6 ms·

Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ https://xkcd.com/538/ ) until the

by zuppy 11y ago

Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ https://xkcd.com/538/ ) until they get access to your phone. It's a huge convenience for you though, to unlock it without doing anything extra, as you're pressing that button anyway to turn the screen on. Much easier than typing passwords.

deleted 11y ago
[deleted]
chrsstrm 11y ago
My worry is that this is a gateway drug to "Fingerprint protect all the things!" My bank emailed me the other day with an announcement that I could access my account through their app via my fingerprint. WTF? My text messages are one thing by now my money is protected by just my fingerprint? I took my bank to task because they allowed my username to be twice as long as the allowed characters in my password. Someone at the bank said, "Hey, all these new-fangled phones have fingerprint readers, why don't we tap into that and sell it as a feature?" When everyone is doing it, no one is going to stop and ask if they should, it's just a race to incorporate the newest features. Normal people aren't asking if this is secure, they are buying into the marketing copy pushed on them, so they start thinking that it has to be secure, because why would my bank not have my interests in mind?
- zuppy 11y ago
  Fair point, it should be used for convenience, not for real security.
  - jgord 11y ago
    .. non-hackers will equate it with security.
    - r-w 11y ago
      Non-hackers aren’t responsible for data security. Well, except for Sony. And every other company that doesn’t deal with data security in particular.
- tgb 11y ago
  What can the bank app do? Mine can only deposit and view accounts, not withdraw or transfer. Open access to it would be weird, but not much worse than someone fishing my ATM receipts out of the trash to see my balance.
  - chrsstrm 11y ago
    It's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?
    - TechieKid 11y ago
      Thank you for validating my decision to not put any BofA online banking apps on my phone.
    - tgb 11y ago
      This is scary enough I'm uninstalling my app just incase they add these "features" in an update. Thanks. Oh well, no big loss.
- branchan 11y ago
  The bottomline is that if someone can hack a server to steal your fingerprint, they can just as easily use the same method to steal your method so I don't really see the differen imho.
  - nileshtrivedi 11y ago
    Except that you can't choose a different fingerprint for each app/site. Lose it once and all your accounts are compromised.
    - branchan 11y ago
      All the apps that I use give me the option to not use fingerprint login.
  - TechieKid 11y ago
    The bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.
    - branchan 11y ago
      Ummm, if I lose my phone, I'm just going to remotely disable it so there's no way the person who stole my phone can reach my data.
      - bostik 11y ago
        So, you're using full-disk encryption on your phone and the remote kill switch flushes the key? Otherwise the data is still there in the plain, accessible by anyone who can read the flash.
        EwanToo 11y ago
        If you're using a Nexus 5X or 6P on Android 6, then probably yes. Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.
- wisty 11y ago
  Yeah, no-one will steal your fingerprint, just like no-one will crack a reasonably strong password. But if every site has a copy ...
  - SideburnsOfDoom 11y ago
    It's quite possible that your fingerprint has already been stolen http://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints http://www.theguardian.com/technology/2015/sep/23/us-governm...
posnet 11y ago
Many countries now take fingerprint scans when you cross the border. Even if they themselves never use it, its easily conceivable that they could be hacked or leaked. Then what? You can't revoke your fingerprint.
- zuppy 11y ago
  Who will bother to recreate the fingerprint, most of us aren't that important? (I'm not) :) Don't get me wrong, I do understand the main problem is that you can't change this "token" and it's something that the people have easy access to. It shouldn't be used to keep data that has a higher value than the effort required.
  - zmmmmm 11y ago
    The real risk is that if it reaches a certain level of ubiquity (which it appears it is), authorities will invest in a) laws and b) technology to break it with almost trivial ease. The US already has my fingerprints on file from crossing the border. Presumably it means that if they wish they could trivially unlock my phone and search its contents. I fully expect that if fingerprint access does become the universal security mechanism used on computing devices we'll soon enough have fully automated solutions where law enforcement can either download your fingerprint from their existing database or scan it from any available surface in real time and apply an image to the sensor to fool it into unlocking. Obviously this will take a while to happen, so for now people are lulled into a rather false sense of security that their fingerprints are a "pretty good" way to secure their phone when they are only "pretty good" because technology will take a few years to automate the breaking of them, at which point they will become "very bad".
    - r-w 11y ago
      Why bother breaking into a phone manually when you already have access to all the data it sends, receives, and contains (especially now that cloud storage solutions are all the rage)? What do passcodes and fingerprint scanners even mean when the target data is already being made accessible to national governments through more convenient channels? In my mind, the only reasons tech giants continue to force centralization on their users are PRISM and data mining. Today’s devices have sizable internal drives, so all personal data could realistically be stored and processed locally; and secure, distributed systems have been proven to work for data transfer (BitTorrent), monetary transactions (Bitcoin), message boards (Aether—sort of), and more. Hopefully solutions like Copperhead OS and Blackphone that secure our mobile devices and communication channels, respectively, make it to the mainstream.
