Technology

70285 readers

2813 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

498

Microsoft’s Windows Hello fingerprint authentication has been bypassed (www.theverge.com)

submitted 2 years ago by [email protected] to c/[email protected]

109 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 3 points 2 years ago* (last edited 2 years ago) (1 children)

There is no service on the face of the planet that strictly accepts tokens from Bio tools. Simply using Bio doesn't stop those online from bruteforcing the underlying password.

https://support.microsoft.com/en-us/account-billing/how-to-go-passwordless-with-your-microsoft-account-674ce301-3574-4387-a93d-916751764c43

https://blog.google/technology/safety-security/the-beginning-of-the-end-of-the-password/

https://techcrunch.com/2022/09/12/apple-passkey/

No. I "Spread FUD" because I understand that a good password MUST be revocable. Which Bio CANNOT be. Bio is a username.

Incorrect because your bio is not the password, the private key is. The private key is revocable. Your bio just unlocks your hardware key store and makes the private key accessible to the software.

This is what I mean when I say people do not understand biometric authentication.

[+] [email protected] 2 points 2 years ago* (last edited 2 years ago) (1 children)

[removed by mod]

[–] [email protected] 2 points 2 years ago (1 children)

Which just had some leaks about how insecure it is.

Windows Hello didn't. The hardware wasn't implemented correctly allowing the authentication to be bypassed. You misunderstood the issue here

They sync shit using iCloud...

They sync the public key with iCloud, not the private key. You misunderstood how it works.

It doesn't matter how many keys deep you have to go.

There is no "keys deep" there is a public/private key pair that authenticates a single device with a single account. You have misunderstood how a local key store works.

The compromised item is already obtained when you obtained the device.

Which means someone trying to access my account requires physical access to my device. Passwords, no matter how strong leave you open to remote attack.

Can you tell me the process to revoke the private key from your fingerprint reader on your phone?

Open the authencator app and remove the account. Or uninstall the authenticator app. Or delete your local phone account. Or factory reset if you want to go nuclear.

Alternatively if you lost your phone, go to the account online. Browse to the security section and delete the device from the list. Most services have the ability to sign out remotely. All that's doing is revoking the key. The phone doesn't have to do anything. The fact you think something needs change in the "blob" shows you do not understand how encryption works.

If I were to bump into you, and lift your phone.

Again physical access, not remote access. Much smaller attack vector than a password.

It puts all the power into another companies hands... and takes ALL of it out of yours.

You think passwords take power from the company that stores your passwords remotely? You have no idea how they are storing that password. You don't have to trust the company, you just have to trust the open standard these companies are implementing and that public/private key encryption is the standard used to secure the entire Internet.

Also, whats more likely... that you break a device or that a user CANNOT learn how to use a password manager?

Virtually no one uses a password manager. It's too much hassle.