18 ms·

A fingerprint reader can also be operated while the victim is asleep, unconscious, and even after you sever the thumb off (remote attack!!). Does that mean a fi

by ahbyb 7y ago

A fingerprint reader can also be operated while the victim is asleep, unconscious, and even after you sever the thumb off (remote attack!!). Does that mean a fingerprint reader cannot be ever be called secure?

petschge 7y ago
A fingerprint is never a secure password. It is a username at best.
- ses1984 7y ago
  I think you mean the worst case scenario for a fingerprint is that it's a username.
  - nolok 7y ago
    I think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.
    - ses1984 7y ago
      A wee bit of motivation, hah, are you James Bond or something? Usernames can be guessed remotely, fingerprints can't really. Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
      - josefx 7y ago
        The CCC went after a German politician to show just how easily you could copy a fingerprint even without access to an object touched by the target[1]. A few pictures of the finger are more than enough. [1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerprints-public-photos/ https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...
        Wowfunhappy 7y ago
        How do you actually use the picture of the fingerprint to get into a phone? It doesn’t accept pictures, only fingers.
        et-al 7y ago
        From the NewScientist article Laforet linked above: > fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland. Replace silicone with some other flesh-like material that's conductive.
        ses1984 7y ago
        Ok but isn't that significantly more trouble than seeing or guessing a username? Does this take just a "wee bit of motivation"?
        petschge 7y ago
        Print with a laserjet onto overhead projector foil, spread a suitable kind of wood glue, dry, peel and apply to own finger tip. It is actually very straight forward.
        josefx 7y ago
        This video[1] is German, however as far as I can tell everything you need to get from an image to a fake print is easily available. The relevant part starts at 65 seconds. Only a few minutes to get a working fake. It is basically the process described by petschge. [1] https://youtu.be/OPtzRQNHzl0?t=65 https://youtu.be/OPtzRQNHzl0?t=65
    - petschge 7y ago
      What I meant is: you can not change it and you can not keep it secret so it makes a poor password replacement. Usernames do not have to kept secret (you know that my username on HN is petschge), so finger prints might be slightly more usable as usernames than they are as passwords. They are of course not great for that either. Their best use might be similar to the "card present verifier" on the back of a credit card, i.e. as a sign that the person who entered they username, they password (and possibly a physical auth token like a chip card) is actually present themselves. Or don't use fingerprints at all. They are not secure nor convenient as you think.
      - blotter_paper 7y ago
        I agree with this, but think that faces face the same issue. If anything, we leave our faces more places than our fingerprints; fingerprints smudge over time, but faces are big enough to capture at sufficient detail using cameras that are already widely deployed. iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles. I would really like biometrics to work, verifiable proof-of-human would be great, but I can only buy into them as an additional requirement for authentication; a piece of privately known/held information is still our most secure authentication mechanism for competent users.
        petschge 7y ago
        You are right. But note that I never said that faces where any better.
        blotter_paper 7y ago
        True that, I didn't mean to imply otherwise; I just thought your comment was the most coherent rebuking of fingerprints I'd seen so far while skimming, and I thought it would be a good place to expand on your sentiments with my own thoughts. I do see how my opening "but" could be confusing in this regard.
        saagarjha 7y ago
- xoa 7y ago
  No. It is a biometric identifier. That is what it is. A username is a human language convenient symbolic pointer that is meant to be public and used socially. I am still confused about why this particular incorrect meme is so persistent. "Something you know, something you have, something you are" all are simply different classes of authentication factor, and all are distinct from names, or UIDs, or any other bit of meta-information that isn't for authentication. Just like "something you know" can have different strengths, "something you are" can too and changes in technology and threats will enable new options alongside new attacks as we go along. It's a process.
  - djsumdog 7y ago
    I've only heard the "something you know" and "Something you have" from my old graduate level security class. This is the first I've heard of "something you ARE" and I like this distinction. It makes sense. Not only can "something you are" change (in some instances), it can also be something that can be difficult for technology to not recognize correctly. A username or password must be correct (unless you're Facebook and do that goofy thing where you allow both the upper and lower case versions) but a biometric is more fudgable.
    - xoa 7y ago