ris 11y ago
"Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ https://xkcd.com/538/ ) until they get access to your phone." I think this misses the point. Accessing a device using a "cloned finger" (not tremendously difficult) can be done without the target ever knowing it has happened. The wrench technique, less so.
- zuppy 11y ago
  Yes, but is it worth spending the required resources? If the answer is yes, than anyway the 4 digit pin isn't more secure (you can watch people type them and find out the code).
  - elyobo 11y ago
    You can change your code. The fingerprint is a bit more difficult. That's my main issue with biometric security, revocation of compromised credentials (e.g. fingerprints) is difficult or impossible.
    - nileshtrivedi 11y ago
      Not only that. With fingerprints, you are essentially using the same password everywhere. You just need to lose it once and all your accounts would be compromised.
  - SideburnsOfDoom 11y ago
    > Nobody's going to bother to recreate your fingerprint, Whyever not? They might have a copy of it lying around. http://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints http://www.theguardian.com/technology/2015/sep/23/us-governm... > Yes, but is it worth spending the required resources? When it becomes easy - and it will become easy, there's nothing basically hard about printing out some ridged plastic - it will become commonplace. And unlike stolen passwords, an attacker can be fairly sure that you haven't changed your fingers.
will_hughes 11y ago
(I'm not a lawyer, I've just read a bunch of blogposts/discussions on the issue) There's a legal difference in some places between having your phone secured by a fingerprint and a password. If your phone is secured by a password, then in some places you cannot be obliged to provide the password, but a fingerprint you can.
- r-w 11y ago
  Where are those laws in place?
  - will_hughes 11y ago
    In the US in particular. There was a bunch of reporting in the past few days that a Federal District Court in Pennsylvania found that Fifth Amendment rights apply to smartphone passcodes. Random link: http://www.digitaltrends.com/mobile/why-the-government-cant-make-you-give-up-your-phone-password/ http://www.digitaltrends.com/mobile/why-the-government-cant-... That same protection doesn't seem to apply to fingerprints. Random link: http://time.com/3558936/fingerprint-password-fifth-amendment/ http://time.com/3558936/fingerprint-password-fifth-amendment... Again, I'm not a lawyer, but that seems to be how the law falls out on that issue. Whether that's an issue for you, personally - no idea. It might be a factor for some.
    - Tinyyy 11y ago
      I wonder if its possible to counter this through obscurity. Since the sensor is on the back of the phone, you can use your ring finger to unlock it instead. If >3 attempts with any other fingers are made, then the phone will be locked with a password. That way, you still keep your right to protection.
    - geofft 11y ago
      The other thing about the US is that occasionally you'll find a police department that's willing to bend the law. They can make you touch the fingerprint sensor and then claim that they never did and they found your phone unlocked, and it'll be your word against theirs. If the court believes the police, which they are culturally inclined to do, the Fifth Amendment question doesn't even come up. One of the neat things about encryption, historically, is that the government couldn't force decryption even if it were willing to break the law in doing so. That's why there were export controls and demands for backdoors in the '90s, and that's why there are demands for backdoors today. Fingerprint locks may mathematically involve encryption, but they don't have this property.
r-w 11y ago
Wrench, meet plausible deniability: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_cryptography https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...
- bobert22935 11y ago
  People who say this never game this out. 1. Attacker sees random data. 2. Attacker knows you might be smart enough to use a plausible deniability file system. 3. Attacker starts beating you with the wrench. At this point, there are several possibilities that could happen: 1. You give up the secret and give the attacker what he wants. The beating continues after this point, because the attacker really has no idea if you've given up the right secret. 2. You give up a fake secret and give the attacker what he thinks he wants. The beatings continue. See possibility #1. 3. You don't give up the secret and he continues beating you with the wrench anyway to try to get you to reveal the secret. 4. You're not using a plausible deniability encryption at all, and it truly is random data, and he continues to beat you with the wrench to make sure. As you can see, the wrench doesn't give two shits about your plausible deniability.
  - exo762 11y ago
    If your threat model involves wrench, you are OOL. Fortunately, its not true for most of us.
    - bobert22935 11y ago
      The world is rife with wrenches and people willing to use them. PD is only good against people who don't have legal leverage against you, and those not willing to break the law to get it.
  - r-w 11y ago
    …unless drives were encrypted by default, in which case the wrench would have no method to distinguish the two! Any reasonable wrench would not pursue such a doubtful case anyway. And regardless, the goal is not to avoid being beaten by the wrench, but to sustainably deny the existence of the secret. There is no incentive to ever give up the actual secret when the wrench cannot tell the difference and must continue beating (which would only happen at high levels of worth or likelihood); I might as well have continued lying. NOW GIMME MY SHITS
DataWorker 11y ago
I think the OPM data breach recently put about 10 million fingerprints and a ton of associated personally identifying information into the hands of people who have clear motivation to hack the cell phones of many of the people impacted.

