Why Fingerprints Are Bad Security Tokens

I keep telling you guys that TouchID is a bad idea: 

From Hackaday:

Passwords are crap. Nobody picks good ones, when they do they re-use them across sites, and if you use even a trustworthy password manager, they’ll get hacked too. But you know what’s worse than a password? A fingerprint. Fingerprints have enough problems with them that they should never be used anywhere a password would be.
...
But if your fingerprints are your password and they get leaked, it’s “impossible” to change them. Indeed in traditional fingerprint applications, uniqueness and immutability are the whole point — tying criminals to the scene of the crime, for instance. If you could just change your fingerprints after each heist, you wouldn’t have to wear those awkward gloves.
...
The problem with fingerprints is that close is good enough, and needs to be. If I press my finger harder into one reader than into another, or swipe differently, or have a cut, I still want the reader to accept my fingerprint. Trained FBI agents make matches with “partials” all the time, and with reasonable accuracy. Close matches are a fact of life with human flesh and real-world scanners. But a fingerprint with a tiny flaw will hash into something entirely different from the reference version. What this means is that fingerprints are not hashable. Hashing makes passwords strong and without it, fingerprint protection is much weaker.

Setsumei

They say you'll never really appreciate your own country until you see it from a foreign land. To that, I add that one never gets to appreciate his legal system until he try to explain it to a foreign lawyer.

Now that we're doing some comparative law, looking at "baseline" common law and civil law rules, I'm starting to see what a strange and improbable thing Philippine law is - a civil law tradition with an active Supreme Court engaged in common law style elaboration of substantive rules. Whenever I try to explain the whole thing, they look at me as if I'm trying to describe a linear accelerator and a ham sandwich getting together and producing a fully functional airplane.  

Setsuzoku

Social Network Analysis is very dependent on computation. Because while it's easy enough to visualize and analyze "toy" networks with your intuition, things start getting out of hand once we're dealing with real world actors and their interactions. 

I used to collect Social Network Analysis programs - I even thought I could build one myself. Thankfully, the open source movement came into its own before I could commit that folly. 

Professor Teramoto is using R for his class. I think that's the best long term solution. R offerings for social network analysis are diverse (there's sna and statnet to start), robust, and open. The barebones command-line interface may turn off a lot of beginners, though.  So here's a couple of my favorites alternatives to R:

  • Gephi - Java-based SNA package. The base install gives novices an easy way to visualize sociographs. Entering data is a bit awkward for those already familiar with sociomatrices, since you have to enter vertices and edges in separate worksheets. Analytical tools are sparse, but it has an R-type library you can use to install new functionality.

 

  • UCINET - Windows-only program developed by big names in SNA - Borgatti, Everret, and Freeman. It can handle a lot of legacy sociomatrix file formats and has a lot of the  standard analytical tools built in. 

 

Jugyou

Studying law as a student. Again. 

It should be familiar ground. Except it isn't. Points of departure from my LL.B experience:

Being treated like an adult - no insults, no passive-aggressive sarcasm during recitation ("seminar discussions"). One can be wrong about the fact of a case, the reasoning of the court and still be treated with baseline human decency. You're not protected from consequences to your grade though - that's what being an adult means.

A more reasonable reading load - 2-3 readings per session. Relevant snippets of select cases are already baked into the articles (or distributed in digest form in the teachers' notes), and the selection of cases is thoughtful enough to give you meaningful pattern recognition. 

Research orientation - I have my own Westlaw, Lexis Nexis, accounts, and they're not tied to the university's IP address so I can use them anywhere. The program emphasises that the classes are just entry points and that you have to dig deeper on your own - lots of  references to "additional readings" in the outlines. And then there's the overarching goal of producing a master's thesis - which is counted more than any subject (or any quarter) of the school year. 

Hajime

Landed in Fukuoka, Japan a week ago. I'm here for one year on a scholarship to take my LLM. The past week has been about setting up shop, getting through the orientations (they have orientations about everything here in Japan). First day of class tomorrow. 

 


First class is intellectual property. Interesting enough. According to the class description, the professor is going to teach it from a social networks approach. Cracking open my old graph theory software and materials.