7 ms·

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in

> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and biologically identifying the owner. You don’t get to reset that stuff once it’s been released into the wild! That's one of the biggest dangers in using biometrics as a factor in authentication. Once it leaks (and keeping data safe is one of the hardest task in today's world) there is no changing, no resetting, it is out there and rendered useless at best or a vector for identity theft at worst.

speeder 11y ago
Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
- DanielBMarkham 11y ago
  You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
  - mtgx 11y ago
    Unfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations). I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.
    - DanielBMarkham 11y ago
      Wow. So a piece of plastic the bank gives you with mostly arbitrary numbers on it is better protected than your own fingerprints, which you're stuck with for life? Good grief.
    - arviewer 11y ago
      In the Netherlands we had a passport with fingerprint, and all data stored by the state. Luckily, this was reversed, and now the fingerprint is only stored in the passport itself. Well, that's what I hope, as the fingerprint needs to be stored temporarily for the time to create the passport. Better, if you don't leave the EU, you can use an identity card that doesn't have the fingerprint. I was lucky enough to have an old passport that just spanned the period in which the fingerprint was stored centrally. Now I have an ID card, but one time in the future I will leave the EU, and then I have to get a password...
  - adzm 11y ago
    However, Fingerprints cannot be practically hashed.
    - stonemetal 11y ago
      Images can be hashed(and hashed in such a way that minor changes can still lead to the same hash), so images of fingerprints should be hashable.
  - jessaustin 11y ago
    Just use them as a hash lookup into a keystore. This is intuitively appealing, but do biometrics really boil down to an exact number that we could hash like this? (Genuine questions; I don't know.) It seems more likely to me that biometric measurements would be considered to "match" when they're within particular tolerances. This is an operation you can perform on the original measurements, but not on hashes of those.
    - taejo 11y ago
      There is a cryptographic tool called a "fuzzy extractor" that solves this problem (c.f. Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data, by Dodis, Reyzen and Smith [0]). At enrollment time, you compute some (non-sensitive) data P = Enroll(biometric). Then every time you compute Recover(P, biometric') you will get the same (high-entropy) output, as long as biometric' is close enough to biometric. [0] https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec2004-final.pdf https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec20...
    - spdustin 11y ago
      It is, effectively, what Touch ID does. (It's an over simplification but as an analogy it works)
  - newman314 11y ago
    This sounds like a good idea on the surface but this just shifts the problem. Ultimately, you still only have 10 fingers (general assumption), and not a large space like 30 char passwords.
- elros 11y ago
  Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – Voting card (Título de Eleitor), mandatory for all citizens between 18 and 65 years of age, encouraged for all citizens over 16; – Employment record book (Carteira de Trabalho), mandatory for any formal employment; – Passports Also, as of at least three years ago in the state of Rio de Janeiro, some of these were already computerized.
  - speeder 11y ago
    In my state these were all just printed on the document (at least last time I had to make documents). You cannot "hack" a piece of paper easily... But with mandatory vote + mandatory fingerprint to vote, you just turn that database in a giant juicy target, an attacker can be sure that all voters will have fingerprints there.
    - _asummers 11y ago
      Do you have any assurances your paper documents were not immediately scanned? Do you know what kind of access controls are enforced on the file cabinet they're stored in? Are they susceptible to a janitor who gets approached by a shady dude with a briefcase of money? The larger point I'm trying to make is that this is no longer something you have control over and have no guarantees about who else has a copy of it, and therefore should not be relying on it being kept secret, and moreover should assume it has been compromised.
  - a3n 11y ago
    > Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? If they already have fingerprints, and now fingerprints are suddenly required for voting, that makes election fraud easier for the government.
yoodenvranx 11y ago
> Once it leaks Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.
- Jarwain 11y ago
  One requires targeting a specific individual, but you have a specific goal in mind for those prints. The other involves obtaining several people's fingerprint data. From there, you can figure out what you can actually do with said data
  - yoodenvranx 11y ago
    You are right, thanks for the answer!
K0nserv 11y ago
The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and-you-should-do-so-too.html https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
- tim333 11y ago
  Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
  - K0nserv 11y ago
    It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
    - mikeash 11y ago
      Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.
      - K0nserv 11y ago
        You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad
lallysingh 11y ago
If someone's going to use biometrics, please just use a face picture. People understand that their face is mechanically recognizable, and don't have the same false confidence in pictures that they have in fingerprints.
robmcm 11y ago
Most people have 10 to choose from, 20 if you want, and potentially more if you consider other regions of your skin.
newman314 11y ago
I found this article from Microsoft a while ago that I thought was particularly interesting. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx
make3 11y ago
They should keep a hash of the finger print info, not the info itself. I don't know how it would work, but keeping biometric data for authentification is indeed potentially worse than keeping plain text passwords. Like, the output range of a convnet, or something.

speeder 11y ago

Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...

