Bitcoin Forum

I'm just wondering if its possible to have this kind of system where you just need to scan your finger print and you will be login directly to your account.

I'm talking about this one using our mobile phones since most of the phone now have their own finger print technology, and i usually used my phone to work on this forum. Any violent reactions or any clarification are really appreciated. Thank you.  :)

Considering the fact that 2FA has not yet been implemented on our SMF-based server, it's unlikely to see this happen any time soon.

---

An alternative would be to use a password manager that will recognize your fingerprint.

Selling your fingerprint data for convenience, though... hm...

I don't think (hope) that such a feature will ever be implemented. Everything can be hacked and I wouldn't feel comfortable to send my personal finger print as verification here, there are much better solutions to increase the security. 2FA would be fine but if you have staked an address here (https://bitcointalk.org/index.php?topic=996318.0), you should be fine.
And remember: most hacks happen because the person in front of the device made a mistake.  ;)

Yeah it could be possible at your own risk. This because finger print is unique to every individuals. And I do not want my finger print to.give to any institutions unless it is really needed or being asked.

Besides, bitcointalk account has secured already by the admins. So, let us just trust the system and should wait if it is really a necessity to implement finger print.

For now, I do not see that this is needed but we can look forward on it in the near future.

The best way would be to implement https://webauthn.io
The fingerprint information is not really sent to the website, but just a "the user is who he says he is" message. A compatible browser is required for that. As far as I know it's quite secure, and USB/NFC keys could be used too instead of/besides fingerprints.

However there's no SMF plugin for this (I might be wrong). Considering there is already an SMF 2FA plug-in ready to be installed and it's not because of the risk of damaging something, I don't think there's any chance to implement webauthn in the foreseeable future, as actmyname said.

Giving up personal data in exchange for something that doesn't even make your like that much easier is definitely not even close to being worth it. Just use a trusted and reputable password manager app on your phone that has an autofill feature so you wouldn't need to re-enter your login credentials when logging in. Needing a fingerprint login is just being extremely lazy in my opinion.

Maybe next time we have someone suggesting that what if we use facial identifiers to log in to our account, That would be convenient for us than using a fingerprint. Imagine waking up in the morning and you haven't wash your face yet and when you trying to log in, BitcoinTalk won't recognize you. it will say "That Face does not exist."

It would be convenient but how  many people here use mobiles to login into the forum?
The forum posts are barely readable on mobile.
AFAIK just a few computers enable finger print reading and i am not sure if the finger print reader can even be used beyond login in through the OS like it is on mobiles phones and yet i believe the forum is mostly accessed through Personal Computers so this feature would just favor currently very few people using mobiles to access it.

That will take a lot of time to be implemented even a 2FA hasn't been done yet for forum use. I use mobile as it is handy to bring anywhere else and most of the time this is where I read topics here on the forum. Though I like to realize that feature I guess it is still not secure as there are times fingerprint technology on mobile has some issues too when it comes to security as I experience that when I use it on my phone it doesn't recognize some of the time.

Worst idea ever I have seen on this forum. Fingerprints is very very sensitive thing for us. I don't know why we like to divert to decentralized system. Every information could be found about you relevant with fingerprints. Why should I provide my fingerprints in order to use forum? Sound isn't good really. Put your finger print on third party website expect government, there is high risk for you. You know why? I will give example below.

As usual we trust always our mobile service providers with fingerprints and personal details as well. Just few days ago I bought a sim card with my fingerprints from general store(not office of service provider). So what they did ? Active multiple postpaid simcard on my name and sell to other people's. They had activate 9 simcard with my fingerprints from different service provider. Wondering how is it possible. I just give fingerprint one time and they have actived 9 sim cards from multiple provider. When I check online how many simcard belongs to my name & ID then I discover 9 simcard under my fingerprint. Almost $100 I have spent just for disconnect all of simcard. So be careful when you are going to handle your fingerprint.

How would it know which of my alts to use? :)

I've got the fingerprint app disabled on my phone, and a sticky over the camera lens on the phone and computers. I don't use near field identification or contactless cards either. I'm also a fan of cash payments, I'm such a luddite. Goodness only knows how I became a Bitcoin believer.

What is the purpose of using fingerprint when you are login in the forum? Easy login and being lazy to type your password?

This issue has been discussed here so many times even they are suggesting U2FA for having second layer security of your account but not yet implemented. I think @1miau has right, once you've to stake your Bitcoin address here  (https://bitcointalk.org/index.php?topic=996318.0) then, your account will be fine. And there is also the second option of having the extra security layer of your account. Set a secret question that found in your profile as a seed phrase on your account if ever it is being hacked then easy to recover.(but make it sure write in a piece of paper and keep in a safe place)
https://i.imgur.com/B53rmwg.jpg
Just an example.

