be a minority.
Hi, yes, I am that minority
I have a 37 character password with both cases, numbers and special characters to login to my pw vault using long random strings
My phone has a swipe pattern lock since that is the safest lock option it allows in the first place. I wish I could lock it better, but the only other options available to me are a 4 character pin, and fingerprints/facial scan. I hope the problems with those are obvious
Couple that with the fact that I have a daily predictable commute in public transit where I have a habit to put my phone next to me during breakfast and you have a recipe for disaster.
Finger prints on Android stop working after 24 hours, a reboot, and some other cercumstances. I feel pretty OK using fingerprint to unlock my phone, because in about 99% of cases I might be compelled to unlock my phone, I will either be able to restart it first, or that 24 hour timer will have expired.
I may be misunderstanding you, but how does that stop an attacker?
Getting a copy of someone's fingerprint can be done without their knowledge since it is the easiest biometric to accidentally leave behind. Having to restart my phone doesn't suddenly change my fingerprints.
Or, do you have to actually re-register your prints on a daily basis via a different form of authentication? That'd seem inconvenient and like it would just move the problem around
US legal system can compel you to give biometrics, but not password/pin
They won't be able to compel you before the biometric access timer expires.
Tell that to cops at traffic stops
Yes it's a thing
Then you have a nice juicy lawsuit. No legal protection is going to prevent a rogue cop from getting your data. https://xkcd.com/538/
Good luck in court
https://www.computerworld.com/article/2743684/mich--state-police-confiscate-cell-data-at-traffic-stops--won-t-say-when-or-why.html
https://www.vice.com/en/article/aekqkj/us-state-police-have-spent-millions-on-israeli-phone-cracking-tech-cellebrite
They even brag about it
https://cellebrite.com/en/kansas-investigators-use-advanced-analytics-to-speed-their-work-and-reduce-violent-crime/
https://m.slashdot.org/story/418156
Make sure your devices are up to date
You link to articles about law enforcement hacking phones to get data as a reason not to use biometrics? If they are hacking your device it doesn't matter if you use a password or a fingerprint.
On the contrary, these tools only work when the phone has been unlocked since boot on any modern phone, so you can turn it off or reboot it
True. In the context of this thread it doesn't matter though.
You have to enter your pin/pattern to re-enable biometrics
Also, I'm not sure which phone you're using, but if it's an Android there should be the option for password, some OEMs don't give that option but they're rare and the standard set by Google is to provide that and also the pins to be very long (I haven't personally checked the limit, but you can make them longer than reasonable)
After the phone restarts, you must unlock your phone with your PIN(or swipe pattern) before you can use your finger again. The same is true with the 24 hour timer. Android also has a feature that if you hit the power button a set amount of times, it requires the PIN/Pattern too. So if my phone and my finger print have been separate for more than 24 hours, my fingerprint is useless. If I have any warning at all, my fingerprint is useless. Also, after a set number of failed biometric attempts it requires PIN as well. Which means the law better get the finger print right in only a few tries or they lose their chance.
Yes, it is technically possible that law enforcement may steal my phone, duplicate my finger print(in a way that works on my phone's finger print reader), and use that to unlock my phone while they have a chance, then suck everything out of my phone. But for anything government, that's moving pretty swift for anything they might want to book me for.
I'm guessing you could reduce that to a lower number of hours if you really felt the need.
You can still use a 37 character password to protect your passkeys in your pw vault, so it's not like anyone is forcing you to change.
It's still a single factor though. The number of times I have had to lecture IT admins that their 64 character passwords was compromised by a keylogger and that they need to move towards MFA is too damn high.
As for your phone, if that's sufficient for you, go for it.
There are better phones out there.
Even FIDO2 MFA doesn’t protect you from attacks that involve malware running on your machine. If there was a keylogger on their machine then that machine is likely compromised in other ways, and any credentials entered or stored on it should be considered compromised and should be reset.
I have MFA in addition to that pw, yes
That's news to me. Which other mobile authentication is there besides pin, pattern, facial and fingerprint?
Most phones allow passwords, or at least longer length pin.
My 6 character alphanumeric pin is more secure than your four digit numeric