A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.97K Posts
- 74.6K Comments
- Modlog
Fingerprint might count though I’ve considered fingerprint sensors to be a bit dubious. There was a famous incident in Germany(?) where some government muckymuck called for fingerprint based biometrics in a panel discussion at a security conference. Someone nabbed his water glass afterwards, lifted his fingerprints from it, and fooled a fingerprint reader. You can also duplicate your own fingerprints with Elmer’s glue. Just spread it on your fingertip, let it dry, and peel it off.
Password to unlock the totp app might count. Auth methods include knowledge such as passwords, objects such as tokens, and physical characteristics like fingerprints. 2fa means one thing from each of two categories. So the phone with the app and stored password is one factor, and the memorized app password is the second. But, remembering and entering complex passwords is a pain, and a lockout in the app for too many wrong passwords is a DOS vector (in the event that you get your phone back after such an attack). So it sounds annoying, idk.
I guess you might already have a similar lock on your whole phone anyway, so another one on the app might be redundant.
Right, so fingerprint on everything wouldn’t be the best practice, because it’s all in one category and everything can be unlocked by a compromise of that one thing.
That’s a good point. I might look at removing that from my totp app and using a passcode instead.
Yeah and if your fingerprint is compromised, you can’t update it.
I worry most about the phone, since they get stolen all the time and they are full of software vulnerabilities. For my own phone I’m hoping to use a token to unlock. So that’s two objects from one category but the token should be harder to steal, if the thief even knows about it.
I expect high security stuff like banking ops is done only from on-premises terminals and not from someone’s phone. I will try to ask my buddies in that field.
Physical location can be an auth factor too: you could have a token permanently installed at your desk, so it activated only when you are there.
You will probably like the book “Security Engineering” by Ross Anderson if you’re not already familiar with it. PDFs of the full 2nd edition and part of the 3rd are here:
https://www.cl.cam.ac.uk/~rja14/book.html