by zuppy 11y ago

deleted 11y ago

[deleted]

chrsstrm 11y ago

My worry is that this is a gateway drug to "Fingerprint protect all the things!" My bank emailed me the other day with an announcement that I could access my account through their app via my fingerprint. WTF? My text messages are one thing by now my money is protected by just my fingerprint? I took my bank to task because they allowed my username to be twice as long as the allowed characters in my password. Someone at the bank said, "Hey, all these new-fangled phones have fingerprint readers, why don't we tap into that and sell it as a feature?" When everyone is doing it, no one is going to stop and ask if they should, it's just a race to incorporate the newest features. Normal people aren't asking if this is secure, they are buying into the marketing copy pushed on them, so they start thinking that it has to be secure, because why would my bank not have my interests in mind?

zuppy 11y ago
Fair point, it should be used for convenience, not for real security.
- jgord 11y ago
  .. non-hackers will equate it with security.
  - r-w 11y ago
    Non-hackers aren’t responsible for data security. Well, except for Sony. And every other company that doesn’t deal with data security in particular.
tgb 11y ago
What can the bank app do? Mine can only deposit and view accounts, not withdraw or transfer. Open access to it would be weird, but not much worse than someone fishing my ATM receipts out of the trash to see my balance.
- chrsstrm 11y ago
  It's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?
  - TechieKid 11y ago
    Thank you for validating my decision to not put any BofA online banking apps on my phone.
  - tgb 11y ago
    This is scary enough I'm uninstalling my app just incase they add these "features" in an update. Thanks. Oh well, no big loss.
branchan 11y ago
The bottomline is that if someone can hack a server to steal your fingerprint, they can just as easily use the same method to steal your method so I don't really see the differen imho.
- nileshtrivedi 11y ago
  Except that you can't choose a different fingerprint for each app/site. Lose it once and all your accounts are compromised.
  - branchan 11y ago
    All the apps that I use give me the option to not use fingerprint login.
- TechieKid 11y ago
  The bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.
  - branchan 11y ago
    Ummm, if I lose my phone, I'm just going to remotely disable it so there's no way the person who stole my phone can reach my data.
    - bostik 11y ago
      So, you're using full-disk encryption on your phone and the remote kill switch flushes the key? Otherwise the data is still there in the plain, accessible by anyone who can read the flash.
      - EwanToo 11y ago
        If you're using a Nexus 5X or 6P on Android 6, then probably yes. Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.
wisty 11y ago
Yeah, no-one will steal your fingerprint, just like no-one will crack a reasonably strong password. But if every site has a copy ...
- SideburnsOfDoom 11y ago
  It's quite possible that your fingerprint has already been stolen http://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints http://www.theguardian.com/technology/2015/sep/23/us-governm...