---

I think that is too sensitive using fingerprint when you are log in. Nothing to worry if you know how to keep your password safe and having a clean laptop and mobile phone.

As far as I know signing a message and quoting it is already enough in order for you to get your account back.

Most of us here are actually working our ass out anonymously. Also I don't think if we can implement that certain feature to this forum because as far as I know we are using an older programming language in which finger print detection was not yet discovered . As you have noticed most of the system that uses fingerprint as a security access is on mobile applications and not from a website or web application.  

This is too much I guess. Why will a forum log in ask to give your finger print? This is a place for learning related stuff on bitcoin. Do you think people will share finger print for logging in here?
We must create the forum more user friendly. Newbies will be stuck with these changes you are thinking of.

It would also delimit the number of Alts that a single person can manage to 10 (20 at best if one tends to keep his socks off). That would place a strong restriction on solo account farming  :) … but potentially expose everyone to being doxed to authorities. No win there (downside way superior to potential upside).

Well, after the last April Fool (KYC (https://bitcointalk.org/index.php?topic=5124947.0)), we now know that Theymos can ask for anything and a lot of people will do it.
For next year, I will propose a KYC with genitalprint :).

Yesterday was KYC, today is fingerprints, tomorrow will be the retinal scanning/face recognition, and we gonna end up with a teeth recognition at the end.
The one-man-army a.k.a theymos cannot make miracles here, at least not so big ones, so one day ... (hope this will be before the time we mine the last bitcoin) ... will come a new, better, quite expensive already, software which will replace the SMF and we gonna step into the 21 century.
I like the old-fashion way of SMF but I'm an 80's baby so...

This is already possible if you have an iPhone.

All you have to do is login to the forum using your password from your phone, and tell your iPhone to save your password. Your password will be saved to your keychain and when you access the login screen in the future, you will be prompted to use your saved password, and if you want to, you will be prompted to use your touch id to access your saved passwords in your keychain.

I do not like this idea because it means publishing a fingerprint online and this can violate privacy and security.

I appreciate the effort of this one, btw I'm just wondering if this thing is possible and I don't make any suggestion.
Well, this answer my queries with so much explanation. Thank you for this.  :)

I feel the convenience using my phone but of course serious topics or thread can't be done by just using your phone.

For convenience, a more advance to access your accounts just like having and application where you just need to scan your finger?
Honestly, I'm still thinking for this one if its really possible but since it got so much criticism I think its hard to happen.

---

Thank you everyone for the answer, I'm happy because I got so much response and some of those response makes me smile honestly.
Some are open for this possibilities, and some are not but only time can tell and no one knows about the future

Although I agree with the idea being silly on a Bitcoin forum the idea of our fingerprints being sensitive is also a silly one. You leave your fingerprints all over where you go on a daily basis. Yet you are not worried about it are you? Its an extreme example but there has already been examples of those with Bitcoin being targeted for their fingerprints. Using your fingerprint for anything is a stupid way to access anything and only belongs in james bond movies and teenagers phones.

You still need to put the username there.

But I am wondering if your fingerprint data is copied then you lost the access from all accounts here. What will happen if you have injured your finger.

That's the reason why we have 10 fingers right?

Each of them maybe you can use in having data when login here and may be useful. ;D(Lol, that is probably abuse)

Why would you want to give such private information away ? What is wrong with signing in with a complex password and 2FA for security ?

Do you really want a scan of your fingerprint circulating on the internet ?

Bitcointalk has been hacked three times already https://bitcointalk.org/index.php?topic=4405796.0 (https://bitcointalk.org/index.php?topic=4405796.0)

There have been 6 major exchange hacks already in 2019. Anything crypto is a target for hackers.

Besides - someone can easily replicate your fingerprint or intercept the data containing the digital version of your fingerprint.

The idea seems nice but the vulnerability involve is high and I think having a personal code or the implementation of google auth is still better.




The last time I checked it not most of the phone we have this days that have the finger print technology and implementing such finger print will hinder some people like myself.

Even if such feature were to be implemented, I would not do it for the sake of convenience. I am not willing to sacrifice personal data for convenience. No matter how secure a network can be, it is still prone to malicious hacks and malware that can be accesses by anyone.

Imagine if the forum were to be hacked and they get a hold of each of every member's fingerprint.

And in this case you can use the fingerprint safely, because when you use the touch ID, your fingerprints won't leave the iphone, it will just check them to give access to the password manager (at least, this is the Apple communication :D ) So they won't let any 3rd party app access the digital version of the fingerprint stored on the device (only the 3 letter government agencies :D )

   I totally agree. I am sure it is possible to lift someone's fingerprint and create some kind of prosthesis with a 3D printer. Although fingerprints have an advantage since they are unique to each individual, (even identical twins have different fingerprints,) I don't think it is feasible to start expecting people to wear gloves everywhere they go as a way to keep their fingerprints "secure." Using a fingerprint as a way to access accounts is about as secure as writing your password on a sticky and sticking it on your computer monitor.

