5 ms·

I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have b

I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations - for example: "Experiments on a capacitive fingerprint dataset, similar to the one used by Apple TouchID, showed that it is possible to break 6.88% of users’ account in 5 attempts if the FMR setting of the matching algorithm (Verifinger 6.1 SDK) was set to 0.01% and each subject was enrolled with one finger and 12 partial impressions per finger." It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID. The way you believe TouchID works may be significantly better or worse than it actually does, so don't you need to test iPhones if you're going to be giving scary quotes to reporters about them being insecure?

pinum 10y ago
I understand it's difficult to test against the actual Touch ID, since it has aggressive hardware-enforced cooldowns and other defensive tech.
- ballenf 10y ago
  So it's a lock that's too hard to pick to prove how easy it is to pick?
- mikeash 10y ago
  It should be easy on a phone you control. You can try five times quickly, then it stops accepting fingerprints until you put in the password. This is a major problem for an attacker, but if you're just researching it then you can put in the password to reenable fingerprint authentication and then get five more tries. You should be able to try 20-30 fingerprints per minute.
fauigerzigerk 10y ago
>I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations That is exactly what the article says. Specifically: The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life conditions. and “To really know what the impact would be on a cellphone, you’d have to try it on the cellphone,” she said. and Dr. Ross acknowledged the limitations of the work. Half of the article is about the limitations of the approach the paper used, so I fail to understand your criticism of the reporting.
- huxley 10y ago
  While the article does say that ... eventually, the headline and the first two and a half paragraphs undermine your point. Since most people won't actually read and digest the full article, but instead go by the headline "That Fingerprint Sensor on Your Phone Is Not as Safe as You Think" and read the first paragraph or so, none of the caveats matter much, people will walk away with the impression that this is a verified fact.
- djrogers 10y ago
  The article currently linked here is not the same one originally linked. It was changed after I made my post. That said, the headline still explicitly calls out smartphones.
  - deleted 10y ago
    [deleted]
  - pbhjpbhj 10y ago
    >article currently linked here is not the same one originally linked // Grr, hate it when they do that, it's clearly too hard to add a second link "previously the linked article was: ..."?
    - yorwba 10y ago
      Like here? https://news.ycombinator.com/item?id=14318899 https://news.ycombinator.com/item?id=14318899
  - fauigerzigerk 10y ago
    Oh, I see! Now that is weird. Apologies.
- bobbles 10y ago
  Maybe because the headline is: That Fingerprint Sensor on Your Phone Is Not as Safe as You Think when in fact, probably they are
DINKDINK 10y ago
>It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID. In theory, there's no difference between theory in practice; In practice, there is. ;] OTOH, Here is a supposed example of an attacker circumventing TouchID iPhone-access controls: "The video shows in detail how CCC member "Starbug" managed to fool the Touch ID sensor of Apple's new iPhone 5s – using only a scanner, tracing paper, a pcb and wood glue." [1] https://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html https://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-i...
- r00fus 10y ago
  That hack uses lab conditions. They have a clear wine glass with a high resolution scanner. More real-life conditions (smeared print, non-glass surface) would be interesting to reproduce. My guess is that it ups the ante significantly for cost of hacking.
  - derefr 10y ago
    In "real life"—unless there was some absolute urgency to the problem—you wouldn't try to reconstruct a smudged partial print; you'd just use social engineering/espionage tactics to get a good print. (Remember that iOS locks and/or wipes devices after 10 failed attempts. You want to go to however much effort is required to be perfect the first time.) I can think of a number of situations one could create where a person would have no incredulity about actually inking their fingers and carefully applying fingerprints to a piece of paper. Committed adversaries aren't scared of crimes like "impersonating a police officer", remember.
    - bigiain 10y ago
      I imagine that sort of "committed adversary" is also quite capable of hitting you with a $5 wrench until you tell them the passcode...
      - 10y ago
Nightshaxx 10y ago
> The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life. You are indeed correct. I wish someone would do a full test on how secure the readers are.

pinum 10y ago

I understand it's difficult to test against the actual Touch ID, since it has aggressive hardware-enforced cooldowns and other defensive tech.

ballenf 10y ago
So it's a lock that's too hard to pick to prove how easy it is to pick?
mikeash 10y ago
It should be easy on a phone you control. You can try five times quickly, then it stops accepting fingerprints until you put in the password. This is a major problem for an attacker, but if you're just researching it then you can put in the password to reenable fingerprint authentication and then get five more tries. You should be able to try 20-30 fingerprints per minute.

fauigerzigerk 10y ago

>I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations That is exactly what the article says. Specifically: The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life conditions. and “To really know what the impact would be on a cellphone, you’d have to try it on the cellphone,” she said. and Dr. Ross acknowledged the limitations of the work. Half of the article is about the limitations of the approach the paper used, so I fail to understand your criticism of the reporting.

huxley 10y ago
While the article does say that ... eventually, the headline and the first two and a half paragraphs undermine your point. Since most people won't actually read and digest the full article, but instead go by the headline "That Fingerprint Sensor on Your Phone Is Not as Safe as You Think" and read the first paragraph or so, none of the caveats matter much, people will walk away with the impression that this is a verified fact.
djrogers 10y ago
The article currently linked here is not the same one originally linked. It was changed after I made my post. That said, the headline still explicitly calls out smartphones.
- deleted 10y ago
  [deleted]
- pbhjpbhj 10y ago
  >article currently linked here is not the same one originally linked // Grr, hate it when they do that, it's clearly too hard to add a second link "previously the linked article was: ..."?
  - yorwba 10y ago
    Like here? https://news.ycombinator.com/item?id=14318899 https://news.ycombinator.com/item?id=14318899
- fauigerzigerk 10y ago
  Oh, I see! Now that is weird. Apologies.
bobbles 10y ago
Maybe because the headline is: That Fingerprint Sensor on Your Phone Is Not as Safe as You Think when in fact, probably they are

DINKDINK 10y ago

>It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID. In theory, there's no difference between theory in practice; In practice, there is. ;] OTOH, Here is a supposed example of an attacker circumventing TouchID iPhone-access controls: "The video shows in detail how CCC member "Starbug" managed to fool the Touch ID sensor of Apple's new iPhone 5s – using only a scanner, tracing paper, a pcb and wood glue." [1] https://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-in-detail-1966044.html https://www.heise.de/video/artikel/iPhone-5s-Touch-ID-hack-i...

r00fus 10y ago
That hack uses lab conditions. They have a clear wine glass with a high resolution scanner. More real-life conditions (smeared print, non-glass surface) would be interesting to reproduce. My guess is that it ups the ante significantly for cost of hacking.
- derefr 10y ago
  In "real life"—unless there was some absolute urgency to the problem—you wouldn't try to reconstruct a smudged partial print; you'd just use social engineering/espionage tactics to get a good print. (Remember that iOS locks and/or wipes devices after 10 failed attempts. You want to go to however much effort is required to be perfect the first time.) I can think of a number of situations one could create where a person would have no incredulity about actually inking their fingers and carefully applying fingerprints to a piece of paper. Committed adversaries aren't scared of crimes like "impersonating a police officer", remember.
  - bigiain 10y ago
    I imagine that sort of "committed adversary" is also quite capable of hitting you with a $5 wrench until you tell them the passcode...
    - 10y ago

Nightshaxx 10y ago

> The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life. You are indeed correct. I wish someone would do a full test on how secure the readers are.