Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If your FIDO2 key is compromised, you can bin it and change to a new key.

If your fingerprint is compromised, where can get new fingerprints?

Device based security (like a FIDO2 key, or even a phone with an authenticator app) is great, beuacse when it's compromised, you can change it.

Biometrics though is even worse than a userID, it's public, left everywhere, and can't be changed



There's a difference. If your FIDO2 key has biometrics (such as touch ID) then it's still a FIDO2 key. It means if it gets compromised (lost or stolen, for example) then you need both the device and the biometrics to gain access.

If your fingerprints are lifted/leaked from a glass, for example, then published, your attackers also still need physical access to the device you use biometric security against.

If that's public, such as your house front door, I agree, you've a problem. If that's your cellphone, then you have to ensure you don't leave your phone unsupervised.

The same is frankly true of other exploits that can be done in-person, such as USB attacks or PIN code screen bypass, and so on. Once you have physical access to a device, you can authenticate via many means, not just biometrics.

I'd point out that a password can also be compromised. https://xkcd.com/538/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: