3 ms·

Somewhat related: I've heard that devices with fingerprint access control are designed such that software can't get the fingerprints out; the fingerprint reader

by brlewis 11y ago

Somewhat related: I've heard that devices with fingerprint access control are designed such that software can't get the fingerprints out; the fingerprint reader is a self-contained black box. If I wanted to verify this, how would I?

VLM 11y ago
You don't. I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open doors directly and supposedly stored no data locally in case someone smashed and stole it, or smashed and shorted the control wires (I believe it was RS-485 line level protocol WRT wiring) and a black box inside the secured area that contained our biometric hash data, logs, and a normally closed relay that could toggle and unlock the door when it felt like it. Anyway if the protocol and connection between the two black boxes could be monitored without breaking the DMCA, then you could verify the box outside does hashing and only 24 bits of data or whatever transport to the other black box that unlocks, rather than entire hand pix. Assuming there's no ATM-skimmer grade camera taped on the scanner recording the geometry of every hand for later abuse. The nature of security theater or snake oil is apparently unfixable failure modes don't indicate lack of effort or knowledge, they indicate the product sucks.
uptown 11y ago
Some devices yes. Other devices? Not so much: "HTC stored user fingerprints as image file in unencrypted folder" http://www.theguardian.com/technology/2015/aug/10/htc-fingerprints-world-readable-unencrypted-folder http://www.theguardian.com/technology/2015/aug/10/htc-finger...
seszett 11y ago
I have some kind of time tracking terminal here that allows users to identify themselves either through facial recognition, fingerprint or NFC. The terminal listens on telnet or ssh, is easily compromisable, and stores the last fingerprint image (the full picture, not just a hash) as well as last face picture as bmp in /tmp. You just can't rely on devices being designed such that they are secure.

by brlewis 11y ago

VLM 11y ago

You don't. I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open doors directly and supposedly stored no data locally in case someone smashed and stole it, or smashed and shorted the control wires (I believe it was RS-485 line level protocol WRT wiring) and a black box inside the secured area that contained our biometric hash data, logs, and a normally closed relay that could toggle and unlock the door when it felt like it. Anyway if the protocol and connection between the two black boxes could be monitored without breaking the DMCA, then you could verify the box outside does hashing and only 24 bits of data or whatever transport to the other black box that unlocks, rather than entire hand pix. Assuming there's no ATM-skimmer grade camera taped on the scanner recording the geometry of every hand for later abuse. The nature of security theater or snake oil is apparently unfixable failure modes don't indicate lack of effort or knowledge, they indicate the product sucks.

uptown 11y ago

Some devices yes. Other devices? Not so much: "HTC stored user fingerprints as image file in unencrypted folder" http://www.theguardian.com/technology/2015/aug/10/htc-fingerprints-world-readable-unencrypted-folder http://www.theguardian.com/technology/2015/aug/10/htc-finger...

seszett 11y ago

I have some kind of time tracking terminal here that allows users to identify themselves either through facial recognition, fingerprint or NFC. The terminal listens on telnet or ssh, is easily compromisable, and stores the last fingerprint image (the full picture, not just a hash) as well as last face picture as bmp in /tmp. You just can't rely on devices being designed such that they are secure.