On 8/24/2021 8:03 PM, JF Mezei wrote:
> On 2021-08-24 20:09, nospam wrote:
>
>> actually, it would make it not secure, which would be bad.
>>
>> if the phone is lost or stolen during that window, *anyone* could make
>> multiple purchases.
>
> The suggestion was to disable FaceID temporarily so phone goes right
> away to keypad entry for PIN/password. So no purchases possible if phoe
> list duringf that time.

I think that nospam understood perfectly well what you were saying.

A six digit pass code is certainly as secure, but probably more secure
than FaceID.

Apple claims, without any proof, that there is a one in a million chance
that a _random_ person could unlock your phone with their face. A six
digit code can have a million different combinations so even a
non-random person only has a one in a million chance of unlocking your
phone, though of course they can make several tries before they are
locked out. But if you add an "alternate appearance" to FaceID I guess
that reduces the probability to 1 in 500,000.

A 3D ultrasonic fingerprint sensor also claims a one in a million chance
but without the "random" qualifier required by FaceID, though just as
with FaceID there is no data to back up that claim.

Having FaceID fail multiple times prior to the phone requiring a
passcode is a pain. It would be great to be able to temporarily turn off
FaceID for when you're in places where masks are required.

On 2021-08-24 23:07, nospam wrote:

>> The suggestion was to disable FaceID temporarily so phone goes right
>> away to keypad entry for PIN/password.
>
> it already does that.

Not for me. Xs.

Double click on power button to put it into Apple Pay mode.
WAIT FOR FACEID TIMEOIUT at which poimnt "pay with passcode" button
appears, then press that button and then enter passcode and then and
only then can you bring phone to POS.

What I am suggesting: once mode is set, when you double click, it
immediatly display passcode and then shows cards and you cabn put it
over POS terminal.

What Apple has done is reduce the timeout between its attempt at faceID
and displaying the button. I am saying eliminate the time out and go
direct to passcode entry.

Where wearing a mask is mandatory in all stores, the iPhone is useless.

Apple can keep faceID as primary in Florida and Texas where they have no
Covid problem so masks are not worn, but for the rest of world, this is
a big issue.

And with Delta, expect masks will be worn for at least a year.

In new Zealand: 1 infected person with a "leak" in the quarantine hotel
has so far resuoted in 140 infections despite the whole coulntry being
in strict lockdown (as in: stay at home, with over 10,000 now considered
"contacts" and with stricter movement restrictions (can't go to
supermarket for instance).

On 2021-08-25 00:22, sms wrote:

> A six digit pass code is certainly as secure, but probably more secure
> than FaceID.

The issue is that it is now simpler and faster to just take credit card
and tap. This isn't about security.

On 25/08/2021 at 01:09, nospam wrote:
> Being slower than regular fingerprint sensors is the best case
> scenario. The worst is having these in-screen sensors regularly
> misread your fingerprint, requiring you to give multiple attempts
> before your phone finally unlocks.

For me, the more traditional fingerprint sensors (iPhone 6s etc.) rarely
worked and I usually ended up using the passcode. I re-entered the
fingerprint data on many occasions, to no avail.

--
Wilf

In article <A9kVI.26286$%r2.21700@fx37.iad>, JF Mezei
<jfmezei.spamnot@vaxination.ca> wrote:

>
> >> The suggestion was to disable FaceID temporarily so phone goes right
> >> away to keypad entry for PIN/password.
> >
> > it already does that.
>
> Not for me. Xs.

user error.

In article <sg4gio$j48$1@dont-email.me>, sms
<scharf.steven@geemail.com> wrote:

>
> A 3D ultrasonic fingerprint sensor also claims a one in a million chance

where has that claim ever been made?

ultrasonic fingerprint sensors can be easily spoofed, making it more
like a 1 in 1 chance.

> but without the "random" qualifier required by FaceID, though just as
> with FaceID there is no data to back up that claim.

there is no data for the above claim because it doesn't exist.

> Having FaceID fail multiple times prior to the phone requiring a
> passcode is a pain. It would be great to be able to temporarily turn off
> FaceID for when you're in places where masks are required.

user error.

In article <sg4r6m$1e6a$2@gioia.aioe.org>, Wilf <wilf@postingx.uk>
wrote:

> On 25/08/2021 at 01:09, nospam wrote:
> > Being slower than regular fingerprint sensors is the best case
> > scenario. The worst is having these in-screen sensors regularly
> > misread your fingerprint, requiring you to give multiple attempts
> > before your phone finally unlocks.
>
> For me, the more traditional fingerprint sensors (iPhone 6s etc.) rarely
> worked and I usually ended up using the passcode. I re-entered the
> fingerprint data on many occasions, to no avail.

i didn't write that. it's a quote from one of the links i cited.