Most users are posting the same cons against this without knowing how the technology works.
As I said (https://bitcointalk.org/index.php?topic=5140857.msg50960526#msg50960526), the fingerprint is not sent anywhere. And the username or email must be entered too.

Simplifying things: you can think of your fingerprint as the password that encrypts the private key used to sign a message. Only the public key (during registration) and the signed message (during logging in) is sent to the server along with the username or email. The private key and fingerprint is not sent, the same as your wallet password and address private keys are never sent anywhere.

Do check this site if you're interested (and do read it before posting here): https://webauthn.io/

I don't think it's even necessary, you just login once and save details your browser will take care of it, if you worried about security then you can use fingerprint as lock.

This is only possible if someone is making an app version of the forum. I dont think its a burden if you are loging in using your username, password and reCaptcha everytime you want to visit the forum but getting an app will be much better. Also, your browser has its own history so you can log in without retyping. Dont be that lazy its a part of the job.

Even 2FA has not been high in to-do list of theymos, so I believe it is time to lock the topic. Fingerprint is too far from current prioritized things in theymos' to-do list. He likely has never had such idea on fingerprint, but something might pop up next April Fool.

One thing would stop is fingerprint technology would be used that account sales would stop. It should only be used as an identifier and not password as last month only somebody was able to trick Samsung's device by inserting a fake password and he managed to unlock the device everytime without having to use his own fingerprint. Fingerprints can't be changed by the hacker but but can be copied. For exchanges, this could be useful too.

This is why it is only safe to use biometrics as an access medium when using a device that can protect against these types of attacks.

A website relying on third party devices to transmit fingerprint data is not going to work. However verifying fingerprint information locally will be much more secure.

As an FYI, it is not trivial to replicate a fingerprint so that it reasonably appears the same on a fingerprint scanner. What is much easier is transmitting the data from a fingerprint scanner showing the fingerprint is the same.

When you consent to a background check at most employers, you will have your fingerprints taken and transmitted to the FBI to cross reference against arrest records.

Also you leave your fingerprints ~everywhere, and the government could trivially get them by just following you around a little bit.

I really dont like the idea. Imagine someone getting access to the database with 100.000s of fingerprints.
This forum is against KYC, except during April fools day, and this suggestion is even more invasive. 

There is a way in Linux anyway. You can select password protected sites and launch a print reader. however I think it lowers your security somewhat. I was able to defeat my fingerprint reader with a pencil, a bit of white paper, and a some clear tape. If you think in terms of theory a fingerprint password means you leave a copy of your private keys on everything you touch.
 :-\

Biometrics =/= password. Biometrics are more of an username, but the industry developed this backwards standard that will work out just fine one day in the future. I'm certain.

Any proper security expert will tell you that it lowers your security significantly. Use it only on your phone if you really have to as that device gets unlocked the most number of times per day. Do not use it for anything else, never ever.

I agree. But I was assuming the password on his shared windows 2000 computer is "god". And that his hotel wifi connection mysteriously requires installing screen share software. In that case it only marginally reduces security.
 ;D 

If your password is "god", then you're a lost cause anyways. You don't need security considerations in your life, you need the Arhitect to build a v2 of you. ;)

I wouldn't be opposed to the option (however, I see it as extremely unnecessary), but as a requirement I think it is completely contradictory to what Bitcoin stands for. I enjoy having my anonymity on this forum.

Just make a tough password that no one is going to bruteforce and you should be okay.

You can learn a lot from the comments below and above your post, they keep on explaining that your fingerprints doesn't send to anyone which makes this topic more possible if ever the technology becomes high-tech. Though I also doubt that this can happen in just a year or even 5 years from now but the future will be more good for sure.

See this one with a great explanation about your concern.

Yep, nope, not happening for me.  It's great that technology has advanced this far, but we're rapidly getting into 1984 territory here.  A website or program or whatever would have to be pretty damn important for me to use my fingerprint to access.  If bitcointalk were to require something like that, sorry to say but I'd be outta here. 

As far as 2FA and all that happy horseshit, ask Binance how that protected them from hacks and how paranoid their customers are right now.  I understand the difference between personal security and a website's security (more or less), but some of these measures are just overkill.  Fingerprint/retinal scans/facial recognition tech should be reserved for people who can launch nuclear missiles...not for a freakin' discussion forum.

Nowadays, laptop, smart phones, tablets and some other stuffs have options to setup and use Finger Prints to access. Personally, I have never used this option, that is terrible  in my opinion. At the first glance, it looks like bring more security, but in worst case, we might get big troubles with such security option. Who knows when the Finger Print Features on our devices get troubles, then we might have to spend a lot of time to solve it. I don't like that sort of Finger Print Trap.