4 ms·

Somebody stealing your phone will likely be able to retrieve fingerprints from it? Maybe it is too much for a random thief. But what if there are "factories" fo

Somebody stealing your phone will likely be able to retrieve fingerprints from it? Maybe it is too much for a random thief. But what if there are "factories" for treating stolen phones, and random thieves just sell the phones to those factories? (Not saying that happens, but it seems likely to me that such things will eventually exist - down to trying to retrieve bank codes from stolen computers and phones and trying to exploit them).

acdha 5y ago
A stolen phone has hashes, not scans – if memory serves, there were a couple of old Android phones which saved the images but even that was a developer’s mistake leaving logging on rather than the design. The sensible approaches for biometrics use them to unlock strong keys which never leave the device. If implemented correctly, this is somewhat resistant to offline brute-force attacks — certainly not impossible but not economical for going after most people.
- kkjjkgjjgg 5y ago
  I meant retrieve actual physical fingerprints that are on the phone, not digital scans of fingerprints. So if you use fingerprints to unlock your phone, and a dedicated attacker steals your phone, they could create fake finger prints from the prints you left on the phone (as surely you do touch your phone), and use them to unlock your phone.
  - acdha 5y ago
    That also doesn't work with any modern design: you don't leave a 3-D structure behind on the reader, and usually they're coated in a way which means that you don't even leave much of a print. As another way to look at it, people have been spending considerable time attacking these sensors since they were first released. If it was that easy, you wouldn't see the academic attackers going to such lengths.
    - kkjjkgjjgg 5y ago
      I would expect the academic attackers being interested in other aspects than the criminal attackers. How 3d is a fingerprint - do the sensors really measure the depth of the creasing, and it is a significant distinguishing factor? I think there are plenty of places to leave a print. For example my slim and elegant smartphone is covered with a "protector case" which probably doesn't have such a sophisticated coating.

acdha 5y ago

A stolen phone has hashes, not scans – if memory serves, there were a couple of old Android phones which saved the images but even that was a developer’s mistake leaving logging on rather than the design. The sensible approaches for biometrics use them to unlock strong keys which never leave the device. If implemented correctly, this is somewhat resistant to offline brute-force attacks — certainly not impossible but not economical for going after most people.

kkjjkgjjgg 5y ago
I meant retrieve actual physical fingerprints that are on the phone, not digital scans of fingerprints. So if you use fingerprints to unlock your phone, and a dedicated attacker steals your phone, they could create fake finger prints from the prints you left on the phone (as surely you do touch your phone), and use them to unlock your phone.
- acdha 5y ago
  That also doesn't work with any modern design: you don't leave a 3-D structure behind on the reader, and usually they're coated in a way which means that you don't even leave much of a print. As another way to look at it, people have been spending considerable time attacking these sensors since they were first released. If it was that easy, you wouldn't see the academic attackers going to such lengths.
  - kkjjkgjjgg 5y ago
    I would expect the academic attackers being interested in other aspects than the criminal attackers. How 3d is a fingerprint - do the sensors really measure the depth of the creasing, and it is a significant distinguishing factor? I think there are plenty of places to leave a print. For example my slim and elegant smartphone is covered with a "protector case" which probably doesn't have such a sophisticated coating.