On 25/08/2021 at 11:10, nospam wrote:
> In article <sg4r6m$1e6a$2@gioia.aioe.org>, Wilf <wilf@postingx.uk>
> wrote:
>
>> On 25/08/2021 at 01:09, nospam wrote:
>>> Being slower than regular fingerprint sensors is the best case
>>> scenario. The worst is having these in-screen sensors regularly
>>> misread your fingerprint, requiring you to give multiple attempts
>>> before your phone finally unlocks.
>>
>> For me, the more traditional fingerprint sensors (iPhone 6s etc.) rarely
>> worked and I usually ended up using the passcode. I re-entered the
>> fingerprint data on many occasions, to no avail.
>
> i didn't write that. it's a quote from one of the links i cited.
>

Wasn't obviously a quote. Sorry.

--
Wilf

Am 25.08.21 um 05:07 schrieb nospam:
> In article <TpiVI.91074$Qp7.62192@fx46.iad>, JF Mezei
> <jfmezei.spamnot@vaxination.ca> wrote:
>
>>
>> The suggestion was to disable FaceID temporarily so phone goes right
>> away to keypad entry for PIN/password.
>
> it already does that.

Happens here with activated Face-ID wearing a mask.

--
De gustibus non est disputandum

Am 25.08.21 um 07:05 schrieb JF Mezei:
> On 2021-08-25 00:22, sms wrote:
>
>> A six digit pass code is certainly as secure, but probably more secure
>> than FaceID.
>
>
> The issue is that it is now simpler and faster to just take credit card
> and tap. This isn't about security.

BTW: Apple and Google are not welcome to be part of the financial system
and converting to parabanks. They are becoming really dangerous and
monopolistic. This constitutes an enormous risk for the society and the
economy.

--
De gustibus non est disputandum

Joerg Lorenz <hugybear@gmx.ch> wrote:
> Am 25.08.21 um 07:05 schrieb JF Mezei:
>> On 2021-08-25 00:22, sms wrote:
>>
>>> A six digit pass code is certainly as secure, but probably more secure
>>> than FaceID.
>>
>>
>> The issue is that it is now simpler and faster to just take credit card
>> and tap. This isn't about security.
>
> BTW: Apple and Google are not welcome to be part of the financial system
> and converting to parabanks. They are becoming really dangerous and
> monopolistic. This constitutes an enormous risk for the society and the
> economy.

They are no more a bank than Visa, Mastercard or paypal. Are they also
dangerous?

JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
> On 2021-08-25 00:22, sms wrote:
>
>> A six digit pass code is certainly as secure, but probably more secure
>> than FaceID.
>
>
> The issue is that it is now simpler and faster to just take credit card
> and tap. This isn't about security.

It is about security. Biometrics are more secure than PINs, there's no
debate about that.

On 8/24/2021 10:05 PM, JF Mezei wrote:
> On 2021-08-25 00:22, sms wrote:
>
>> A six digit pass code is certainly as secure, but probably more secure
>> than FaceID.
>
>
> The issue is that it is now simpler and faster to just take credit card
> and tap. This isn't about security.

True, but for some reason nospam tried to claim that it would affect
security, when the technically the passcode is more secure than either
the current 2D capacitive TouchID, or FaceID.

Personally, I don't want to use a physical credit card unless absolutely
necessary because the cash-back rewards are much lower than with mobile
wallet.

I have one card, that I don't carry the physical card, that gives 3%
back on mobile wallet purchases (Apple Pay, Google Pay, Samsung Pay). I
only get 2% back (on a different card) for tap and pay; that's a 50%
difference in cash back. For Apple Card holders they get 2% back for
ApplePay but only 1% for physical card, and the Apple Card doesn't
support tap & pay so you have to slide the card into the reader. There
are other cards that also give you more cash back for mobile wallet
purchases.

On 8/25/2021 6:14 AM, Chris wrote:
> Joerg Lorenz <hugybear@gmx.ch> wrote:
>> Am 25.08.21 um 07:05 schrieb JF Mezei:
>>> On 2021-08-25 00:22, sms wrote:
>>>
>>>> A six digit pass code is certainly as secure, but probably more secure
>>>> than FaceID.
>>>
>>>
>>> The issue is that it is now simpler and faster to just take credit card
>>> and tap. This isn't about security.
>>
>> BTW: Apple and Google are not welcome to be part of the financial system
>> and converting to parabanks. They are becoming really dangerous and
>> monopolistic. This constitutes an enormous risk for the society and the
>> economy.
>
> They are no more a bank than Visa, Mastercard or paypal. Are they also
> dangerous?

