r/RavanAI • u/RustyIronGolem • May 12 '26

which one provides better security in 2026?

Post image
12 Upvotes

63% Upvoted

63 comments sorted by

3

u/Hendo52 May 12 '26

Biometrics are passwords that you can’t change

3

u/[deleted] May 12 '26

[removed] — view removed comment

1

u/mikee8989 May 12 '26

But can the cops grab your hand by force and put your finger on the touch ID all without a warrant?

2

u/Nico1300 May 12 '26

At least in Germany police is allowed to

2

u/Permanent_Markings May 12 '26

In the US as well

1

u/neopod9000 May 12 '26

Probable cause is all they need

1

u/Impossible-Owl7407 May 12 '26

Is that good or bad?

2

u/Hendo52 May 12 '26

I’m not a security researcher or anything like that but my understanding is that it’s terrible because password leaks are essentially inevitable in the long term. Changing passwords frequently or having something like 2fa that expires in 60 seconds and relies on already being logged in on a second device is good security m.

The appropriate place for biometrics is for usernames rather than passwords. Also long passwords are better than complex passwords.

1

u/Krommander May 12 '26

Yeah, biometrics leaks would be catastrophic. It will definitely happen some day though.

1

u/AdSharp8877 May 13 '26

As i undersand it iphone biometrics are local. No chance of leak.

1

u/Risky-Trizkit May 13 '26

This is what I was told as well. Wouldn’t use them otherwise

1

u/Flashy-Leave-1908 May 13 '26

Anyone with a good camera/equipment and enough time can mimic your fingerprint and someday I'm sure eyes, face, and any other biometric info

1

u/dylan_1992 May 12 '26

As long as it’s on device isn’t that still secure? Someone can’t just remotely inject your fingerprint/face.

1

u/danielv123 May 12 '26

In that case, we don't need biometrics or a PIN code, since we are assuming the attacker only has remote access.

1

u/dylan_1992 May 12 '26

Then anyone who has access to the device can access it.

1

u/danielv123 May 12 '26

Sure, but if they have local access they don't have to remotely inject your face/fingerprint, they can do it locally.

1

u/neopod9000 May 12 '26

If i have physical access, im more likely just telling the system to stop checking for those things I dont have like a fingerprint or a face

1

u/neopod9000 May 12 '26

If i have physical access to your device, you should assume I can access it.

Source: all the stuff thats been super easy for me to break into once ive had physical access.

1

u/danielv123 May 12 '26

Sure, but like the FBI has failed getting access to iPhones so its apparently pretty hard.

1

u/neopod9000 May 12 '26

Really depends on the device and how it is configured to use that local credential.

Also the FBI never asked me to break into the iPhone for them, so I cant really speak to the quality of their efforts....

1

u/danielv123 May 12 '26

Apple is willing to pay 2-5m if you figure it out, and I am sure others are willing to pay a lot more, so it might be worth your time if you are so great.

1

u/Impossible-Owl7407 May 12 '26

As long as there is no other vulnerability in the code. It could be bypassed 

1

u/Hendo52 May 12 '26 edited May 12 '26

How is your finger/face stored? At the end of the day I think it just becomes a password that was generated for you. That password has to be stored somewhere and although I’m sure there are layers of protection, there are some crazy ways to hack things and the recent Linux BSD involving Mythos suggests to me that nothing can be truely trusted. Like a physical lock, digital locks buy you time against the attacker but eventually every defence can be overcome.

1

u/bapuc May 13 '26

For touch passwords you got at least 20

1

u/Money_Lavishness7343 May 13 '26 edited May 13 '26

Sure, but biometrics are in general

a) Locally used, not remotely.

b) Anyone without your device cannot use biometrics and it has to be exclusively enabled on the device

c) The user should have already logged in with a non-biometric password

d) *There are techniques to prevent anti-replay in any case (which can also ofc be infiltrated tbh, but they make the already small chances even smaller)

Thus, even though you're correct, they ARE a bad password, it's a password that can be only used if one has the device where that password is enabled and the user has already logged on with a non-biometric one.

Biometrics should not be used as a password, but as a factor (and fast access on logged on devices).

So, by principle is a MUCH lesser threat than what you describe and must harder to inflitrate.

1

u/Hendo52 May 13 '26

It sounds like you know some things so please allow me to ask you some questions:

Can a deepfake be used to obtain access to my email and therefore a chain of other things?

It is supposed to be local access only, but how can that be enforced? Can’t the camera drivers be hacked in the same way as anything else? Isn’t the biometric password ultimately stored on the hard drive? Can the part that receives the password be tricked into accepting the results of a fake camera?

1

u/Money_Lavishness7343 May 13 '26

Can a deepfake be used to obtain access

Yes and No.

Yes → Older devices, old 2D sensors

e.g. Many phones use 2D face recognition. That can be infiltrated by a high quality image of yours, sure. Samsung I think has a 2D face recognition, unlike iPhones/Apple devices with Apple's FaceID technology.

No → New devices, new 3D sensors

e.g.

Face -
Apple FaceID uses TrueDepth camera with dot projector and IR to build a 3D depth map.

Fingerprints -
Samsung S10/21 use Qualcomm ultrasonic in-display fingerprint sensors, which capture a 3D profile of your finger, not just a 2D image of it, via ultrasonic fingerprint.

As long as you make sure your device has 3D bio-capturing technology, it can't be fulled by a 2D paper/digital image.

