5 ms·

Fingerprint Extraction Using Smartphone Camera

40 points by lainon 9y ago

benjaminjackman 9y ago
This is a good brief post by Bruce Schneier to read when the subject of biometrics come up: https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht... The thrust of his argument in this post is: > The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system. Which may be a good thing to keep in mind if you are using fingerprints to id someone using their phone's camera.
- unkown-unknowns 9y ago
  "Hey could you hold my phone for a sec? Thanks. No wait, not like that, here, hold it like this." :p
oleks 9y ago
Ironically, this looks like another excellent argument against the use of fingerprint authentication. It makes it easier to capture someone's fingerprints without their consent - "Hey, could you hold my phone for a sec?" - "Thanks!" Oh, and it is easy enough to break TouchID[1], so what makes using the smartphone camera any more sensible? [1]: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
- userbinator 9y ago
  It makes it easier to capture someone's fingerprints without their consent You can already observe someone and take the prints from whatever was touched last... no need to interact with the person directly.
draugadrotten 9y ago
Can anyone say if this camera method includes detection if the finger is alive or a static image? Early fingerprint detectors could be spoofed by static images (on paper, plastic or other materials) while modern detectors use various methods for liveness detection. It should be obvious that few commercial implementations would like to use something that can be fooled by a static image.
- yorwba 9y ago
  It's possible to detect the minute changes in skin color caused by the pulse, so you could distinguish a live finger from a fake (unless it has a pulsing light...) This paper doesn't mention anything about verifying liveness, though.
  - readams 9y ago
    Liveness sensors in fingerprint sensors have not historically proved difficult to defeat.

40 points by lainon 9y ago

This is a good brief post by Bruce Schneier to read when the subject of biometrics come up: https://www.schneier.com/blog/archives/2009/01/biometrics.html https://www.schneier.com/blog/archives/2009/01/biometrics.ht... The thrust of his argument in this post is: > The lesson is that biometrics work best if the system can verify that the biometric came from the person at the time of verification. The biometric identification system at the gates of the CIA headquarters works because there's a guard with a large gun making sure no one is trying to fool the system. Which may be a good thing to keep in mind if you are using fingerprints to id someone using their phone's camera.

unkown-unknowns 9y ago
"Hey could you hold my phone for a sec? Thanks. No wait, not like that, here, hold it like this." :p

oleks 9y ago

Ironically, this looks like another excellent argument against the use of fingerprint authentication. It makes it easier to capture someone's fingerprints without their consent - "Hey, could you hold my phone for a sec?" - "Thanks!" Oh, and it is easy enough to break TouchID[1], so what makes using the smartphone camera any more sensible? [1]: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

userbinator 9y ago
It makes it easier to capture someone's fingerprints without their consent You can already observe someone and take the prints from whatever was touched last... no need to interact with the person directly.

draugadrotten 9y ago

Can anyone say if this camera method includes detection if the finger is alive or a static image? Early fingerprint detectors could be spoofed by static images (on paper, plastic or other materials) while modern detectors use various methods for liveness detection. It should be obvious that few commercial implementations would like to use something that can be fooled by a static image.

yorwba 9y ago
It's possible to detect the minute changes in skin color caused by the pulse, so you could distinguish a live finger from a fake (unless it has a pulsing light...) This paper doesn't mention anything about verifying liveness, though.
- readams 9y ago
  Liveness sensors in fingerprint sensors have not historically proved difficult to defeat.