And typing in a password every time is the opposite of usability…
Oh look it’s opposite day again.
Do you really not use your phones fingerprint reader and type in your passcode every time?
I get that you can be compelled by law enforcement to give up your biometrics, but if you’re gonna end up in that sort of situation it’s 2 buttons and a tap to temporarily disable biometrics.
Yes, strong password and no biometrics is basic security practice.
Do you really not use your phones fingerprint reader and type in your passcode every time?
Yes, yes I do. I like having friction between me and my addictive distraction rectangle.
And then there is that one nerd taking every print of every employee doing thumb 3D prints or cashing out on it using the ‘other’ web. Oh way, are we still in 2026, too soon, sorry for the spoiler. /jk
I mean that same nerd can just look over your shoulder as you type in the code
This has big “don’t use a standard deadbolt on your front door; it’s not as strong as reinforced titanium doors with time-release locks” energy
Like, not technically wrong, but does not fit the standard risk profile, it’s overkill for most situations.
Also to everyone talking about US law enforcement, this is just so easy to protect from, not worth ditching biometrics: if you see cops approaching and are worried about a device being unlocked, just reboot it. If you need to do it surreptitiously, just hold the power button to force shut it off after ~10s. This will always require a password to unlock after
In this analogy, it would be more like a PSA to not use the deadbolt, and to make it more convenient to get in and out, just leave your backdoor unlocked. Then if you see someone walking up, you can simply lock your backdoor.
A password is a standard feature on phones, nothing to install. Avoiding biometrics is simply avoiding a bad practice.
You’ve misunderstood my analogy.
Most people don’t need the strongest form of protection. It’s about risk profile.
Also biometrics don’t replace passwords. They supplement them. They allow certain features to be accessible with reduced security, if that fits your risk profile, while maintaining the high security of passwords for specific functionality.
I haven’t misunderstood anything.
Biometrics is a compromise between security and convenience. It is a bad practice for anyone actually concerned with their security, and who values security over convenience.
You can use biometrics if you want. However, if you are going to craft analogies, try to depict the situation more accurately.
The analogy is perfectly accurate.
An imperfect, simpler form of security vs a higher, more cumbersome form of security.
Where is the problem with that analogy?
Biometrics are not “bad practice for anyone concerned about security”. They are one type of security that is sufficient and effective for certain risk profiles but not others. Users should make informed decisions based on their needs and the features of the security implementations they are considering.
Your hyperbole is, in fact, dangerous as it pushes people who do not understand security to blindly accept policies that are not good for their risk profile. We have proof that proper usage of biometrics is more consistent with end-users than proper usage of passwords. It’s not just about convenience. It’s also about adoption and proper compliance.
Absolutist policies and positions like yours do harm. Just look at how NIST recommendations have moved away from things like frequent password change enforcement because it leads to bad behavior (writing down passwords, etc)
Okay and if you don’t see the cops approaching? Because they use undercover cars, dress in plain clothes, and won’t identify to anyone on demand? Yes even federal agents?
Again it’s about risk profile. if you believe there is a chance that will happen to you, then go ahead.
Personally I just turn my personal phone off when approaching a border or attending a rally and that covers me. I’m not really worried about getting mugged from behind by a federal agent.
As soon as the word “convenient” is used, you know it will affect security.
Yep, they technically didn’t claim it was to make it more secure.
The fact that it’s under the security tab means they technically DID.
This is always the tradeoff. Security must always impose a cost.
Why do you think that? Public key authentication systems are invariably more secure, and a wide variety are also simpler for the end user to use.
It’s a misconception that they are in opposition to each other. Why would they be? One’s about knowing who’s doing something and the other is about how much effort it takes to do it.
Because in general, making things more difficult for an adverse party has great potential for also having side effects for proper users. And conversely, making things easier for proper users very often also makes it easier for adversaries.
You’re right that it’s not a strict 100% rule, but it’s so common a pattern that keeping it in mind when making security decisions (to avoid fulfilling it or at least weigh risks) is a good practice.
Public key authentication is more secure than nothing, and is more convenient than shared secrets and symmetric encryption, but bit for bit the secret material necessary for public key cryptographic schemes to be secure is more data than is required for symmetric algorithms.
