emilxix

Sorry, you feel this way, mate, but matters of "believe" are between you and your priest.

As for the "overall impressions", It is usually recommended to try something first and then form an impression. Otherwise, it's just an opinion

That's great. It means that the subset of all users you've measured had their phones unlocked, next to the computer, and ready to click push notification

Got it. Let me share with you our experience, and please take it with a grain of salt.

Early on, we've conducted a handful of end-user interviews - knowledge workers, various industries, fluent with computers. We conducted a series of hour-long video calls, recorded them with permission to re-watch them later, and asked the questions like - how do you think about privacy? How do you think about the performance of faceID or similar? How do you think about biometrics and privacy? Will you be open to try a solution that uses your biometrics from an unknown vendor? Etc.

The result, somewhat surprisingly, boiled down to a few bullet points: 1. Performance- "If it works and I can log in, that's enough assurance." 2. Privacy and data - "Have an FAQ section or show in me onboarding that you don't sell my data for surveillance - that's good for me."

We've been prepared to answer the "SOC 2 Type2 -style" question regarding performance and data privacy, but no one really cared. What users did care about is "can I add this app to my account?" and other feature requests.

Communicating assurance is challenging. Finding a balance between "FAR/FMR/FNMR metrics" and "it's safe to use" is an art. Apple's faceID. for example, claims "1:1,000,000 chance a random person can unlock an iPhone", which, I guess, is a good enough proxy to communicate assurance for the intended audience. Answering the question, yes we thought about it, but still a work in progress.

thank you for sharing your thoughts.

-> Fingerprints are just more convenient. Apple, for example, argued the false positive rate way too high. For me, as a user, I'm more concerned about the false-negative rate. I think Apple just wanted more screen real estate. They could've easily put the sensor on the back (eg like the Samsung Galaxy S8).

I agree, a matter of fact fingerprint sensor on the back of a phone is arguably the most efficient way to unlock a phone. With desktops, it varies quite significantly.

-> - Masks!

for what its worth, one user told us that they have successfully logged in while having a green mint facial care mask on..:)

-//-

By no means Entry is the best tool out there, nor we claim it to be so. Here are a few known flaws:

- if someone has two or three monitors and it is unclear where the camera is, it requires some time to get used to, which may be annoying - to your point, Entry will not work in a pitch-black room - Entry is by no means "fingerprints-fast": as a factor, Entry competes with the time it takes to reach a phone and click on push notification. For example, mean time to verify using Okta Verify (default mfa solution for okta sso) is ~21 seconds. For Entry it's 30 seconds. We still need to work on that (although our users still choose Entry over Verify, we ask to have both factors set up :) )

Several layers of anti-spoofing.

They detect mask-attacks, replay attacks (put the phone with video into the camera; highjack a webcam input and send a pre-recorded video faking to be real-time from zoom for example), and, of course, still images.

Give it a try!

Yes, you are right. To be clear, the pricing on the website is for the workforce identity (Entry as a factor to a Single Sign-on solution). If you are thinking about customer identity, we don't have pricing yet. Most likely, it will be volume-based. It would be great to brainstorm with you and come up with something that makes sense!

Entry was designed to protect end-user privacy against malicious actions in the first place. Not just because we want to "do good", but also because it is commercially viable: End-users get full control of their data forever free, while organizations deploy Entry to solve tactical issues like fraud, security, and phishing prevention. But, I guess, without an independent audit by "the big four" or alike, these are just my words.

thanks for posting it here. It is still too high-level. We'd be publishing in-depth details soon.

good catch, I've fat fingered it while editing the comment

Absolutely, that's on the product map. KYC/AML and document verification use cases are super exciting but require some thoughtfulness around regulations. Sometimes it is easier to solve a hard technical problem than to navigate compliance requirements.