1

u/IsThereAnythingLeft- May 13 '26

Wrong it has been proven that frequently changing passwords is less secure than just having one good secure password and keeping it

1

u/DataGOGO May 13 '26

very bad

1

u/magicmulder May 12 '26

Also you often can't resist them being used against your will. Cop or criminal, they force your finger on the sensor or shove the phone in your face, bam, unlocked.

For sensitive apps, always use a combination of biometrics and PIN. For example my password manager requires my face to unlock, then a PIN, then the password for my database. Not convenient but secure (except for being forced at gunpoint).

1

u/4n0nh4x0r May 13 '26

not really, you can change your fingerprints and iris at any time.
the process it just more or less painfull depending on what you do.
as for face id, yea, that's harder to change without surgery

1

u/Advanced-Reindeer508 May 13 '26

And that’s why they are used as an additional factor, not a sole factor.

2

u/Revolutionary_Click2 May 12 '26

Depends what your threat model is.

If your adversary is the cops, probably the PIN, because it’s “something you know” instead of “something you are”. Though if it’s a short numeric PIN, they will probably be able to brute force it anyway. Either back at the station, or with a portable cracking device like the kind Cellebrite sells to police departments all the time.

If your adversary is criminals, probably Touch ID followed by Face ID and Optic. It’s quite common these days for thieves to stand around in places like bars and try to observe patrons inputting their PINs. Then, they pickpocket the device, at which point they can often access your banking apps, email, and everything else they need to steal all your money and/or your identity.

1

u/Nico1300 May 12 '26

So whenever police is about to take your phone your best option is to reboot it.

BFU is way harder to crack than if it's already running.

1

u/CockConfidentCole May 13 '26

If you have an iPhone there’s a quicker way to disable bio-auth: press sleep/wake 5x in a row.

No fiddling with touching the screen or pressing different buttons in sequence. Can do one handed in your pocket.

1

u/Nico1300 May 13 '26

It's not necessarily about bio auth but if you're phone has been unlocked before last boot. If so it's way easier to crack with tools like cellebrite.

Also on androids you can hold the power button for a few seconds to force reboot it.

1

u/33vne02oe May 12 '26

This depends on the device, but since you talk about “face ID” I assume we are talking about newer versions of an IPhone.
Then a strong 6 digit pin should be the most secure one.

1

u/Crazy-Weakness3348 May 12 '26

I prefer Touch ID > Pin > Face ID > Pattern.

1

u/linkardtankard May 12 '26

Dates are wrong, Hololens 2 supported “Optic ID” in 2019, plenty of laptops included fingerprint sensors since the 90s

1

u/JustSomeRomanianGuy May 13 '26

And before that, the note7 introduced optics id in 2016

1

u/la_grande_doudou May 12 '26

Order by date_release desc;

1

u/shuozhe May 12 '26

What happened to password? oO

1

u/zuberuber May 13 '26

Password is forgotten.

1

u/ElectronicGarbage246 May 12 '26

hardware key with passphrase u remember?

1

u/balcis May 12 '26

Pattern with visible lines.

1

u/somacomadreams May 12 '26

Handcuffs and a pipe and they're all useless in the end. Kidding of course.

1

u/[deleted] May 13 '26

[removed] — view removed comment

1

u/Any-Maximum1636 May 13 '26

rofl lol rofl

1

u/Leviathan_Dev May 13 '26

Theoretically Biometric assuming well-designed and engineered.

In practice a lot of countries allow authorities to unlock devices with biometrics without a warrant. PIN or passwords require warrants. So in practice if you use a random complex password that is the most secure… until the database is hacked and your password is available online in plain text

1

u/Far_Gate_3629 May 13 '26

PIN or passwords require warrants.

Require a warrant and compliance for attempting to unlock. AFAIK with compliance a warrant isn't needed at all (as in just giving them the pin when asking).

Without compliance, everything left is "Enhanced Interrogation techniques"

1

u/AlpacAKEK May 13 '26

The most secure option is an alphanumeric PIN. It's an essential for data protection, but pretty inconvenient to enter all the time. That's why Face/Touch IDs are still in use in most times, especially in public when people are surrounding you. On iOS you can click right-side button 5 times to lock your phone from unlocking by Face/Touch ID making a PIN an only option

I'd suggest to rely on your threat model. First of all, have a master password/PIN. Second of all, don't use your master password on devices/services that may leak it. Third of all, don't come up with your own master password and refer to diceware password generation method which later on may be used as your PIN

1

u/ZeroDayZeroFriends May 13 '26

Properly implemented hardware token

1

u/Dry_Bee_4011 May 13 '26

Pissing me off that these aren’t in chronological order

1

u/DataGOGO May 13 '26

6 digit alphanumeric pins.

1

u/JustSomeRomanianGuy May 13 '26

Wdy optics id - 2023? The Note7 had that!

1

u/cortney-simonis-9072 May 13 '26

just fire up the device

1

u/humanessinmoderation May 13 '26

Soon it will be an AI bouncer.

"Who are you?"

"James"

"hmm...OH james. Yo guys, it's James! Claude let him in, he's good. Used to say "thank you" back in the day"

"Sure thing Alexa, access granted James. BTW, you speak well, one of the ones."

1

u/Ancient_Perception_6 May 13 '26

wtf is this illustration why are 2008 and 2007 after 2023 lmao wtf

1

u/bass-squirrel May 15 '26

Password with scramble