I'm not a fan of any kind of biometric style authentication. People want to kill the concept of the password because it does have it's flaws, but I still think it's the best way to go. I like Android's pattern system, I just wish it was more versatile, like that you can use the same dot twice. Perhaps even add more dots.
The issue with finger print, face recognition etc is 1: how accurate is it really, will someone that looks very close to you be able to trigger it? And 2: you can more easily be forced to unlock it. Someone can use it on you while you're unconscious for example. I could see police beating you if you refuse to let them in then they'll just use it on you after they knocked you out. But a password, it has to come from you and be you specifically inputing it, assuming you did not write it down anywhere.
Biometric could work nicely as a two factor auth system though.
While I fully agree that phone OSes should offer an option of using biometric with 2FA (I'm kinda baffled as to why they don't!), I don't think you've done your homework on how biometric logins work on current phones.
I haven't looked into to how Android implements it, so I won't make any guesses. But here's a simplified explanation of how iOS does it:
Biometric login (be it Touch ID or Face ID) is simply a proxy for the passcode. The "Secure Enclave" security processor (which runs its own realtime OS, totally separate from iOS), when the phone boots up, must first be "fed" the passcode, because it doesn't actually have it stored across reboots. (The same initial passcode entry on boot is also used to unlock the OS, such that the passcode can even be passed to the Secure Enclave.) For security purposes as well as to make sure you don't forget the passcode, the Secure Enclave automatically discards the passcode every 48h, forcing you to re-enter it manually.
Additionally, failed biometric login attempts (2 with Face ID, 5 with Touch ID) will also trigger the Secure Enclave to forget the passcode, thus necessitating re-entry. There's also a system setting to delete the phone's storage decryption keys after 10 failed passcode entries, causing the phone's contents to be fully, instantly, and irretrievably erased. (There is no user-visible counter of the attempts, so that a cop or thief who is trying to coerce you into divulging the passcode cannot know how many attempts remain, nor indeed whether the auto-erase function is enabled at all. If enabled, it simply erases the phone on the spot once the 10th incorrect passcode has been entered.)
In iOS 11, the new emergency screen (triggered by pressing the sleep/wake button 5 times in a row) also tells the Secure Enclave to discard the passcode, giving you a way to quickly disable biometric login without leaving evidence. (For example, you can quickly press the button 5 times while waiting in line at airport security.)
In both Touch ID and Face ID, the biometric signature is not transmitted to the CPU and iOS; it remains solely within the Secure Enclave, totally unavailable to iOS, and thus unavailable to both law enforcement and hackers/malware. The Secure Enclave, in essence, only feeds back to iOS whatever data it was told to hold in escrow (like the passcode, and the decryption key for the system keychain) when biometric login succeeds. [speculation]Given this, and the fact that the iPhone X can use the Face ID sensors for augmented reality, it stands to reason that either a) the Face ID/Secure Enclave subsystem can feed anonymized (non-personalized) face position data out to iOS, without allowing the facial signature to be output, or b) the Face ID sensor data is fed to iOS, which sends sensor data to the Secure Enclave for computation of the signature and future comparison. I strongly suspect that approach (a) is used, since (b) has far more opportunity for abuse. [/speculation]
Touch ID can be used on an unconscious person (which is why some people recommend not registering your thumbprint, but instead using other fingers, such that cops would likely use up the 5 attempts on your thumbs before getting to the finger that works). Face ID, on the other hand, requires a deliberate, active gaze, and apparently also locks automatically when you look away. Between that and that you only get 2 attempts before it disables Face ID, the chances of an unconscious or uncooperative person's face being used to unlock are
extremely small.
Apple just stated the false-positive (i.e. random chance of a stranger being able to unlock) rate for Touch ID as 1 in 50K, and for Face ID as 1 in 1 million, with the rate rising significantly with close relatives.
Ultimately, though, the original goal of biometric logins isn't to be more secure than a passcode, it's to be more secure than
nothing at all, which is apparently what
tons of people were doing before Touch ID. (I forget the statistics, but it was shockingly high to me.)
Apple publishes a document called the
iOS Security Guide that goes into the security architecture in great detail. The current version is from March 2017, so I expect an updated version for iOS 11 and Face ID to come out next spring at the latest.
A much larger issue, IMHO, than the technical situation is the legal one. To me (and many others), it's obvious that the law should expressly address when you can and cannot be compelled to unlock your device, regardless of unlock method. But for historical reasons, and ones of what I consider obtuse interpretation of the law, in the US, you cannot be compelled to provide a passcode/password (though the government is now holding someone indefinitely for refusing to divulge a decryption password, egregiously violating the law IMHO), but you
can be compelled to provide physical attributes, like fingerprints or the appearance of your face. This is why the ability to quickly and surreptitiously disable biometric login without leaving evidence (as Apple is doing in iOS 11) is hugely important.
Home
Help
Search
Login
Register