Not sure what a parabank is, but in the U.S. large non-banking companies
that want to start a bank, or get into the credit card business, will
spin it off into a separate entity. Ally Bank was part of GM. Discover
was part of Sears. I'm sure that there are other examples as well. I
doubt if Apple would want to start their own financial institution since
they are so laser-focused on consumer electronics. They've already
exited businesses that did not fit their core competencies. Google might
be more likely to attempt something like that.

On 8/25/2021 6:14 AM, Chris wrote:
> JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
>> On 2021-08-25 00:22, sms wrote:
>>
>>> A six digit pass code is certainly as secure, but probably more secure
>>> than FaceID.
>>
>>
>> The issue is that it is now simpler and faster to just take credit card
>> and tap. This isn't about security.
>
> It is about security. Biometrics are more secure than PINs, there's no
> debate about that.

LOL, there is actually a LOT of debate about that!

<https://www.zdnet.com/article/face-fingerprint-passwords-or-pin-whats-the-best-way-to-keep-your-smartphone-secure/>

A six digit passcode has a 1 in 1,000,000 chance of being guessed on the
first try, and too many tries will cause the device to be locked for a
while. That's actually much more secure than what Apple claims for their
capacitive 2D TouchID, the same as what 3D ultrasonic or optical
fingerprint scanners claim, and the same as what Apple claims for a
_random_ face with FaceID (the "random" qualifier was added because
family members that look alike have a better chance of unlocking a
parent's or sibling's phone than does a random person).

What is really needed is two-factor biometric authentication for times
when the highest security is needed. Some banks are already doing one
biometric factor and one password or passcode authentication.

On 8/24/2021 11:23 AM, JF Mezei wrote:
> On 2021-08-24 02:23, Joerg Lorenz wrote:
>
>> Face ID is acceptable in all occupations. You are again spreading FUD
>> and braindead nonsense. Yesterday I explained to you why Touch-ID won't
>> come back.
>
>
> Heree, face masks requires indoors. So people who work in stores always
> have face masks. Same with health care workers.

OMG, did Jorge really say "Face ID <sic> is acceptable in all
occupations." Say it isn't so! That's so obviously false that even Jorge
would not say it!

Maybe they don't have nurses, doctors, hospitals, medical offices, or
home health care workers, where he lives! Removing your mask to use
FaceID in those situations could result in you being terminated for
cause. If a regulatory body saw this occur then the health care provider
would get into trouble.

It's not just health care workers that are required to wear masks at
work at this time. It's food service workers, retail workers, office
workers, etc.. And some of this mask wearing is likely to remain as a
requirement indefinitely. I'm just waiting for the response of "well
they shouldn't be on their phones at work anyway!"

TouchID is almost certainly coming back, just not for another year or
so. It's not just so users have a biometric authentication option for
when FaceID is impractical, it's because with TouchID you can have
two-factor biometric authentication on the device.

On Aug 25, 2021, Joerg Lorenz wrote
(in article <sg590t$45o$1@dont-email.me>):

> Am 25.08.21 um 07:05 schrieb JF Mezei:
> > On 2021-08-25 00:22, sms wrote:
> >
> > > A six digit pass code is certainly as secure, but probably more secure
> > > than FaceID.
> >
> >
> > The issue is that it is now simpler and faster to just take credit card
> > and tap. This isn't about security.
>
> BTW: Apple and Google are not welcome to be part of the financial system
> and converting to parabanks. They are becoming really dangerous and
> monopolistic. This constitutes an enormous risk for the society and the
> economy.

That seems to be an odd claim given my experience that my bank, Amex, and Goldman Sacks have been quite happy to welcome Apple, and ApplePay.

--
Regards,
Savageduck

In article <sg5nob$tqk$1@dont-email.me>, sms
<scharf.steven@geemail.com> wrote:

> > It is about security. Biometrics are more secure than PINs, there's no
> > debate about that.
>
> LOL, there is actually a LOT of debate about that!
>
>
> <https://www.zdnet.com/article/face-fingerprint-passwords-or-pin-whats-the-bes
> t-way-to-keep-your-smartphone-secure/>

that article is old and makes many incorrect assumptions.

