Biometric Authentication

[zappaDPJ]

How long do you think it will it be before an off the shelf forum product offers biometric registration and login?

This one feature has so much to offer it has to be a priority where on-line interaction takes place. Ease of use, enhanced security at both ends of the wire, user accountability and less spam are just some of the advantages.

So when do you think it will happen?

 

[MarkFL]

I voted more than 5 years, because I think there are sufficient issues currently that need to be addressed before biometric authentication will be embraced by the masses. While there are more sensitive applications than forum participation, I would think it has to be seen by the public as safe/reliable for all applications before it's really embraced for any application.

 

[doubt]

So when do you think it will happen?

It will take much longer than 5 years.
With the current forum developers: Never.

 

[haqzore]

Do you include fingerprints in this?

If so, it could be quick. Fingerprint integration is all over smartphone apps. But i don't think any current developers care enough to do it.

 

[Ryan Ashbrook]

There are several factors that go into this.

• Support across all operating systems
• Support across all browsers
• Support for each type of authentication (fingerprint, facial recognition, etc)

And that's just to start with - when you consider how many browsers, operating systems, and then each individual biometric type, it becomes a black hole if they all operate independently. Everything would need to be standardized for the web, otherwise you have to maintain every individual integration point which can become quickly overwhelming - even for large development teams.

You can, of course, sacrifice and go for the most common ones, but it's much better to have a standard that everyone adheres too. Both web developers and OS developers alike.

So, I think it's possible, but not within the next five years.

Do you include fingerprints in this?

If so, it could be quick. Fingerprint integration is all over smartphone apps. But i don't think any current developers care enough to do it.

I have not done extensive research, but as far as I know, it is not possible for websites to tap into finger print readers. I could be wrong, though.

 

[LeadCrow]

Hopefully never. Losing a password only means reseting it, getting a copy of your fingerprint, your retina or its succesful authentication result stolen means the exclusive use of your credentials is lost forever. It's the equivalent of using the same password everywhere. It is really as safe as people think ?

Native mobile apps would be a much more seamless option though, if just as mobile authenticators leveraging the OS' specificities. They just dont make sense to implement for a hobbyist site, or outside a networked forum infrastructure (like a SaaS such as Proboards or IPS' hosted service).

Anyway, isn't biometric authentication already possible with LDAP binding?
Woltlab had this since a while (apparently meant for desktop computers, like in intranets), phpBB since 3.2. Issue is the auth autority would generally have to be setup by yourself (which will exclude hobbyists using shared hosts, unless they can count on a shared authority like their forum software provider. A lot of the mainstream solutions are not as safe in their implementation as people think, or use fixed seeds under their control - A disaster waiting to happen)

 

[doubt]

There are several factors that go into this.

• Support across all operating systems
• Support across all browsers
• Support for each type of authentication (fingerprint, facial recognition, etc)

And that's just to start with - when you consider how many browsers, operating systems, and then each individual biometric type, it becomes a black hole if they all operate independently. Everything would need to be standardized for the web, otherwise you have to maintain every individual integration point which can become quickly overwhelming - even for large development teams.

Not much enthusiasm to develop it from a current forum software developer...

 

[zappaDPJ]

You can, of course, sacrifice and go for the most common ones, but it's much better to have a standard that everyone adheres too. Both web developers and OS developers alike.

Perhaps this will start the ball rolling in terms of standardisation?
https://www.microsoft.com/en-gb/windows/windows-hello

It is really as safe as people think ?

That's a very good question, there are also major implications for privacy. Nevertheless the Biometrics Research Group predicts 2 billion people will be using biometric smart phones by 2020 so the genie is already out of the bottle.
http://www.biometricupdate.com/2015...c-releases-report-on-mobile-biometrics-market

 

[Ryan Ashbrook]

Not much enthusiasm to develop it from a current forum software developer...

Actually, I would love to do this - I'm just being realistic.

 

[Paul M]

It will take much longer than 5 years.
With the current forum developers: Never.

Forum developers will add something if there as a large demand for it.
I cannot see that there would be much demand for such a system in the next 5 years.

Most people dont actually type their password in very often, your have the "remember me" type cookie system, plus browsers remember paswords, and you have things like lastpass to manage/remember & login for you. I rarely actually type a password on anything I log into.

 

[The Sandman]

I'm not so sure about biometric registration and login - not in the near future anyway. But I could see biometrics being used as the second factor in two factor authentication. That makes more sense to me as an intermediate step anyway.

 

[Zylantex]

Too 1984 for me.

 

[insaneadmin]

I have flashbacks to moments in Demolition Man when I hear about this sort of thing.

BE WELL!

 

[Maddox]

Facial Recognition is only just beginning to appear on mobiles, so I reckon it will be quite a while before it becomes widespread on the Internet.
As Ryan Ashbrook points out it would have to have a universal standard to keep it sweet with all OS's and Browsers.

 

[Gus]

If a forum wants to scan my fingerprint or my eye then that's the day I stop visiting that forum. It's just a damn message board, not a top secret government building.

 

[ManagerJosh]

If a forum wants to scan my fingerprint or my eye then that's the day I stop visiting that forum. It's just a damn message board, not a top secret government building.

Guess it's time to stop using your smartphone?

 

[Gus]

Guess it's time to stop using your smartphone?

No I'm fine with that. Not with forums doing it though.

 

[ManagerJosh]

No I'm fine with that. Not with forums doing it though.

What's the difference?

 

[Gus]

What's the difference?

People who run forums are sometimes untrustworthy and I hardly feel comfortable with them having my IP address and email, let alone my fingerprints & other biometric data.

 

[The Sandman]

People who run forums are sometimes untrustworthy and I hardly feel comfortable with them having my IP address and email, let alone my fingerprints & other biometric data.

Isn't it the device you're using (smart phone, tablet, pc/mac, microwave oven, etc.) that holds the data?