posnet 11y ago

Many countries now take fingerprint scans when you cross the border. Even if they themselves never use it, its easily conceivable that they could be hacked or leaked. Then what? You can't revoke your fingerprint.

zuppy 11y ago
Who will bother to recreate the fingerprint, most of us aren't that important? (I'm not) :) Don't get me wrong, I do understand the main problem is that you can't change this "token" and it's something that the people have easy access to. It shouldn't be used to keep data that has a higher value than the effort required.
- zmmmmm 11y ago
  The real risk is that if it reaches a certain level of ubiquity (which it appears it is), authorities will invest in a) laws and b) technology to break it with almost trivial ease. The US already has my fingerprints on file from crossing the border. Presumably it means that if they wish they could trivially unlock my phone and search its contents. I fully expect that if fingerprint access does become the universal security mechanism used on computing devices we'll soon enough have fully automated solutions where law enforcement can either download your fingerprint from their existing database or scan it from any available surface in real time and apply an image to the sensor to fool it into unlocking. Obviously this will take a while to happen, so for now people are lulled into a rather false sense of security that their fingerprints are a "pretty good" way to secure their phone when they are only "pretty good" because technology will take a few years to automate the breaking of them, at which point they will become "very bad".
  - r-w 11y ago
    Why bother breaking into a phone manually when you already have access to all the data it sends, receives, and contains (especially now that cloud storage solutions are all the rage)? What do passcodes and fingerprint scanners even mean when the target data is already being made accessible to national governments through more convenient channels? In my mind, the only reasons tech giants continue to force centralization on their users are PRISM and data mining. Today’s devices have sizable internal drives, so all personal data could realistically be stored and processed locally; and secure, distributed systems have been proven to work for data transfer (BitTorrent), monetary transactions (Bitcoin), message boards (Aether—sort of), and more. Hopefully solutions like Copperhead OS and Blackphone that secure our mobile devices and communication channels, respectively, make it to the mainstream.

ris 11y ago

"Nobody's going to bother to recreate your fingerprint, when it's much easier to beat you with a wrench ( https://xkcd.com/538/ https://xkcd.com/538/ ) until they get access to your phone." I think this misses the point. Accessing a device using a "cloned finger" (not tremendously difficult) can be done without the target ever knowing it has happened. The wrench technique, less so.

zuppy 11y ago
Yes, but is it worth spending the required resources? If the answer is yes, than anyway the 4 digit pin isn't more secure (you can watch people type them and find out the code).
- elyobo 11y ago
  You can change your code. The fingerprint is a bit more difficult. That's my main issue with biometric security, revocation of compromised credentials (e.g. fingerprints) is difficult or impossible.
  - nileshtrivedi 11y ago
    Not only that. With fingerprints, you are essentially using the same password everywhere. You just need to lose it once and all your accounts would be compromised.
- SideburnsOfDoom 11y ago
  > Nobody's going to bother to recreate your fingerprint, Whyever not? They might have a copy of it lying around. http://www.theguardian.com/technology/2015/sep/23/us-government-hack-stole-fingerprints http://www.theguardian.com/technology/2015/sep/23/us-governm... > Yes, but is it worth spending the required resources? When it becomes easy - and it will become easy, there's nothing basically hard about printing out some ridged plastic - it will become commonplace. And unlike stolen passwords, an attacker can be fairly sure that you haven't changed your fingers.

