166
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Sep 2024
166 points (96.6% liked)
Showerthoughts
29242 readers
1382 users here now
A "Showerthought" is a simple term used to describe the thoughts that pop into your head while you're doing everyday things like taking a shower, driving, or just daydreaming. The best ones are thoughts that many people can relate to and they find something funny or interesting in regular stuff.
Rules
- All posts must be showerthoughts
- The entire showerthought must be in the title
- Posts must be original/unique
- Be good to others - no bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia
- Adhere to Lemmy's Code of Conduct
founded 1 year ago
MODERATORS
Biometrics should be usernames, not passwords. Fingerprints, irises, faces, vocal patterns, all of it, no matter how good it is, only identifies the person trying to enter/use something and is somewhat easy to steal without their knowledge.
If you want true security you still need to ask for a passcode that only the now-identified user will know.
And yes, it is still possible to intercept the passcode at the moment that the user interacts with the locking mechanism, but that is completely different from grabbing it when they're randomly walking down the street, etc.
(Edit to add: I didn't think this needed to be explained, but I'm not saying biometrics should replace usernames, I'm saying they shouldn't have replaced passwords. And yes, you can still use biometrics in the authentication process to identify that it's you, i.e. your username, but you still need a password.)
The only form of authentication that will work long term is to run a hash on the entire person.
Basically instead of authenticating that it is the same person, you authenticate that whatever is attempting access shares enough characteristics with that person to use the resource in the same way.
Like, a perfect transporter clone of me can get access to my stuff, but it’s okay because he’s got my same goals and moral constraints.
What if you want to have more than one account with a provider, but you have only one face?
Are you serious or are you being pedantic and trolling? That doesn't change my point, your face shouldn't be the password to both accounts. It's pretty easy to add another step for multiple accounts.
Ok, but the providers will not offer such a service. I'd gladly take 2fa using biometrics and a password/passkey with my username working as it always has.
I'm not saying biometrics should replace all usernames. I'm saying that they should be used as usernames/identification at best.
I have the same username at multiple websites...