Biometrics also has another issue, in that they can't be altered. If
records of your fingerprint or face, or iris, are compromised,
attackers could use it to bypass all of your accounts, and you can't
realistically reset your face or your fingerprints.

none of that matters.

face id does not work with photos, which is a major shortcoming of
android face unlock systems. it requires an actual face on a living
human. 3d models don't work (the video claiming such is faked).

touch id requires a finger that is alive, so even if someone obtained a
fingerprint on file, they have the problem of figuring out how to map
it to a live finger on another person.

> A six digit passcode has a 1 in 1,000,000 chance of being guessed on the
> first try, and too many tries will cause the device to be locked for a
> while.

delays begin at 5 tries and ends at 10, when the iphone locks and does
not accept any more attempts and can also optionally be configured to
auto-erase itself.

> That's actually much more secure than what Apple claims for their
> capacitive 2D TouchID,

a six digit pin code is statistically better, except that most people
choose easy to guess pincodes (123456, 111111 are two of the most
popular), so in the real world, it's not as secure.

in other words, by simply trying the most popular pincodes, there's a
*very* good chance it will unlock a random device.

it also helps to know something about the person, since it's common to
use birthdays, anniversaries, etc.

> the same as what 3D ultrasonic or optical
> fingerprint scanners claim,

except that they can be spoofed within minutes.

> and the same as what Apple claims for a
> _random_ face with FaceID (the "random" qualifier was added because
> family members that look alike have a better chance of unlocking a
> parent's or sibling's phone than does a random person).

apple has always said that an identical 'evil twin' can spoof face id.

it's also not a significant threat model.

the biggest threat is if a phone is lost or stolen, someone other than
the owner can gain access.

> What is really needed is two-factor biometric authentication for times
> when the highest security is needed. Some banks are already doing one
> biometric factor and one password or passcode authentication.

that's entirely up to app developers.

as you say, some banks do it.

In article <sg5qh9$l90$1@dont-email.me>, sms
<scharf.steven@geemail.com> wrote:

> TouchID is almost certainly coming back, just not for another year or
> so.

it might remain on the iphone se (although that's not a given), but it
ain't coming back any time soon on the rest of the lineup.

> It's not just so users have a biometric authentication option for
> when FaceID is impractical, it's because with TouchID you can have
> two-factor biometric authentication on the device.

there already is 2-factor authentication: face/finger + passcode.

two biometrics is not 2-factor (both are the same factor) and risks
being locked out of the device. it's a very bad idea.

Am 25.08.21 um 15:14 schrieb Chris:
> JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
>> On 2021-08-25 00:22, sms wrote:
>>
>>> A six digit pass code is certainly as secure, but probably more secure
>>> than FaceID.
>>
>>
>> The issue is that it is now simpler and faster to just take credit card
>> and tap. This isn't about security.
>
> It is about security. Biometrics are more secure than PINs, there's no
> debate about that.

That is simply wrong and nobody except you is claiming such a nonsense.

--
De gustibus non est disputandum

On 8/25/2021 9:22 AM, Savageduck wrote:
> On Aug 25, 2021, Joerg Lorenz wrote
> (in article <sg590t$45o$1@dont-email.me>):
>
>> Am 25.08.21 um 07:05 schrieb JF Mezei:
>>> On 2021-08-25 00:22, sms wrote:
>>>
>>>> A six digit pass code is certainly as secure, but probably more secure
>>>> than FaceID.
>>>
>>>
>>> The issue is that it is now simpler and faster to just take credit card
>>> and tap. This isn't about security.
>>
>> BTW: Apple and Google are not welcome to be part of the financial system
>> and converting to parabanks. They are becoming really dangerous and
>> monopolistic. This constitutes an enormous risk for the society and the
>> economy.
>
> That seems to be an odd claim given my experience that my bank, Amex, and Goldman Sacks have been quite happy to welcome Apple, and ApplePay.

I think the question was whether or not Apple (or Google) would try to
open their own bank or finance company rather than partnering with an
existing bank.

Goldman Sachs first foray into the credit card business was the Apple
Card. Citibank reportedly turned Apple down on profitability concerns.

With 2% cash back for ApplePay purchases, that exceeds the typical
merchant credit card fee, so any profit has to come from cardholders
that carry a balance. That can be highly profitable if you have a lot of
cardholders paying high interest rates, but not profitable if people are
paying off their balance every month. Also, it's not clear if Apple is
paying Goldman Sachs anything to compensate for the 0% financing on
Apple products purchased directly from Apple, or if Goldman Sachs is
expected to eat the cost of such financing.

You would think that cardholders that carry a balance would choose a
credit card with a lower finance charge, though the 10.99% lowest rate
on an Apple Card is lower than many cards. The lowest rate card that I
have is 9.65% which is not much lower than the Apple Card.