      >I've only heard the "something you know" and "Something you have" from my old graduate level security class. This is the first I've heard of "something you ARE" and I like this distinction. It makes sense. I'm somewhat surprised because it's definitely not new, I don't know what the exact genesis of that particular cryptographer's verse is but my vague recollection is I first heard it the late 90s, and the idea of extracting bits showing identity from physical qualities unique to a person certainly dates back a long ways. "Something you are" can cover a lot of possibilities too, and with vastly more variety and subtlety than I think a lot of people consider even in security fields. For example, there was recently a genuinely very interesting idea of measuring bottoms. As in, your actual behind/ass, via sensors in chairs. It should be unsurprising if you consider it, but of course the patterns of musculature/fat/bone structure are fairly unique to you for any part of your body if you have sensitive enough tools. It's a transparent measure for certain use cases like a workstation or the like since you're sitting down anyway, and hard to clone from afar since our butts are typically covered and subdermal is challenging without near contact. Another place if you want to look for cutting edge possibilities is advertising/surveillance. Near anything used for tracking fingerprinting could in principle be used for authentication too, and again there are potentially a lot of bits of entropy to be found there. Our gaits as we walk, our patterns of typing, our micro muscle movements, all sorts of things aren't so generic to a powerful enough system. "Biometrics" is to some extent at the stage of 80s or early 90s passwords, something to keep in mind in these discussions when people complain about them. 8-character alphanumeric passwords protected by crypt aren't exactly good these days either, but auth tech moved on even as tech benefitted attackers. In the future biometrics will undoubtedly consider far more than our current early generation systems, up to and including implants. FWIW, I have (more rarely) seen a few other classes of factor suggested that do make sense, and are arguably distinct categories. One is spatiotemporal, ie., "somewhere/somewhen you are". This is used de facto by any sort of air gapping or "this system can only be accessed from this one place and console" or the like. It could though be taken advantage of far more thanks to more ubiquitous high resolution GPS and the like in our systems. Having certain kinds of data only become accessible in the right place/time could be very useful. Another fuzzier category is "something you do", as-in observing the actions you take. I felt at one point that this was merely another way of measuring "something you are", but I can see the idea that it'd be distinct because it's about revealing your direct state of mind, whereas at least for the foreseeable future "something you are" tends to focus on more bulk matter aspects of your being. Technically state of mind is physical too, there is a specific vector state of axons and neurons and firing patterns that represent it, but it might make sense still to distinguish that from physical body structure or even implants. Whatever the case though it's still an interesting consideration, and makes a lot of sense in old school counterops. Sometimes the first sign of someone who "shouldn't be authenticated to use this" has been "they were 'acting funny'" after all.
- invalidusernam3 7y ago
  I can read your username once and remember it. I can't do the same with a fingerprint
  - jcranberry 7y ago
    Depends on the username. And you don't have your username written on your body.
  - pennaMan 7y ago
    I'm sure you can produce a hash from fingerprint model data for your reading pleasure
    - djsumdog 7y ago
      OpenSSH does that thing now where it can visually display ASCII art of your key fingerprint.
  - rhizome 7y ago
    That's not dispositive, you also can't dust for names.
deleted 7y ago
[deleted]
TheLML 7y ago
Modern fingerprint readers rely on the conductivity of your finger, so a cut off finger (or the finger of a dead person) can't per se unlock a phone.
- immad 7y ago
  A dead persons skin is still conductive.
  - Laforet 7y ago
    There are better ways to detect whether the finger is still attached to a live person. https://www.newscientist.com/article/mg21128225-100-fingerprint-scanner-to-spot-the-living-dead/ https://www.newscientist.com/article/mg21128225-100-fingerpr... Nevertheless it probably won't ever be completely reliable short of installing a hypodermic needle with the sensor to take a blood sample every time :)
    - war1025 7y ago
      Was it GATTACA where the main character used a prosthetic thumb add-on to fool the blood check every day on his way in to work?
      - djsumdog 7y ago
        Yep, fake hair samples and fake blood patches under the skin. There was a lot of detail written into that movie.
        rhizome 7y ago
        Andrew Niccol is so good!
      - covercash 7y ago
        And Demolition Man where he used an eyeball on a pen to fool the optical scanner.
botwriter 7y ago
found this out the hard way with a paranoid ex. now I just use the 8 digit pin to login
- rpmisms 7y ago
  I'm slightly curious as to which of the GP's options you found out the hard way. I truly hope you still have your fingers.
  - botwriter 7y ago
    Passed out and the ex-girlfriend used my finger on my phone to unlock it.
    - kd913 7y ago
      What makes you think a ex-girlfriend wouldn't be paranoid enough to look over at an 8-digit passcode or pattern?
      - rpmisms 7y ago
        Personally, I don't date anyone I don't trust with my passwords, work excluded, of course. Works out pretty well for me.
        PostPost 7y ago
        How do you know if you can trust someone that way without dating them in the first place? Only date people you've been friends with for several years?
        rpmisms 7y ago
        Yes, actually.
        idoh 7y ago
        I'm curious about this - is there some formal unveiling of passwords as a relationship milestone? Or does it just come up naturally, like, "I need to log into your gmail account, what's your password?"
floatinthecloud 7y ago
Yes

by ahbyb 7y ago

petschge 7y ago

A fingerprint is never a secure password. It is a username at best.