DanielBMarkham 11y ago
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
- mtgx 11y ago
  Unfortunately, that's not how governments around the world require it right now. Estonia for its e-citizenship program, as well as pretty much all countries requiring a fingerprint for passports store the fingerprints in their own centralized database (that also get shared with other nations). I switched my phone fingerprint to another finger for my phone as soon as I signed-up for a passport.
  - DanielBMarkham 11y ago
    Wow. So a piece of plastic the bank gives you with mostly arbitrary numbers on it is better protected than your own fingerprints, which you're stuck with for life? Good grief.
  - arviewer 11y ago
    In the Netherlands we had a passport with fingerprint, and all data stored by the state. Luckily, this was reversed, and now the fingerprint is only stored in the passport itself. Well, that's what I hope, as the fingerprint needs to be stored temporarily for the time to create the passport. Better, if you don't leave the EU, you can use an identity card that doesn't have the fingerprint. I was lucky enough to have an old passport that just spanned the period in which the fingerprint was stored centrally. Now I have an ID card, but one time in the future I will leave the EU, and then I have to get a password...
- adzm 11y ago
  However, Fingerprints cannot be practically hashed.
  - stonemetal 11y ago
    Images can be hashed(and hashed in such a way that minor changes can still lead to the same hash), so images of fingerprints should be hashable.
- jessaustin 11y ago
  Just use them as a hash lookup into a keystore. This is intuitively appealing, but do biometrics really boil down to an exact number that we could hash like this? (Genuine questions; I don't know.) It seems more likely to me that biometric measurements would be considered to "match" when they're within particular tolerances. This is an operation you can perform on the original measurements, but not on hashes of those.
  - taejo 11y ago
    There is a cryptographic tool called a "fuzzy extractor" that solves this problem (c.f. Fuzzy Extractors: How to Generate Strong Keys from Biometrics and Other Noisy Data, by Dodis, Reyzen and Smith [0]). At enrollment time, you compute some (non-sensitive) data P = Enroll(biometric). Then every time you compute Recover(P, biometric') you will get the same (high-entropy) output, as long as biometric' is close enough to biometric. [0] https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec2004-final.pdf https://www.iacr.org/archive/eurocrypt2004/30270518/DRS-ec20...
  - spdustin 11y ago
    It is, effectively, what Touch ID does. (It's an over simplification but as an analogy it works)
- newman314 11y ago
  This sounds like a good idea on the surface but this just shifts the problem. Ultimately, you still only have 10 fingers (general assumption), and not a large space like 30 char passwords.
elros 11y ago
Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – Voting card (Título de Eleitor), mandatory for all citizens between 18 and 65 years of age, encouraged for all citizens over 16; – Employment record book (Carteira de Trabalho), mandatory for any formal employment; – Passports Also, as of at least three years ago in the state of Rio de Janeiro, some of these were already computerized.
- speeder 11y ago
  In my state these were all just printed on the document (at least last time I had to make documents). You cannot "hack" a piece of paper easily... But with mandatory vote + mandatory fingerprint to vote, you just turn that database in a giant juicy target, an attacker can be sure that all voters will have fingerprints there.
  - _asummers 11y ago
    Do you have any assurances your paper documents were not immediately scanned? Do you know what kind of access controls are enforced on the file cabinet they're stored in? Are they susceptible to a janitor who gets approached by a shady dude with a briefcase of money? The larger point I'm trying to make is that this is no longer something you have control over and have no guarantees about who else has a copy of it, and therefore should not be relying on it being kept secret, and moreover should assume it has been compromised.
- a3n 11y ago
  > Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? If they already have fingerprints, and now fingerprints are suddenly required for voting, that makes election fraud easier for the government.

yoodenvranx 11y ago

> Once it leaks Leaking? Why do you need a leak? Just follow somebody and wait until he touches something, preferably a glass in a pub or something similar.

Jarwain 11y ago
One requires targeting a specific individual, but you have a specific goal in mind for those prints. The other involves obtaining several people's fingerprint data. From there, you can figure out what you can actually do with said data
- yoodenvranx 11y ago
  You are right, thanks for the answer!

K0nserv 11y ago

The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and-you-should-do-so-too.html https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...

tim333 11y ago
Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
- K0nserv 11y ago
  It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible. The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords. Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple. 0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - mikeash 11y ago
    Do you think they would have figured all of that out before the phone disabled Touch ID at the 48-hour mark? I'm rather doubtful myself.
    - K0nserv 11y ago
      You are right, that's an oversight of mine. Didn't keep the 48 hour thing in mind when writing that comment. My bad

lallysingh 11y ago

If someone's going to use biometrics, please just use a face picture. People understand that their face is mechanically recognizable, and don't have the same false confidence in pictures that they have in fingerprints.

robmcm 11y ago

Most people have 10 to choose from, 20 if you want, and potentially more if you consider other regions of your skin.

newman314 11y ago

I found this article from Microsoft a while ago that I thought was particularly interesting. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx

make3 11y ago

They should keep a hash of the finger print info, not the info itself. I don't know how it would work, but keeping biometric data for authentification is indeed potentially worse than keeping plain text passwords. Like, the output range of a convnet, or something.