安全与隐私blog.dustinkirkland.com
指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
2013 — 2017，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。文章围绕指纹登录的安全性问题展开，多年来在 HN 上反复引发生物识别安全与可用性的讨论。
为什么经久不衰：它触及生物识别认证的根本属性——不可更改、无法保密——这一争论在 Face ID 时代依然适用，且作者本人也现身评论区更新观点。
HN 评论精选
指纹用于全盘加密太弱，但用于解锁手机是合理的折中
作者是 eCryptFS 的维护者，该加密文件系统被多个 Linux 发行版用于保护主目录或整盘。对全盘加密而言，指纹远弱于好密码：警察本就能从各处取得你的指纹，甚至可强制你现场按压，指纹登录只会给人虚假的安全感。但用于解锁手机则足够了——TouchID 不是防 NSA 的，而是防小偷和恶作剧者的。
kijin查看英文原文
The author is a maintainer of eCryptFS. For those not familiar with it, eCryptFS is an encrypted filesystem used by several Linux distributions (including Ubuntu) to protect your home directory and/or the entire disk. It serves a similar purpose to TrueCrypt, BitLocker, FileVault, etc. For the purpose of a full-disk encryption software, fingerprints are many times weaker than a good password. The purpose of such software is to prevent a thief, the cops, the NSA, or anyone else who takes possession of your computer, from viewing the contents of your hard drive. A fingerprint won't protect you from the cops, since your prints are already all over the place and they can probably force you to provide a fresh copy anyway. In that case, fingerprint logins would only give the user an illusion of security. So it's understandable that the author doesn't want to enable fingerprint logins to his software. For the purpose unlocking a phone, on the other hand, a fingerprint is probably good enough. The contents of the phone usually aren't encrypted, so a determined attacker will just turn the phone off, pull out the SD card and/or the internal Flash memory, and read everything off of it. Or if you're NSA, forget the phone and get the data straight from Apple. TouchID is not for NSA-proofing your phone, it's for deterring common thieves and pranksters. tl;dr: I agree with the author that fingerprints are not a good fit for full-disk encryption software. But I don't agree that fingerprints are completely useless. It all depends on the type of attack you're trying to defend against.
从实际体验看 TouchID 便利性远超理论上的安全顾虑
关于指纹安全性的学术争论与 TouchID 的日常使用完全脱节。它解锁极快，防止旁人乱动手机，小偷只有几次假指纹尝试机会，失败后需输密码，输错十次手机即被抹除。TouchID 几乎消除了锁屏的全部负担，比无密码滑动解锁还快，没有理由不开。
gfodor查看英文原文
All these academic arguments about the security of fingerprints are interesting but completely are detached from the day-to-day use of TouchID. I've been using it for about a week or so now. It's incredibly convenient. It unlocks my phone almost instantly. It prevents random people near by phone from being unable to unlock it. If a thief got their hands on it, they'd have a few attempts to unlock it with a fake fingerprint, and then they'd have to enter my code. And if they fail to enter my code 10 times, the phone is wiped. All in all TouchID basically removes almost the entire burden from the security of having a locked phone. It's actually faster to unlock my phone with TouchID than codeless swipe to unlock, so it's a no-brainer to turn it on. It doesn't matter that the NSA probably has my fingerprints, in practice it prevents most people from getting into my phone in a way that is transparent and easy to use. If the spooks want my data, they can already get it.
安全方案必须兼顾可用性，否则用户会用弱密码，结果更糟
TouchID 是消费级设备安全的巨大进步。安全设计必须考虑可用性：生物识别让用户愿意设置更强的密码；不用生物识别，人们就会用弱密码，那显然是更糟的结果。建议每次解锁都输入高熵强密码，只会导致更差的安全结果。
abalone查看英文原文
Why is this getting reposted? I’d argue this is very shortsighted especially coming from a security professional. TouchID has been a huge leap forward in consumer device security. Security design must take into account usability. Fingerprints (and now faces) make it easy to use stronger passcodes. If you don’t use biometrics, people use weak passcodes. That’s clearly a worse outcome. Sure, it’s even stronger to not use biometrics and enter a strong high entropy passcode every time you want to unlock your phone. But to actually advise something like that as a better approach in a consumer device than TouchID is simply to advocate a guaranteed worse security outcome. Maybe you “cover your ass” as a security acolyte and blame the compromised user for not following your stringent prescriptions, but that’s not owning the outcome. You have to consider usability.
作者重申核心观点：一切生物特征都只能当用户名，不能当密码
原作者现身：这篇文章今天比以往更切题！你的脸是你的用户名，不是你的密码。像使用用户名那样使用它，但绝不要当作密码那样的秘密。任何生物特征——指纹、声音、虹膜、步态、DNA——都一样，无论商家如何推销生物识别认证，那都是胡扯。
dustinkirkland查看英文原文
Original author here. This article is more pertinent today than ever before! Your face is your username, not your password. Use it like you use your username. But never as something secret, personal, unknown like your password. The same goes for any biometric. Fingerprints, voice, iris, gait, DNA, etc. No matter how much they try to sell you authentication through biometrics, it's total b.s. @DustinKirkland
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选HTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选Google 拥有我的大部分邮件，因为它拥有你所有的邮件（2014）
Google has most of my email because it has all of yours (2014)
作者(2014年)分析了自己社交网络中的邮件往来数据，发现由于大多数联系人都在用 Gmail，Google 实际上能看到他与几乎所有人的通信内容——即使他自己不用 Gmail，隐…
安全与隐私上首页 4 次 · 2014–2025mako.cc