ses1984 7y ago
I think you mean the worst case scenario for a fingerprint is that it's a username.
- nolok 7y ago
  I think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.
  - ses1984 7y ago
    A wee bit of motivation, hah, are you James Bond or something? Usernames can be guessed remotely, fingerprints can't really. Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
    - josefx 7y ago
      The CCC went after a German politician to show just how easily you could copy a fingerprint even without access to an object touched by the target[1]. A few pictures of the finger are more than enough. [1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerprints-public-photos/ https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...
      - Wowfunhappy 7y ago
        How do you actually use the picture of the fingerprint to get into a phone? It doesn’t accept pictures, only fingers.
        et-al 7y ago
        From the NewScientist article Laforet linked above: > fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland. Replace silicone with some other flesh-like material that's conductive.
        ses1984 7y ago
        Ok but isn't that significantly more trouble than seeing or guessing a username? Does this take just a "wee bit of motivation"?
        petschge 7y ago
        Print with a laserjet onto overhead projector foil, spread a suitable kind of wood glue, dry, peel and apply to own finger tip. It is actually very straight forward.
        josefx 7y ago
        This video[1] is German, however as far as I can tell everything you need to get from an image to a fake print is easily available. The relevant part starts at 65 seconds. Only a few minutes to get a working fake. It is basically the process described by petschge. [1] https://youtu.be/OPtzRQNHzl0?t=65 https://youtu.be/OPtzRQNHzl0?t=65
  - petschge 7y ago
    What I meant is: you can not change it and you can not keep it secret so it makes a poor password replacement. Usernames do not have to kept secret (you know that my username on HN is petschge), so finger prints might be slightly more usable as usernames than they are as passwords. They are of course not great for that either. Their best use might be similar to the "card present verifier" on the back of a credit card, i.e. as a sign that the person who entered they username, they password (and possibly a physical auth token like a chip card) is actually present themselves. Or don't use fingerprints at all. They are not secure nor convenient as you think.
    - blotter_paper 7y ago
      I agree with this, but think that faces face the same issue. If anything, we leave our faces more places than our fingerprints; fingerprints smudge over time, but faces are big enough to capture at sufficient detail using cameras that are already widely deployed. iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles. I would really like biometrics to work, verifiable proof-of-human would be great, but I can only buy into them as an additional requirement for authentication; a piece of privately known/held information is still our most secure authentication mechanism for competent users.
      - petschge 7y ago
        You are right. But note that I never said that faces where any better.
        blotter_paper 7y ago
        True that, I didn't mean to imply otherwise; I just thought your comment was the most coherent rebuking of fingerprints I'd seen so far while skimming, and I thought it would be a good place to expand on your sentiments with my own thoughts. I do see how my opening "but" could be confusing in this regard.
      - saagarjha 7y ago
xoa 7y ago
No. It is a biometric identifier. That is what it is. A username is a human language convenient symbolic pointer that is meant to be public and used socially. I am still confused about why this particular incorrect meme is so persistent. "Something you know, something you have, something you are" all are simply different classes of authentication factor, and all are distinct from names, or UIDs, or any other bit of meta-information that isn't for authentication. Just like "something you know" can have different strengths, "something you are" can too and changes in technology and threats will enable new options alongside new attacks as we go along. It's a process.
- djsumdog 7y ago
  I've only heard the "something you know" and "Something you have" from my old graduate level security class. This is the first I've heard of "something you ARE" and I like this distinction. It makes sense. Not only can "something you are" change (in some instances), it can also be something that can be difficult for technology to not recognize correctly. A username or password must be correct (unless you're Facebook and do that goofy thing where you allow both the upper and lower case versions) but a biometric is more fudgable.
  - xoa 7y ago
    >I've only heard the "something you know" and "Something you have" from my old graduate level security class. This is the first I've heard of "something you ARE" and I like this distinction. It makes sense. I'm somewhat surprised because it's definitely not new, I don't know what the exact genesis of that particular cryptographer's verse is but my vague recollection is I first heard it the late 90s, and the idea of extracting bits showing identity from physical qualities unique to a person certainly dates back a long ways. "Something you are" can cover a lot of possibilities too, and with vastly more variety and subtlety than I think a lot of people consider even in security fields. For example, there was recently a genuinely very interesting idea of measuring bottoms. As in, your actual behind/ass, via sensors in chairs. It should be unsurprising if you consider it, but of course the patterns of musculature/fat/bone structure are fairly unique to you for any part of your body if you have sensitive enough tools. It's a transparent measure for certain use cases like a workstation or the like since you're sitting down anyway, and hard to clone from afar since our butts are typically covered and subdermal is challenging without near contact. Another place if you want to look for cutting edge possibilities is advertising/surveillance. Near anything used for tracking fingerprinting could in principle be used for authentication too, and again there are potentially a lot of bits of entropy to be found there. Our gaits as we walk, our patterns of typing, our micro muscle movements, all sorts of things aren't so generic to a powerful enough system. "Biometrics" is to some extent at the stage of 80s or early 90s passwords, something to keep in mind in these discussions when people complain about them. 8-character alphanumeric passwords protected by crypt aren't exactly good these days either, but auth tech moved on even as tech benefitted attackers. In the future biometrics will undoubtedly consider far more than our current early generation systems, up to and including implants. FWIW, I have (more rarely) seen a few other classes of factor suggested that do make sense, and are arguably distinct categories. One is spatiotemporal, ie., "somewhere/somewhen you are". This is used de facto by any sort of air gapping or "this system can only be accessed from this one place and console" or the like. It could though be taken advantage of far more thanks to more ubiquitous high resolution GPS and the like in our systems. Having certain kinds of data only become accessible in the right place/time could be very useful. Another fuzzier category is "something you do", as-in observing the actions you take. I felt at one point that this was merely another way of measuring "something you are", but I can see the idea that it'd be distinct because it's about revealing your direct state of mind, whereas at least for the foreseeable future "something you are" tends to focus on more bulk matter aspects of your being. Technically state of mind is physical too, there is a specific vector state of axons and neurons and firing patterns that represent it, but it might make sense still to distinguish that from physical body structure or even implants. Whatever the case though it's still an interesting consideration, and makes a lot of sense in old school counterops. Sometimes the first sign of someone who "shouldn't be authenticated to use this" has been "they were 'acting funny'" after all.
invalidusernam3 7y ago
I can read your username once and remember it. I can't do the same with a fingerprint
- jcranberry 7y ago
  Depends on the username. And you don't have your username written on your body.
- pennaMan 7y ago
  I'm sure you can produce a hash from fingerprint model data for your reading pleasure
  - djsumdog 7y ago
    OpenSSH does that thing now where it can visually display ASCII art of your key fingerprint.
- rhizome 7y ago
  That's not dispositive, you also can't dust for names.

