5 ms·

I think you mean the worst case scenario for a fingerprint is that it's a username.

by ses1984 7y ago

nolok 7y ago
I think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.
- ses1984 7y ago
  A wee bit of motivation, hah, are you James Bond or something? Usernames can be guessed remotely, fingerprints can't really. Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
  - josefx 7y ago
    The CCC went after a German politician to show just how easily you could copy a fingerprint even without access to an object touched by the target[1]. A few pictures of the finger are more than enough. [1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerprints-public-photos/ https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...
    - Wowfunhappy 7y ago
      How do you actually use the picture of the fingerprint to get into a phone? It doesn’t accept pictures, only fingers.
      - et-al 7y ago
        From the NewScientist article Laforet linked above: > fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland. Replace silicone with some other flesh-like material that's conductive.
        ses1984 7y ago
        Ok but isn't that significantly more trouble than seeing or guessing a username? Does this take just a "wee bit of motivation"?
      - petschge 7y ago
        Print with a laserjet onto overhead projector foil, spread a suitable kind of wood glue, dry, peel and apply to own finger tip. It is actually very straight forward.
      - josefx 7y ago
        This video[1] is German, however as far as I can tell everything you need to get from an image to a fake print is easily available. The relevant part starts at 65 seconds. Only a few minutes to get a working fake. It is basically the process described by petschge. [1] https://youtu.be/OPtzRQNHzl0?t=65 https://youtu.be/OPtzRQNHzl0?t=65
- petschge 7y ago
  What I meant is: you can not change it and you can not keep it secret so it makes a poor password replacement. Usernames do not have to kept secret (you know that my username on HN is petschge), so finger prints might be slightly more usable as usernames than they are as passwords. They are of course not great for that either. Their best use might be similar to the "card present verifier" on the back of a credit card, i.e. as a sign that the person who entered they username, they password (and possibly a physical auth token like a chip card) is actually present themselves. Or don't use fingerprints at all. They are not secure nor convenient as you think.
  - blotter_paper 7y ago
    I agree with this, but think that faces face the same issue. If anything, we leave our faces more places than our fingerprints; fingerprints smudge over time, but faces are big enough to capture at sufficient detail using cameras that are already widely deployed. iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles. I would really like biometrics to work, verifiable proof-of-human would be great, but I can only buy into them as an additional requirement for authentication; a piece of privately known/held information is still our most secure authentication mechanism for competent users.
    - petschge 7y ago
      You are right. But note that I never said that faces where any better.
      - blotter_paper 7y ago
        True that, I didn't mean to imply otherwise; I just thought your comment was the most coherent rebuking of fingerprints I'd seen so far while skimming, and I thought it would be a good place to expand on your sentiments with my own thoughts. I do see how my opening "but" could be confusing in this regard.
    - saagarjha 7y ago

I think you mean the worst case scenario for a fingerprint is that it's a username.

I think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.

ses1984 7y ago
A wee bit of motivation, hah, are you James Bond or something? Usernames can be guessed remotely, fingerprints can't really. Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.
- josefx 7y ago
  The CCC went after a German politician to show just how easily you could copy a fingerprint even without access to an object touched by the target[1]. A few pictures of the finger are more than enough. [1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerprints-public-photos/ https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...
  - Wowfunhappy 7y ago
    How do you actually use the picture of the fingerprint to get into a phone? It doesn’t accept pictures, only fingers.
    - et-al 7y ago
      From the NewScientist article Laforet linked above: > fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland. Replace silicone with some other flesh-like material that's conductive.
      - ses1984 7y ago
        Ok but isn't that significantly more trouble than seeing or guessing a username? Does this take just a "wee bit of motivation"?
    - petschge 7y ago
      Print with a laserjet onto overhead projector foil, spread a suitable kind of wood glue, dry, peel and apply to own finger tip. It is actually very straight forward.
    - josefx 7y ago
      This video[1] is German, however as far as I can tell everything you need to get from an image to a fake print is easily available. The relevant part starts at 65 seconds. Only a few minutes to get a working fake. It is basically the process described by petschge. [1] https://youtu.be/OPtzRQNHzl0?t=65 https://youtu.be/OPtzRQNHzl0?t=65
petschge 7y ago
What I meant is: you can not change it and you can not keep it secret so it makes a poor password replacement. Usernames do not have to kept secret (you know that my username on HN is petschge), so finger prints might be slightly more usable as usernames than they are as passwords. They are of course not great for that either. Their best use might be similar to the "card present verifier" on the back of a credit card, i.e. as a sign that the person who entered they username, they password (and possibly a physical auth token like a chip card) is actually present themselves. Or don't use fingerprints at all. They are not secure nor convenient as you think.
- blotter_paper 7y ago
  I agree with this, but think that faces face the same issue. If anything, we leave our faces more places than our fingerprints; fingerprints smudge over time, but faces are big enough to capture at sufficient detail using cameras that are already widely deployed. iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles. I would really like biometrics to work, verifiable proof-of-human would be great, but I can only buy into them as an additional requirement for authentication; a piece of privately known/held information is still our most secure authentication mechanism for competent users.
  - petschge 7y ago
    You are right. But note that I never said that faces where any better.
    - blotter_paper 7y ago
      True that, I didn't mean to imply otherwise; I just thought your comment was the most coherent rebuking of fingerprints I'd seen so far while skimming, and I thought it would be a good place to expand on your sentiments with my own thoughts. I do see how my opening "but" could be confusing in this regard.
  - saagarjha 7y ago