9 ms·

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviou

• Asdfbla 9y ago
  I suppose Samsung tuned the system to avoid false negatives, which might be difficult in all the lighting conditions that might come up in real world use. It's a device for the mass market and average user after all. Might be that they did a bad job with the Iris recognition, but why not give them the benefit of the doubt and consider that they were aware of the trade-offs involved?
  • dahauns 9y ago
    Knowingly and willingly giving users a false sense of security? How is that not worse in every way? If they couldn't manage to get false negatives down to an sensible level without compromising security in such a blatant way, there's two courses of action: Live with it, or don't release it.
    • adrianN 9y ago
      Or release it and make money with your cool feature that competitors don't have.
      • moe 9y ago
        Spot on. This is a marketing gimmick, not a security feature. Just as with fingerprint readers[1] the target audience is people who otherwise wouldn't lock their phone at all. [1] https://arstechnica.com/apple/2013/09/chaos-computer-club-hackers-trick-apples-touchid-security-feature/ https://arstechnica.com/apple/2013/09/chaos-computer-club-ha...
    • wapz 9y ago
      How is this any different than the swipe to unlock pattern? If you go to a starbucks and sit down for 20 minutes in a higher seat, you can get the passwords to probably 2-5 phones depending on everyone's security and how crowded it is (I inadvertently memorized 3+ coworkers' unlock patterns because they're so easy to see). If someone has physical access to the user they can probably get into most people's phones (that's just saying people aren't careful enough though).
  • rodionos 9y ago
    That could be the case, after all it's not a Diebold ATM.
• _nalply 9y ago
  Do you have a source about these micro-dilations? I googled a little bit but couldn't find enlightening results in my superficial search.
  • IshKebab 9y ago
    The closest I could find was this: https://graphics.stanford.edu/papers/remote-pupillometry/ https://graphics.stanford.edu/papers/remote-pupillometry/ It seems that there are reasonably large changes due to thinking about something, but not due to just looking unless your camera can detect 0.01 mm changes in diameter, which maybe tbihl's could be that seems unreasonable for a smartphone camera. I would guess tbihl has never tried to get iris recognition working on a cost-constrained consumer device at a huge scale. They might not think it is so trivial then.
    • tbihl 9y ago
      It's true that I've only tried iris recognition in dedicated setups. Sadly, I can't speak to whether this test is within the abilities of a standard smartphone camera without any macro lens.
  • matt4077 9y ago
    A similar concept that I remember from university are saccades (minimal, involuntary eye movements).
    • IshKebab 9y ago
      Yes but those are well-known and visible to the naked eye. I've never heard of these 'micro-dilations' and Google didn't show anything.
      • tbihl 9y ago
        'hippus', specifically 'physiological hippus', or ' pupillary athetosis', seem to be the correct terms for what I was describing as 'micro-dilations'. Saccades, as I understand it, is rotational shift of focus by 1-2 degrees, rather than repeated contraction/relaxation of the pupil.
• lawl 9y ago
  > CCC were able to do this for about the cost of a S8. I think you misunderstood this. The cost was buying the S8. You only need a laser printer, a decent camera and a contact lens.
  • bebna 9y ago
    That is what he meant. Doing it better is that easy, that the cost of the S8 is more expensive then the hours of programming labor.
    • StavrosK 9y ago
      What programming labor? They just printed a photo and put a lens on it.
      • jstanley 9y ago
        You're agreeing.
        • StavrosK 9y ago
          Yeah, well, in that sense, the cost of the S8 was also higher than the hours the researchers spent scrubbing toilets to develop this exploit.
      • lorenzhs 9y ago
        I think that tbihl and bebna are trying to say that it would cost Samsung less to defeat the attack by programming one of the listed countermeasures than it cost the CCC folks to buy one of these phones. (I don't agree.)
        • tbihl 9y ago
          That is exactly what I meant. Like you're probably thinking, my estimate IS an amateurish one, taking into account no business admin/healthcare/etc. But I remember implementing this (as a small part of a project) at a time when I couldn't be bothered to put more than a few hours into any project. At any rate, I can't explain their failure to implement these checks, because they're SO trivial.
• NKCSS 9y ago
  You could also add eye-tracking to have the user follow a pattern and add complexity to faking it.
• matt4077 9y ago
  Samsung always seems to me as if they race to match any iPhone feature–but never more than skin-deep. So when the iPhone gets a fingerprint sensor that saves only a hash of the actual data in a special enclave of a custom chip, Samsung responds with an iris scanner that saves an image of the iris as a world-readable jpeg in your home directory. Thus, their marketing material can claim feature-parity (or even exceed Apple). But it never seems like they actually care. It's not like Apple doesn't run into similar problems (not sure if the fingerprint sensor has been defeated–it's a bad idea for 5th amendment reasons in any case). But at least they do the minimum in trying.