deleted 7y ago

[deleted]

TheLML 7y ago

Modern fingerprint readers rely on the conductivity of your finger, so a cut off finger (or the finger of a dead person) can't per se unlock a phone.

immad 7y ago
A dead persons skin is still conductive.
- Laforet 7y ago
  There are better ways to detect whether the finger is still attached to a live person. https://www.newscientist.com/article/mg21128225-100-fingerprint-scanner-to-spot-the-living-dead/ https://www.newscientist.com/article/mg21128225-100-fingerpr... Nevertheless it probably won't ever be completely reliable short of installing a hypodermic needle with the sensor to take a blood sample every time :)
  - war1025 7y ago
    Was it GATTACA where the main character used a prosthetic thumb add-on to fool the blood check every day on his way in to work?
    - djsumdog 7y ago
      Yep, fake hair samples and fake blood patches under the skin. There was a lot of detail written into that movie.
      - rhizome 7y ago
        Andrew Niccol is so good!
    - covercash 7y ago
      And Demolition Man where he used an eyeball on a pen to fool the optical scanner.

botwriter 7y ago

found this out the hard way with a paranoid ex. now I just use the 8 digit pin to login

rpmisms 7y ago
I'm slightly curious as to which of the GP's options you found out the hard way. I truly hope you still have your fingers.
- botwriter 7y ago
  Passed out and the ex-girlfriend used my finger on my phone to unlock it.
  - kd913 7y ago
    What makes you think a ex-girlfriend wouldn't be paranoid enough to look over at an 8-digit passcode or pattern?
    - rpmisms 7y ago
      Personally, I don't date anyone I don't trust with my passwords, work excluded, of course. Works out pretty well for me.
      - PostPost 7y ago
        How do you know if you can trust someone that way without dating them in the first place? Only date people you've been friends with for several years?
        rpmisms 7y ago
        Yes, actually.
      - idoh 7y ago
        I'm curious about this - is there some formal unveiling of passwords as a relationship milestone? Or does it just come up naturally, like, "I need to log into your gmail account, what's your password?"

floatinthecloud 7y ago

Yes