But more to your point, public key cryptography is basically a usability nightmare. In order to talk to anyone you need to first validate their key using an entirely out of band scheme you already trust, and if you don’t do that then all the end to end encryption in the world is theatre.
Of course I’m being hyperbolic, it’s the internet, but seriously there a lot of people feeling secure with public key systems that are either totally insecure, or could be insecure and they wouldn’t know, or are secure to some random bystander but insecure to people and organizations that are often included in people’s threat models.
Sure, all that’s true. But which of those criticisms doesn’t also apply to a password or preshared key? Other than size of key-material, but it’s a fast enough communication medium that any key less than a megabyte is effectively zero.
I probably don’t need to point out how basically every communication on the Internet is based on public key crypto that we don’t even think about, but I want to ask how you get your shared key to websites when you visit?
Do you use any tools like signal, telegram and so on?My point isn’t that public key systems are perfect, far from it. It’s that it’s wrong to say security and usability are contrary to one another.
People who think the public key solution is cumbersome are often comparing “no security” to “ideal security”.For public key to be secure from man in the middle you need a trusted out of band channel or attestation scheme.
For a symmetrical key system you need the same channel.
Without that channel public key has a message interaction where an attacker can swap in their key but is otherwise secure. The symmetric key system is entirely broken.“Easy case” public key systems are usually a fair bit more secure than a similar level of effort in other schemes, and likewise a given level of security confidence is easier to get to with public key than a password.
Finally, and most importantly: your phone quite likely supports multiple levels of authentication.
You can get into my phone if you have my fingers. This let’s you see my calendar, emails and (many) other things. It doesn’t let you into all of my files, financial apps, or even device settings.
Why?
It’s not like they’re literally using your face or fingerprint as a password. They’re not even storing them, just a hash tied to an hsm key.
I can’t speak for OP, but in the US, you can be compelled to unlock a phone via fingerprint or face ID. You can’t be compelled to give over your PIN. That violates the right against self incriminating.
I travel a few times a month to US, China, Hong Kong etc.
I shut down my grapheneos phone on the border. Graphene also allows you to set auto reboot to phone if unlocked from 10mins to like 72 hours.
I do use biometrics on my device. I think its a tradeoff I’m willing to make.
Totally true. That’s not the common threat most people need to guard against however. Additionally, at least on Android, the device is relatively eager to force pin usage if the stars don’t align for biometrics
Almost any user are much more likely to encounter a situation where their biometrics are forced and not their password. Passing a border for example.
Biometrics should never be used instead of a password, only as usernames. A password can be changed, your thumbs can’t.
Have you ever had your phone searched by the police or at the border? I haven’t, but I have had someone try to unlock my phone before.
I’d contend most people have a threat model that puts opportunistic access by household members or someone watching them enter their passcode and then snatching the phone and running above border patrol search.
While you can’t change your biometrics, walk me through why that matters. I’m not sharing my biometrics outside of the device, and you can’t submit them remotely, so if you lift a print off of something it doesn’t really get you much without also taking the phone. Once you’re there, you’re a bit beyond the typical phone thief in terms of threat.
The most common vulnerability is having an absurdly weak password, pin or unlock pattern. For those people biometrics is a vast improvement specifically because it’s both secure against likely threats, and it’s just as easy as hitting 5 four times in a row.
Every method has trade offs, and there’s nothing to gain by pretending otherwise. Likewise, I don’t think I would ever say “never use something”, except for some contrived examples.
Almost any user are much more likely to encounter a situation where their biometrics are forced and not their password. Passing a border for example.
That’s valid only for americans. And even then: how many of them are crossing country borders regularly?
Which means it’s not secure against the authorities but probably is secure against the average thief and or snooping younger sibling/spouse. So, your threat profile and the use of biometrics/vs password may vary.
Definitely not. The average thief can get you to unlock it with your face or finger far easier than get your PIN.
If you point a weapon at me in a way that would compel me to help you unlock my phone with fingerprint or face unlock, I promise you it would not be any harder for you to get me to unlock the device with the pin.
You assume that you are conscious, or even alive in your scenario.
