32 ms·

Fingerprints can be hacked

792 points by SerCe 5y ago

gumby 5y ago
> while your fingerprint is unique to you, Has this been proven to some degree or is it merely a conjecture. I suppose by now, governments have collected enough fingerprints to pretty much confirm this, but I haven’t seen any studies.
the_arun 5y ago
Using same idea, could’t AI generate FaceId from videos?
- lordnacho 5y ago
  Sounds likely. When you train FaceID you are filmed. What's to stop someone from using film of you giving a speech? At best the biometric locks are like locks on your house. Stops most people but not someone really determined.
  - cool_scatter 5y ago
    It uses an IR camera as a proximity sensor. A video isn't good enough. You would need AI to construct an accurate 3D model of the face based on it.
    - lordnacho 5y ago
      Yes that's what I meant, someone could construct the necessary biometrics from a video and some ML.
- acdha 5y ago
  FaceID is more complicated: it uses an infrared camera and projects an array of dots on your face so the problem wouldn't just be generating a realistic video of a face but more along the lines of constructing a mask which would have similar 3D structure including how it reflects infrared light.
deleted 5y ago
[deleted]
1cvmask 5y ago
My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)
- newsbinator 5y ago
  > Spiegel also reported another security hole from the conference: reading a user's PIN code from reflections in their pupils while taking selfies. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens...
  - Cd00d 5y ago
    I don't understand this one - when are people taking a selfie at the same time they're typing in their pin? I have an android phone, and I don't even unlock to take pictures. I just don't follow the timeline and geometry. Seems theoretical only maybe.
    - voakbasda 5y ago
      Take a selfie with someone unlocking their phone positioned over your shoulder. Seems very practical and surreptitious.
    - LocalH 5y ago
      Reflections of the fingerprint marks on the screen that are usually present for those who don't regularly wipe their screen off?
    - ARandomerDude 5y ago
      It's badly worded in the article but I think it means person A is entering his pin. Persons B, C, D, etc. take selfies in the vicinity of person A. By comparing multiple selfies from sightly different times, you can determine person A's pin.
SEJeff 5y ago
Fingerprints are usernames, not passwords. Here is an excellent (and timeless) post on this fact: https://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...
- darkwater 5y ago
  I always thought that since the beginning, but unfortunately the world went into another direction. People always said "something you have and something you know", but now for most cases it's just "something you have - your body". Obviously if in the future remote mind-readers are invented, the "something you know" part will also get obsolete, but for now we should stick to it.
  - braincoke 5y ago
    I believe it's - Something you have (key, device,...) - Something you know - Something you are (biometry) In Europe there is a regulation (PSD2) that defines a strong authentication as 2 of the 3 listed above.
    - amalcon 5y ago
      I've always disliked this breakdown. My body is something I have -- it's just potentially (not always practically -- see the article) more difficult to clone or otherwise use without my consent than a key fob or something. Edit: To be clear, I don't think this is an argument for biometrics, but rather an argument against them. They can't complement something I have in a two factor scheme, because my biometrics are something I have.
      - jagged-chisel 5y ago
        But it's the parts that are easily forgeable (fingerprints, retinas, etc) that are being relied upon. By "forgeable" I mean "things that someone else can also have by creating copies." I don't think we have yet good metrics on how to detect specific individuals using a full-body scan. Not to mention the invasiveness of creating your personal initial dataset. Most folks won't stand for it. So right back to parts that are forgeable...
delineator 5y ago
> you leave your fingerprint on taxi doors, iPhone screens, and glasses of wine at your local restaurant. DNA is similar - you leave hairs in taxis, public toilets, etc.
m00dy 5y ago
Do you think that a 3d printer can replace the whole process ?
- gruez 5y ago
  It probably lacks the resolution to do it. That said, why do you want that when a 2d printer works fine?
  - Workaccount2 5y ago
    Only optical scanners would be fooled, capacitive and ultrasonic readers actually read the 3D ridges of your finger.
    - gruez 5y ago
      The 3d ridges from the 2d printer comes from the raised lettering, which is transferred to the dried acetate glue.
  - resoluteteeth 5y ago
    FDM printers probably don't have a high enough resolution, but I wonder if new high resolution resin printers like the phrozen sonic 8k mini ($600) have a high enough resolution to do it.
voidmain 5y ago
Biometrics are not secrets (it must be assumed that attackers always possess all biometric data), but they can nevertheless be a good form of authentication when combined with situational awareness. If you try to use one of these hot glued fingerprints in front of a security guard, it isn't going to go well for you. At the moment, humans are still necessary for situational awareness, but probably machines can get there pretty soon. A phone, for example, that monitors its surroundings continuously and has enough intelligence to reliably distinguish normal access by its owner from duress or the presentation of fake biometrics seems like it's within reach of current technology (though it doesn't actually exist).
- capitainenemo 5y ago
