<div dir="ltr"><div>Kevin,<br><br></div>Not sure if you intended to suggest that using a tool like LastPass or 1Password is good or bad, but I feel pretty confident saying using a password manager (such as those tools) is the one "right" way to handle password based auth. Those tools should support MFA, have good security by default and generate per-service passwords for users. Password re-use is a much bigger threat most of the time (anyone use the same password for their bank random joe's Linux forum, if so your security is only as good as the weakest link). There are some practical concerns with these sorts of tools, but from my perspective those are a whole lot less than using (and re-using) a password the human brain can remember on demand.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Nov 22, 2014 at 2:17 PM, Kevin Fries <span dir="ltr"><<a href="mailto:kevin@fries-biro.com" target="_blank">kevin@fries-biro.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">I agree, except the idea of passwords being compromised is far easier than a password. The use of passwords especially the 4 digit pins that secures our banking info is ludicrous. </p>
<p dir="ltr">I am very fond of using NFC lock on a electronic device like a phone, then use fingerprint on the phone. A key is no good without a lock, and a lock is no good without the key.</p>
<p dir="ltr">So, placing the unlock on the phone, with the secondary unlock being biometric makes far more sense. If the biometric was used with a key on the device to generate a consistent new key, (think of the fingerprint being the salt of an encryption algorithm), this would be very secure. Steal my fingerprint, and without they key (on the phone) and it does you no good. Steal the phone without the fingerprint, and it does you no good. Now you need a double breach to compromise your data.</p>
<p dir="ltr">While nothing is 100% the use of fingerprint and key is a huge improvement over current systems or anything mentioned in this article.</p>
<p dir="ltr">The biggest issues with passwords is that if they are not easily remembered, users write them down, or use a password tool like Last Pass or 1Password. If they are easily remembered, they are easily guessable. Therefore the use of passwords is inherently flawed. Biometrics can't be guessed.</p>
<p dir="ltr">Just my $0.02</p><span class="HOEnZb"><font color="#888888">
<p dir="ltr">Kevin</p></font></span><div class="HOEnZb"><div class="h5">
<div class="gmail_quote">On Nov 22, 2014 12:41 PM, "Paul Mooring" <<a href="mailto:paul@getchef.com" target="_blank">paul@getchef.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>This article makes some excellent points about using fingerprints as authentication, but I find it's conclusion of continuing to use passwords a bit suspect. The chances of your fingerprint being compromised are real, but no more real than the chances of your password being compromised (brute force, rainbow tables, weak hashing/no salt). In my opinion the take away should be use 2 factor auth all the time and I also think fingerprints can be an excellent form of 2 factor auth (I forget my phone/2FA device more than I forget my fingers).<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Nov 21, 2014 at 11:43 PM, der.hans <span dir="ltr"><<a href="mailto:PLUGd@lufthans.com" target="_blank">PLUGd@lufthans.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">moin moin,<br>
<br>
biometrics aren't secret enough or flexible enough to use in place of<br>
passwords.<br>
<br>
<a href="http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html" target="_blank">http://blog.dustinkirkland.<u></u>com/2013/10/fingerprints-are-<u></u>user-names-not.html</a><br>
<br>
ciao,<br>
<br>
der.hans<span><font color="#888888"><br>
-- <br>
# <a href="http://www.LuftHans.com/" target="_blank">http://www.LuftHans.com/</a> <a href="http://www.PhxLinux.org/" target="_blank">http://www.PhxLinux.org/</a><br>
# Data restorals via Freedom of Information Act requests.<br>
------------------------------<u></u>---------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.<u></u>org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/<u></u>mailman/listinfo/plug-discuss</a><br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div><div dir="ltr">Paul Mooring<div>Operations Team Lead<br></div><div>Chef</div></div></div>
</div>
<br>---------------------------------------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org" target="_blank">PLUG-discuss@lists.phxlinux.org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br></blockquote></div>
</div></div></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">Paul Mooring<div>Operations Team Lead<br></div><div>Chef</div></div></div>
</div>