Let’s start with a smartphone. A user creates an account with a passkey for a service, that passkey gets stored on their smartphone, and they can use biometrics to sign in from then on. The private key is stored on the smartphone. Great.

But then how do you sign into that same service from a different device?

If it’s by using a password manager, some third party piece of software, How do you sign in on a device where you’re not allowed to install third party software?

  • @Everythingispenguins
    link
    18 months ago

    Read your other comment and I don’t disagree. There are two things that I feel could though have a hiccup. First there is a real possibility that you will not be able to lock your phones. I have never set up face ID on any android I have had, but I don’t see any reference to an auto time out on Android on my phone or any of the setup walkthroughs online. Every manufacturer uses a slightly different build of android so it is hard to say that not Androids has it.

    Second it you have a ten digit password as a backup but use face id often the you could forget it. Which would lead many people to use an easy to guess password. Defeating much of the security with a long password has.

    • @[email protected]
      link
      fedilink
      18 months ago

      I can’t speak to Android as a whole, but here’s how often Samsung Face Unlock will require you to re-auth with your phone’s passcode:

      • after 4 hours of not using the phone
      • after restarting
      • at least once every 24 hours

      iPhones do something similar, but it’s after 48 hours of non-use (instead of 4) and at least weekly instead of daily. Having to enter your password daily should help most people keep it memorized pretty well, but weekly - maybe not. So you definitely have a good point there.

      One thing that can make it easier to remember - and just as secure - is to use a longer pass phrase instead of random characters.

      If you using the diceware approach (“correct horse battery staple”), then 5 words has 32 times / 5 bits more entropy than a 10 character mixed-case alphanumeric password (64 vs 59 bits of entropy) (4 word passphrases aren’t random enough to be recommended - they have fewer bits of entropy (51) than even 9 character mixed-case alphanumeric passwords (53), though notably 10 same-case alphanumeric characters also have only 51 bits of entropy).

      The EFF has a word list that’s been improved for usability. They also have a short list, comprised of words with at most 5 characters each, where you roll 4 dice instead of 5. With 6 words from that list you get 62 bits of entropy, which is good enough to be able to recommend.