Finger Prints Are Not Passwords
-
@thecreativeone91 said:
Only the Federal Government Can't be sued. You can infact sue local governments and many state governments.
You can sue your state? I knew that the Fed can sue a state, and they do constantly. I was not aware that there was any way to sue a state. Or that that would be state by state, I would assume. I've had local judges break the law and I've had no recourse. But NY is extremely bad in that regard. Might be a local problem.
-
@thecreativeone91 said:
I guess we should all just quit our govt jobs and go work at the local fast food chain as we aren't IT pros in Scott's book.
To be fair, I actually did this. New York tried to hire me when I was getting back into IT. It wasn't fast food anymore, it was working a hotel front desk which is slightly better (I've done both, so that's an honest comparison.) But the money was about the same, the job was just cleaner and nicer. I had to work overnights and swing shifts. But the jobs with the state were so bad that I turned them down to keep working the hotel because they only thought of IT as being on par with fast food work based on their pay scales. So while I didn't say to do this, I did actually live this advice and I honestly believe that failing to have done so would have crippled my career. I was far beyond the careers of the people who tried to hire me within six months - and they had many years just in their state jobs alone and I was effectively starting from the bottom.
There are thousands and thousands of government agencies in the US. Some must be good. But I think it sounds pretty surprising to hear that you feel that any percentage of them have the necessary will or capability to address security well.
Working with some municipal governments, many that I have worked with have no IT whatsoever and use whatever free or cheap resource they can find to patch things together. They get grants to buy equipment but never spent money on governance. No security oversight at all.
-
@MattSpeller said:
@scottalanmiller said:
If they are going to steal it, it's already gone.
I'm curious how you got to there
You are assuming that theft will occur because you decided to leverage a feature. Why? That makes no sense. You are assuming that the thief is in your house but only steals your TV if you've been watching it. That's not how it works. If you are assuming that the thief is in your house (is on your device and has access to the biometric scanner) then he is going to steal your biometrics whether you chose to use them or not. Unless you are pressing that button with gloves on or otherwise avoiding letting the scanner see your fingers.
-
What timing...
-
@mlnews so much better with moustaches lol
I actually did a bit of reading, apparently it's stored independently on a separate chip. According to Apple's specs it's reasonably secure. I'm still really uncomfortable with this technology and I'll opt out.
From your post below, how do I avoid biometrics? By not purchasing/using any devices that use them
-
@MattSpeller said:
From your post below, how do I avoid biometrics? By not purchasing/using any devices that use them
What phone available today, for example, does not use them? Nearly every sensor on a phone collects identifying biometrics of some sort. Even your desktop keyboard does that (there are systems that use your typing patterns as biometric passcodes!!)
Fingerprints are just the ones that we talk about. But the amount of identifying information collected by all computing devices is staggering.
-
@scottalanmiller said:
What phone available today, for example, does not use them?
Almost all expect the Newest iPhones. Voice Command, And predictive text both can be turned off. Very few android and no windows phones have finger print.
-
@scottalanmiller said:
Even your desktop keyboard does that (there are systems that use your typing patterns as biometric passcodes!!)What system are you using that does that? Mobile OSes do in Android and iOS but it can be turned off.
-
@scottalanmiller said:
Even your desktop keyboard does that (there are systems that use your typing patterns as biometric passcodes!!)
@thecreativeone91 said:
What system are you using that does that? Mobile OSes do in Android and iOS but it can be turned off.
The point was that a shim (aka malware or even embedded in software you trust) can easily be dropped onto your PC and collect this information.
-
@thecreativeone91 said:
What system are you using that does that? Mobile OSes do in Android and iOS but it can be turned off.
@thecreativeone91 said:
Almost all expect the Newest iPhones. Voice Command, And predictive text both can be turned off. Very few android and no windows phones have finger print.
Who cares about what can be turned off. The entire point of this was an exploit/shim. You can be fairly certain that a shim/exploit will not respect that setting.