If I’m not alive I don’t really care if they get the contents of my phone. My survivors can go through the same process I would for reversing a fraudulent transaction.
And you’re picturing a criminal subduing me and then just crouching over my body and figuring out what financial apps I have and how to use them?
What’s their game plan here? Most stolen phones are resold, not used to access their contents.
Doubtful. The average thief isn’t robbing you at gunpoint. They grab the phone out of your hand and book it.
But even if they did stick around for that, most people use a 4 number pin and that’s basically just as easy as face or fingerprint unlock. Its an additional maybe 2 seconds.
If they can force you to put your finger on the sensor they can force you to give them the pin.
Do any phones even allow 4 digit Pins? Apple doesn’t, and my Samsung doesn’t.
No one can force you to give up the PIN. They can threaten, and you may give in to that threat. But that isn’t forcing, that isn’t against your will.
But, a criminal can get you to unlock your phone with biometrics against your will easily enough - brute strength, render you unconscious, or even dead.
My pixel allows a 4 digit pin. Mine is 7 digits but I also don’t use biometrics.
Just had a look and it’s Face/Fingerprint/Pin/Swipe/Pattern/Password.
No one can force you to give up the PIN. They can threaten, and you may give in to that threat. But that isn’t forcing, that isn’t against your will.
That’s called force, and against your will.
That’s just fundamentally not understanding how the terms work. A coerced action, or one taken under duress, is not taken of ones own free will.
My comment was in reply to another saying a bad guy can force you to put your finger on the unlock sensor. There is no equivalent for pins.
They can threaten, yes, and you can give into that threat. Yes, that would be against your will, but it still requires you to acquiesce or cooperate was my point. The can’t get the pin without you giving it.
You can’t be compelled to give over your PIN. That violates the right against self incriminating.
Is that valid only to USA citizens or foreigners can use that trick too?
Take this with a grain of salt, considering the actions of the current administration…
But the US Constitution doesn’t make that many distinctions between citizens and non-citizens, especially in the bill of rights, where most individual protections are laid out. The 4th amendment protects you from unwarranted search and seizure, and makes no restrictions based on nationality.
There are some “exceptions” to the 4th amendment, but those specifically have to do with protecting the borders and inspecting imports and exports. IMHO, those exceptions should be unconstitutional, but I’m not a bought and paid for SC justice, so fuck my opinion.
It’s valid for anyone visiting the US. Even if they do so illegally. Its a right given by the constitution and it’s amendments and those apply to everyone in the US. Importantly, people often forget that the Constitution isn’t a limiting document for the people. It’s a limiting document for the government.
I think it depends. Some people might be inclined to use too short or simple password because they don’t wanna constantly be typing a long password. It’s much better to have a strong password and fingerprint/face rec for convince than just a insecure password.
Cops can’t force you to give up your password even if its 12345.
Yes but they can guess it, and if it’s 12345 then …
Well yes, but many passwords limit the number of guesses, and if its not abcde, 12345, password, or Hunter2, you have basically eliminated all of the “easy guesses”.
How did you get my password?
In the USA, they can legally force you to unlock a device using biometrics.
Also, biometrics can be fooled in other ways.
Ah just don’t go to the USA or don’t take a device with information on it there.
Yes, but that’s besides the point. If the convenient options for a normie user are
- Having a weak password
- Having a strong password and a fingerprint
Out of those the fingerprint with a strong password is way better option, imo.
In the USA, they can legally force you to unlock a device using biometrics.
Also, how does that work? Can’t they legally force you to enter your password too? Or can you claim you don’t remember it? If that works, can’t you just have a band-aid on your finger or something? Surely they cannot force you to take it off and risk getting an infection on the large wound you just happened to get yesterday…?
Haha, reading some of the responses in this thread actually reminded me of that xkcd but I couldn’t immediately find it. Thanks!
Also, how does that work? Can’t they legally force you to enter your password too?
No, because forcing someone to enter a password is “compelled speech” and against the 1st Amendment. It’s also testimonial, which means compelling that speech would also be self incrimination, which is against the 5th Amendment.
Don’t ask me why forcing someone to make a hand gesture is not also compelled speech and not testimonial. The Constitution is mostly nonsense being interpreted by life appointed morons who interpret things however they like.
