4 ms·

A fingerprint reader is probably more secure, but actually wouldn't solve the "smudge" problem. You've most likely left latent prints all over your phone. The

by lawtguy 15y ago

A fingerprint reader is probably more secure, but actually wouldn't solve the "smudge" problem. You've most likely left latent prints all over your phone. These can be used pretty easily to create a fake finger that would probably fool the sensor. Additionally, the history of swipe sensors in laptops is a mixed bag as far as this sort of solution goes. They are in almost all laptops, but almost no one actually uses them. Most people perceive them as too much of a hassle compared to the standard username/password setup. Maybe if phones start holding data that people value more (like digital money) they'd be willing put up with the additional work of using the sensor. The ultimate solution would probably be something that grabs the biometric data without the user having to do anything special. This would make it easier to use and more secure. Apple actually already has a patent on this: http://www.engadget.com/2009/03/27/recent-apple-patent-filing-speaks-of-stealth-biometric-security/ http://www.engadget.com/2009/03/27/recent-apple-patent-filin...

27182818284 15y ago
> These can be used pretty easily to create a fake finger that would probably fool the sensor. At this point aren't all bets off? If a person is willing to do that, I would think they'd also be willing to disassemble the phone and extract the information that way. You would need a sort of whole-disk encryption too.
- dfox 15y ago
  Main problem with any kind of biometric authentication is that it cannot be used as basis for generating encryption keys (eg. for whole disk encryption). Because in that case it's totally irrelevant if you can fool the sensor, you just have to process somehow "stolen" biometric data in same way as the sensor (+ encryption software) does. For other authentication applications, all security lies in fact that it's not possible (for reasonable values of "possible") to fool the sensor or bypass it. But most commonly used fingerprint scanners are incredibly easy to fool (even including so called "high-security" sensors that happily accept photocopy of fingerprint as valid finger). Bypassing the sensor is often even easier, but on the other hand I've seen systems (for example BIOS level fingerprint authentication on ThinkPads) that are explicitly designed as to make that very expensive (in the ThinkPad case you would have to actually decapsulate the sensor chip from it's package).

by lawtguy 15y ago

27182818284 15y ago

> These can be used pretty easily to create a fake finger that would probably fool the sensor. At this point aren't all bets off? If a person is willing to do that, I would think they'd also be willing to disassemble the phone and extract the information that way. You would need a sort of whole-disk encryption too.

dfox 15y ago
Main problem with any kind of biometric authentication is that it cannot be used as basis for generating encryption keys (eg. for whole disk encryption). Because in that case it's totally irrelevant if you can fool the sensor, you just have to process somehow "stolen" biometric data in same way as the sensor (+ encryption software) does. For other authentication applications, all security lies in fact that it's not possible (for reasonable values of "possible") to fool the sensor or bypass it. But most commonly used fingerprint scanners are incredibly easy to fool (even including so called "high-security" sensors that happily accept photocopy of fingerprint as valid finger). Bypassing the sensor is often even easier, but on the other hand I've seen systems (for example BIOS level fingerprint authentication on ThinkPads) that are explicitly designed as to make that very expensive (in the ThinkPad case you would have to actually decapsulate the sensor chip from it's package).