-
@thecreativeone91 said:
@scottalanmiller said:
What phone available today, for example, does not use them?
Almost all expect the Newest iPhones. Voice Command, And predictive text both can be turned off. Very few android and no windows phones have finger print.
That's what I thought. You are pretty much limited to old or really low end devices and rapidly those are disappearing. Some will last for a while, I suspect, but only so long before normal touchpads can read fingerprints, I assume. How long until your mouse can read your fingerprint too?
-
@thecreativeone91 said:
@scottalanmiller said:
Even your desktop keyboard does that (there are systems that use your typing patterns as biometric passcodes!!)What system are you using that does that? Mobile OSes do in Android and iOS but it can be turned off.
Any software that wants to can watch your keystrokes for the biometric. I don't use any that tell me that they are doing it, but any that want to, can, including websites.
-
@JaredBusch said:
Who cares about what can be turned off. The entire point of this was an exploit/shim. You can be fairly certain that a shim/exploit will not respect that setting.
That's a key factor here. The OP was about malware that could bypass the system's security. So the existence of the ability to collect biometrics (the presence of sensors) becomes the risk in that case.
-
@scottalanmiller said:
That's a key factor here. The OP was about malware that could bypass the system's security. So the existence of the ability to collect biometrics (the presence of sensors) becomes the risk in that case.
Well if you are going that far you might as well say any device that has a mic is recording you 24/7. Computer, Phone, Dumb/Feature Phones (they have java too on most). Heck if you want to put your Tin Foil hat on power companies can use their Smart Meters to gather information about you. You can gather sounds, signatures of devices etc plugged into your house. CFLs would be very easy to hide mics that send singals to the meter as well.
-
@thecreativeone91 said:
@scottalanmiller said:
That's a key factor here. The OP was about malware that could bypass the system's security. So the existence of the ability to collect biometrics (the presence of sensors) becomes the risk in that case.
Well if you are going that far you might as well say any device that has a mic is recording you 24/7. Computer, Phone, Dumb/Feature Phones (they have java too on most). Heck if you want to put your Tin Foil hat on power companies can use their Smart Meters to gather information about you. You can gather sounds, signatures of devices etc plugged into your house. CFLs would be very easy to hide mics that send singals to the meter as well.
That's my point - once you are assuming that the vendor is stealing your data, not just the data that you share with them, but the data on the device, and selling it, then you are into an area where the tin foil hat is on and things like the microphone are obviously concerns - much bigger concerns than the fingerprint scanner. Far more money in recording people. And no additional "lines" need to be crossed.
-
Well security isn't androids strong point from the get go. But Google's involvement could potentially make it worse (no one knows as there part is closed source)
-
Don't confuse me pointing out that all of these things are possible and equal risk with thinking that we should be avoiding them. I think that avoiding fingerprints because of any of the reasons given in the thread is unrealistic. There are levels of security that are worthwhile and those that are not. Making your life difficult because of extremely unlikely, very fringe security concerns isn't good. We might as well stop using technology and go live on a mountain somewhere and only use cash. If that's the life you'd prefer, knock yourself out. There are security concerns out there, but we have to find a reasonable medium ground or else we start getting crazy.
-
The only reason I need to avoid finger prints is because I can be compelled by the gov't to give them up use them (or they just use one of mine they have one file) to unlock things I don't want them to have access to.
-
@Dashrender said:
The only reason I need to avoid finger prints is because I can be compelled by the gov't to give them up use them (or they just use one of mine they have one file) to unlock things I don't want them to have access to.
In Virginia I know any law enforcement legally is entitled to anything on your persons without a search warrant this includes your cell phone and any information they can access or accounts they can get from it. I believe it it's locked with a password they then need a warrant but, not for any biometerics.
-
@Dashrender said:
The only reason I need to avoid finger prints is because I can be compelled by the gov't to give them up use them (or they just use one of mine they have one file) to unlock things I don't want them to have access to.
That's fine and makes sense. Just be aware that with iPhones, that's not a concern.
