3 ms·
I suspect there is a vulnerability in the flow: 1. Attacker reads the photo form the passport 2. Attacker prints out the photo, perhaps with some perspecti
by GrantZvolsky 7y ago
I suspect there is a vulnerability in the flow:
1. Attacker reads the photo form the passport
2. Attacker prints out the photo, perhaps with some perspective correction
3. Attacker tricks the phone into recognizing the print as the subject
Am I wrong? My knowledge of the flow is entirely based on the comment above.
- jarfil 7y agoThat's the problem with any biometric data being used for authentication: once an attacker gets a copy, it's game over. Biometric passports are a means of identification, not authentication, with the biometric data being signed by a trusted third party, but not considered a secret. The only protection they include is a password printed inside the passport to thwart silent NFC data access.
- edelans 7y agoIndeed, "biometrics are usernames, not passwords". It reminds me of an old thread : http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... HN discussion : https://news.ycombinator.com/item?id=11549536 https://news.ycombinator.com/item?id=11549536
- Aaargh20318 7y ago> Indeed, "biometrics are usernames, not passwords". Biometrics are neither. They are a completely separate factor in authenticating a person, and used in different scenario's. Biometrics have advantages and disadvantages based on your threat model. For example, unlocking your laptop with a fingerprint while working on a train or plane might be preferable to a username/password because the risk of a shoulder-surfer may be higher than the risk of someone lifting your fingerprint.
- spydum 7y agoYes this is basically just client side authentication, easily tampered with.