Similarly, cardholders that want the highest rewards, and that pay off
their balance every month, would probably not choose an Apple Card since
there are much better no-annual fee cards available.

In article <sg5ssm$34e$1@dont-email.me>, sms
<scharf.steven@geemail.com> wrote:

> Goldman Sachs first foray into the credit card business was the Apple
> Card. Citibank reportedly turned Apple down on profitability concerns.

apple was in talks with several banks prior to partnering with goldman
sachs.

note that verizon turned down the first iphone, a decision they've long
since regretted.

> With 2% cash back for ApplePay purchases, that exceeds the typical
> merchant credit card fee,

nope.

apple card is a mastercard world elite, which has higher transaction
fees than the typical card.

there are also numerous other cards that pay as much as 6% cash back
(not counting additional bonuses) or more valuable points, where it's
not uncommon to net 10-20% return on purchases.

> so any profit has to come from cardholders
> that carry a balance.

nope.

apple card is designed to encourage quick payments so the user
*doesn't* carry a balance, therefore that claim is very clearly false.

sms <scharf.steven@geemail.com> wrote:
> On 8/25/2021 6:14 AM, Chris wrote:
>> JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
>>> On 2021-08-25 00:22, sms wrote:
>>>
>>>> A six digit pass code is certainly as secure, but probably more secure
>>>> than FaceID.
>>>
>>>
>>> The issue is that it is now simpler and faster to just take credit card
>>> and tap. This isn't about security.
>>
>> It is about security. Biometrics are more secure than PINs, there's no
>> debate about that.
>
> LOL, there is actually a LOT of debate about that!
>
> <https://www.zdnet.com/article/face-fingerprint-passwords-or-pin-whats-the-best-way-to-keep-your-smartphone-secure/>
>
> A six digit passcode has a 1 in 1,000,000 chance of being guessed on the
> first try,

You're assuming all number combinations are equally likely. Being human
means we pick meaningful numbers, usually dates, which means the real
chance is very different from 1/1000000. Probably more like 1/300000 or
better.

For example a bank card 4-digit is guessable more than 5% of the time.
Statistically it should be 0.01%.
https://www.itnews.com.au/news/wallet-thieves-have-chance-at-guessing-card-pins-291536

> and too many tries will cause the device to be locked for a
> while.

After a couple of failures with TouchID or FaceID it drops down to the PIN
or passcode.

> That's actually much more secure than what Apple claims for their
> capacitive 2D TouchID, the same as what 3D ultrasonic or optical
> fingerprint scanners claim, and the same as what Apple claims for a
> _random_ face with FaceID (the "random" qualifier was added because
> family members that look alike have a better chance of unlocking a
> parent's or sibling's phone than does a random person).
>
> What is really needed is two-factor biometric authentication for times
> when the highest security is needed. Some banks are already doing one
> biometric factor and one password or passcode authentication.

We already have that. The phone and your face are the two factors.

On Aug 25, 2021, Chris wrote
(in article<news:sg5fn3$j31$3@dont-email.me>):
>>> A six digit pass code is certainly as secure, but probably more secure
>>> than FaceID.
>>
>> The issue is that it is now simpler and faster to just take credit card
>> and tap. This isn't about security.
>
> It is about security. Biometrics are more secure than PINs, there's no
> debate about that.

Where do you get your statistics from?

Ron, the humblest guy in town.

Joerg Lorenz <hugybear@gmx.ch> wrote:
> Am 25.08.21 um 15:14 schrieb Chris:
>> JF Mezei <jfmezei.spamnot@vaxination.ca> wrote:
>>> On 2021-08-25 00:22, sms wrote:
>>>
>>>> A six digit pass code is certainly as secure, but probably more secure
>>>> than FaceID.
>>>
>>>
>>> The issue is that it is now simpler and faster to just take credit card
>>> and tap. This isn't about security.
>>
>> It is about security. Biometrics are more secure than PINs, there's no
>> debate about that.
>
>
> That is simply wrong and nobody except you is claiming such a nonsense.

https://theconversation.com/fingerprint-login-should-be-a-secure-defence-for-our-data-but-most-of-us-dont-use-it-properly-127442
https://www.itnews.com.au/news/wallet-thieves-have-chance-at-guessing-card-pins-291536

Sorry for the DM link, but I can't get the full text of the paper right
now.
https://www.dailymail.co.uk/news/article-3381630/Time-dump-passwords-weakest-link-cyber-security-Experts-call-use-fingerprints-make-safer-online.html
https://www.sciencedirect.com/science/article/abs/pii/S0969476516300492