  • mae9tvw5 9y ago
    >It's not like Apple doesn't run into similar problems (not sure if the fingerprint sensor has been defeated–it's a bad idea for 5th amendment reasons in any case). But at least they do the minimum in trying. In 2013 a CCC member broke TouchID access within a few hours after release of the IPhone. All needed was a photograph of the fingerprint on a glass surface. https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid Same method worked on the Iphone 6, as Apple hasn't changed a thing. Biometry is fundamentally broken.
    • moogleii 9y ago
      >All needed was a photograph of the fingerprint on a glass surface. And wood glue! Looks like that method proved unreliable, so they expanded it: "To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use."
      • mae9tvw5 9y ago
        Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...
• freshbob 9y ago
  Well, a few hours is quite the euphemism if you're talking about starting from scratch. Also, the cellphone image resolution is far too low to recognize dilations. Looking at the video, I'm surprised that it works as well as it does, to be honest.
• _h_o_d_ 9y ago
  This is remarkable, even though it's obvious to any of their phone users (myself included) that Samsung's software development is shoddy at best, despite its excellent hardware. Which is a huge pity, but may well have something to do with the culture of corporate deference and rigid hierarchy. http://www.asianews.network/content/feature-samsung-debacle-exposes-controversial-corporate-culture-28889 http://www.asianews.network/content/feature-samsung-debacle-...
  • tooltalk 9y ago
    why would that only affect their software, but not hardware? While I agree that Samsung is at its core a hardware company and software engineers are still treated like second-class citizens, you can't just expect them to compete with Google or Microsoft overnight, IMO. I'm disinclined to believe that their military-like corporate hierarchy is to blame.
    • _h_o_d_ 9y ago
      I don't know: perhaps that the company's structures work better for their core expertises, hardware, but software development, perhaps something that came somewhat later and lower down the hierarchy, doesn't work so well in that context?
  • Jweb_Guru 9y ago
    Let's not pretend that people here in extremely permissive environments don't build hugely buggy things that wouldn't survive a similarly superficial test.
• tbihl 9y ago
  Edit: 'micro-oscillation' was a term that I lazily invented to describe a phenomenon with which I am only passingly familiar. It is actually called 'hippus' or ' pupillary athetosis'.
  • xnandor 9y ago
    Have you read George Orwell's "Politics and the English Language"? If not you should give it a read, it's short. This comment reminded me of his criticism related to Latin usage.
    • tbihl 9y ago
      I have now! Hopefully you're accusing me only of saying 'micro-oscillations' when I ought to have said "shrinks and swells slightly at regular intervals."
• lucb1e 9y ago
  > It's that simple a programming exercise. Then it's also fixable in software, no hardware update needed, right? At least to make it better even if it isn't good yet.
• binarycrusader 9y ago
  Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. What if one of the subject's eyes is a glass eye? What if they're wearing colored contact lenses? Wouldn't both of those situations complicate that?
  • wlesieutre 9y ago
    If someone's wearing a colored contact lens I would expect iris recognition to not work. That's like trying to use a fingerprint reader with gloves on.
    • wlesieutre 9y ago
      Glass eye I'm not sure about either. That seems along the lines of using a fingerprint reader on a prosthetic hand. Sure, you could mold a fingerprint onto one and scan it, but with a sophisticated fingerprint sensor it's going to look like a fake finger. Do we deliberately make everyone's fingerprint scanner weak to allow someone without fingers to use it? Maybe the answer is to introduce a "weak mode" option where most users could have the scanner verify "yes, this is a real eyeball," and if someone with a glass eye still wanted to use iris scanning in a way that can be copied by a photo, they have the choice to disable the security measures.
      • tboughen 9y ago
        If someone with a glass eye is using a smartphone then one would suspect they are seeing their other, real, eye. This can then be scanned as normal.
        • wlesieutre 9y ago
          You'd think so, but iPhones are incredibly useful to blind people. https://finance.yahoo.com/news/david-pogue-on-iphone-voiceover-163733668.html https://finance.yahoo.com/news/david-pogue-on-iphone-voiceov...
• dingo_bat 9y ago
  I think if they would track an event that's only 2Hz that's too much time to unlock. People would complain that it's slow.
• wl 9y ago
  Silicon imagers don't work very well past 1 µm or so. To go out to 1.2 µm, you're using another semiconductor and that gets expensive rather quickly.
• ender89 9y ago
  at least a decent software update should be pretty easy to push out to fix the issue.
• Geee 9y ago
  You could also flash a bright LED and measure the pupil response. It's possible that there's something unique in the response too.
• deleted 9y ago
  [deleted]