will_hughes 11y ago

(I'm not a lawyer, I've just read a bunch of blogposts/discussions on the issue) There's a legal difference in some places between having your phone secured by a fingerprint and a password. If your phone is secured by a password, then in some places you cannot be obliged to provide the password, but a fingerprint you can.

r-w 11y ago
Where are those laws in place?
- will_hughes 11y ago
  In the US in particular. There was a bunch of reporting in the past few days that a Federal District Court in Pennsylvania found that Fifth Amendment rights apply to smartphone passcodes. Random link: http://www.digitaltrends.com/mobile/why-the-government-cant-make-you-give-up-your-phone-password/ http://www.digitaltrends.com/mobile/why-the-government-cant-... That same protection doesn't seem to apply to fingerprints. Random link: http://time.com/3558936/fingerprint-password-fifth-amendment/ http://time.com/3558936/fingerprint-password-fifth-amendment... Again, I'm not a lawyer, but that seems to be how the law falls out on that issue. Whether that's an issue for you, personally - no idea. It might be a factor for some.
  - Tinyyy 11y ago
    I wonder if its possible to counter this through obscurity. Since the sensor is on the back of the phone, you can use your ring finger to unlock it instead. If >3 attempts with any other fingers are made, then the phone will be locked with a password. That way, you still keep your right to protection.
  - geofft 11y ago
    The other thing about the US is that occasionally you'll find a police department that's willing to bend the law. They can make you touch the fingerprint sensor and then claim that they never did and they found your phone unlocked, and it'll be your word against theirs. If the court believes the police, which they are culturally inclined to do, the Fifth Amendment question doesn't even come up. One of the neat things about encryption, historically, is that the government couldn't force decryption even if it were willing to break the law in doing so. That's why there were export controls and demands for backdoors in the '90s, and that's why there are demands for backdoors today. Fingerprint locks may mathematically involve encryption, but they don't have this property.

r-w 11y ago

Wrench, meet plausible deniability: https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_cryptography https://en.wikipedia.org/wiki/Plausible_deniability#Use_in_c...

bobert22935 11y ago
People who say this never game this out. 1. Attacker sees random data. 2. Attacker knows you might be smart enough to use a plausible deniability file system. 3. Attacker starts beating you with the wrench. At this point, there are several possibilities that could happen: 1. You give up the secret and give the attacker what he wants. The beating continues after this point, because the attacker really has no idea if you've given up the right secret. 2. You give up a fake secret and give the attacker what he thinks he wants. The beatings continue. See possibility #1. 3. You don't give up the secret and he continues beating you with the wrench anyway to try to get you to reveal the secret. 4. You're not using a plausible deniability encryption at all, and it truly is random data, and he continues to beat you with the wrench to make sure. As you can see, the wrench doesn't give two shits about your plausible deniability.
- exo762 11y ago
  If your threat model involves wrench, you are OOL. Fortunately, its not true for most of us.
  - bobert22935 11y ago
    The world is rife with wrenches and people willing to use them. PD is only good against people who don't have legal leverage against you, and those not willing to break the law to get it.
- r-w 11y ago
  …unless drives were encrypted by default, in which case the wrench would have no method to distinguish the two! Any reasonable wrench would not pursue such a doubtful case anyway. And regardless, the goal is not to avoid being beaten by the wrench, but to sustainably deny the existence of the secret. There is no incentive to ever give up the actual secret when the wrench cannot tell the difference and must continue beating (which would only happen at high levels of worth or likelihood); I might as well have continued lying. NOW GIMME MY SHITS

DataWorker 11y ago

I think the OPM data breach recently put about 10 million fingerprints and a ton of associated personally identifying information into the hands of people who have clear motivation to hack the cell phones of many of the people impacted.