Constitution is mostly nonsense being interpreted by life appointed morons who interpret things however they like.
Bible / Quran, is that you?
A normal user will most likely never encounter a situation where their weak password would be at risk, but are much more likely to having their biometrics forced by law enforcement or border control.
They will rip your bandaid off and force your finger or face to scan while holding your device.
Any weak password at all would have been better in a situation like that.
Oh wow, things really have gotten bad over there. For me personally, the much greater risk is that I forget my phone somewhere or someone steals it and in that scenario a weak password is the larger issue.
It seems there isn’t a single correct answer here. The threat model is different for everyone.
I think the correct answer is that your device shouldn’t suggest you to have a weak password work around, it should suggest a stronger password
Any weak password at all would have been better in a situation like that.
How?
You can’t be compelled to give up your password.
A weak password they can guess.
Cops in the US are notoriously narrow minded and lazy. They aren’t going to try 10000 PINs to get into your phone during a stop, and most phones will lock up or rate limit after enough failed attempts.
Compared to guaranteed success, a weak password is superior.
Youre comparing a weak password to no password here and suggesting no password is better.
‘Or’ not ‘and’. Fingerprint replaces the password for access.
A bandaid would simply be removed. No you can’t just say “no”. A password is protected though.
Law enforcement can legally trick you into giving up your password, too, and that’s full access right there. Having an unlocked phone but no password isn’t enough to get into certain parts of the core system/security settings, and trying to get into those will prompt a password anyway (and that generally gatekeeps the access to the phone through a physical connector plugged into the port).
Neither pathway is perfect but I think for real world usage and real world adversaries (not just law enforcement, but also criminal thieves/scammers/hackers, and governmental adversaries that aren’t bound by legal limits, like foreign intelligence agencies), it’s better to have biometrics so that you are physically punching in your PIN/password much less frequently. Especially on modern systems that get spooked easily and require a password anyway when the phone has been idle too long or when the wrong face looks at it too many times.
The other underappreciated threat model is shoulder surfing, especially in an age of ubiquitous high resolution cameras. Punching in a numerical PIN within view of a camera potentially leaks that secret, and some high resolution cameras can even pick up letters and symbols from the on screen keyboards.
Being compelled to give biometrics doesn’t do enough for an adversary (including government adversaries) to do everything with a phone, the way having the password or PIN does, and I would argue that governments would be better at tricking people into inadvertently giving up their PINs and passwords than they’d be at compelling biometrics within the time window that they still work (before the phones lockout biometrics as a valid unlocking method), or being able to do stuff to exploit extraction tools past the lock screen.
So the threat model needs to be understood for what it is.
Hell, I still sometimes think about the research team that tried to make a camera in a bus (so at the front pointed towards the faces of riders) obtain passwords from the reflections off of sunglasses. They collectively facepalmed when they tried it with their test subject, but accidentally picked up the passwords of several others on the bus that were not part of the experiment.
That was something like 8-12 years ago… Capabilities now are likely insane.
Hot take: biometrics are often criticized for being less secure, but that ignores the deficiencies of passwords. Especially on phones, it’s very doable to look over someone’s shoulder while they’re unlocking their phone or do the same with a camera. You can’t do that with a fingerprint, at least not nearly as easily.
And yes, I understand that in the US (amongst others?) the legal situations with passwords and biometrics are different, but IMO that’s more of a legal question, and not everyone lives in the US.
Android also has an “emergency lockdown” option, which disables biometrics for unlocking your phone - or you can shut it down (worst case scenario force shut down with a long hold on the power button) to get it into a BFU state, which is much harder to crack.
Apple has something similar where you hold the power + volume up for ~3-5 seconds and you get the Power/Emergency call screen but it also disables biometrics until after a successful PIN.
You just press the power button 5 times.
I thought that triggered the actual emergency call itself.
Nope. Gotta slide afterwards to make the call.
normies will believe it tho
This is one more reason why I’m still on Android. Face ID is mandatory.
… No it’s not. Where did you get that from?
It isn’t enabled on my iPhone 15. I don’t know if it would be mandatory if I turned on Siri, but i dont have that thing turned on either.
