• Boozilla@lemmy.world
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    8
    ·
    6 months ago

    I’ve read all this before. If you believe the people who designed and implemented the device and its myriad layers of firmware and software were 1. All acting in good faith and 2. Knew WTF they were doing… then: yes, sure.

    Unfortunately that’s way too many strangers for me. Hundreds of people design and code these things. Meanwhile, every week there’s a clever new breach somewhere.

    • ricecake@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      1
      ·
      6 months ago

      While I do respect that viewpoint, there’s a lot more independent scrutiny of the hardware modules than there are around the parts that would handle any other authentication mechanism you might use.

      Pixel phone example iPhone example

      Just because something isn’t perfect doesn’t mean we should keep using the less good thing that it replaces.

      Use the PIN if that’s more your cup of tea, just so long as you move away from passwords, since it’s the HSM that’s the protection, not the biometrics. Those are just to make it easier than passwords.

      • Boozilla@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        6 months ago

        You can change PINs and passwords, but you cannot change your biometric data.

        It’s about as smart as using your SSN as your username.

        • ricecake@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          3
          ·
          6 months ago

          The point being that most people do not need to ever change their biometric data, because it isn’t used for remote authentication.

          It’s about picking the right threat model, and for most people anything that gets them using the HSM is an improvement to their security.

    • lolcatnip@reddthat.com
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      2
      ·
      6 months ago

      If you’re that afraid if the people who build phones, why are you ok with using any device that can access the internet?

      • Boozilla@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        arrow-down
        1
        ·
        6 months ago

        I like how being cautious with my biometric data is beung framed as irrational fear and paranoia. As if ID theft never happens.

        • RGB3x3@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          edit-2
          6 months ago

          You should be more worried about your local doctor’s office contracting some cheap-ass company to handle your data and ending up in a branch than being concerned about biometrics.

          Or hell, Experian had that insane breach of basically everyone’s information years ago. Biometrics are not the problem, it’s smaller companies that you have to deal with all the time skimping on security because they think they can’t afford it.

          And then companies even more shady than Google and Apple and Samsung (loan companies, health systems contractors, banks, credit card companies, insurance companies) have all your data and are more likely to be involved in a data breach.

        • lolcatnip@reddthat.com
          link
          fedilink
          English
          arrow-up
          2
          arrow-down
          2
          ·
          6 months ago

          Using biometric data to unlock your phone does not make you more vulnerable to petty criminals.