  You think the typical security guard would notice a print if it was glued on the finger? At workplaces I've worked at in the past they weren't watching the flow of traffic through the gate all that carefully...
  - joenathanone 5y ago
    Additionally a little social engineering would get right past an attentive guard, just strike up a little small talk to distract their attention.
  - acdha 5y ago
    I think this depends on how well they do liveness tests: it's expensive to have guards checking everyone's hands (but certainly not prohibitively so if you have that level of threat) but it'd be a lot cheaper if your sensors are fairly good at raising an alarm to attract scrutiny.
- jbaczuk 5y ago
  I bet you could make one that looks like part of your skin pretty easily.
sparkling 5y ago
This should not be news to anyone. Chaos Computer Club demonstrated almost the same technique in this 2006 video https://www.youtube.com/watch?v=OPtzRQNHzl0 https://www.youtube.com/watch?v=OPtzRQNHzl0
- rvz 5y ago
  Yeah, this isn't new. It's just cheaper.
  - deleted 5y ago
    [deleted]
- hannob 5y ago
  Exactly, just wanted to link this as well. There's of course nothing wrong with pointing out already known security flaws, but it's good practice to mention when this is a well known thing and reference prior work - which the post by kraken does not do.
- say_it_as_it_is 5y ago
  MacGyver did it in the 80s
zeven7 5y ago
Is modern facial recognition any better or is it also considered bad to use for anything sensitive?
- rei_ayanami 5y ago
  That would also be username like one other user mentioned. Not passwords.
  - zeven7 5y ago
    I know that's something people say, but that doesn't actually give me the information I need to be informed about how secure or insecure it is and how hard it is to bypass.
immmmmm 5y ago
in biometrics this is called a Presentation Attack (PA), here the fake fingerprint is the analog of presenting a photograph, video or 3dp mask to a face recognition system. this is usually mitigated by the use of Presentation Attack Detection (PAD) systems, either hardware, software or hybrid. in this particular case it can easily be mitigated by some hardware that measures the amount of water in the biometric sample, for instance capacitive sensor, transparent conductive electrodes or maybe even better some optical sensor that is sensitive to SWIR wavelengths reflectivity differences (1000 and 1200 nm would be great here). a short scholar search will indeed reveal that this is a very active area of research, and probably will reveal tens of papers from our group which is a leader in this.
- newsbinator 5y ago
  Would this be foiled by a latex glove printed with that fingerprint and worn to scan in?
  - immmmmm 5y ago
    the capacitive one yes probably, the two other i doubt it. sure you can always use a conductive coating as well as a material that mimic optical propreties of skin. the question is not IF a system will be spoofed, the question is WHEN.
- kspacewalk2 5y ago
  For devices like phones and laptops, this sounds too complicated. Why not instead just use passwords, patterns, etc? I doubt anyone who's genuinely sensitive about their device being secure uses biometrics to unlock it anyway, so this seems to be just a convenience feature for the casual user with minimal security concerns. As such, making it more complicated doesn't seem worth it. And if we're talking about authenticating people in truly secure environments, my gut tells me that adding a couple more factors to even a simple fingerprint reader ought to be more secure and robust than making a super-complicated fingerprint reader and leaving it as the only factor.
- deleted 5y ago
  [deleted]
evancoop 5y ago
The broader argument here is less about fingerprints, and more about using anything immutable as authentication. You cannot change your fingerprints. You cannot change your social security number (at least not easily). These should therefore, NEVER be a primary method to authorize access to anything. Once stolen, the proverbial horse is out of the barn.
- h2odragon 5y ago
  You can in fact change your fingerprints; glassblowing and metalwork, for example, offer numerous opportunities to do so.
  - Joker_vD 5y ago
    Don't they regenerate? I vaguely recall reading that criminals have tried lots of surgical ideas but none would last longer than a couple of months.
    - h2odragon 5y ago
      if they do you're not burning deep enough I dunno, I have psoriasis on my hands bad enough that sometimes i dont properly speaking have skin on some fingertips, so my experiences aren't normal. I recall hitting someones' demo of the "first PAM integrated fingerprint ID system" in '98 and crashing their machine repeatedly with my thumb. It couldn't even scan me.
- TheJoeMan 5y ago
  It would be funny to use this technique to make fake fingerprints that are used as the keys. “Hardware key on MBP!”
scott00 5y ago
The method in the article required an hour of photoshop work. Anybody know how much expertise is required for that step?
ruph123 5y ago
The uniqueness of fingerprints is also questionable. e.g.: https://mathblog.com/are-fingerprints-unique/ https://mathblog.com/are-fingerprints-unique/
- lordnacho 5y ago
  One thing that's never been explained to me is how large the space is. Does everyone have one big swirl on their thumb that goes clockwise or counter-clockwise? Could you have two swirls? What is the space of potential fingerprints?
  - JohnFen 5y ago
    Fingerprint scanners compile a small set of identifying features (typically where ridges end or split). They don't characterize the entire fingerprint. The higher quality the scanning system, the more identifying features they use -- so the size of the search space is both smaller than most people think, and varies depending on the quality of the system.
101_101 5y ago
humm cheaper than a rubber hose, but too slow.
thomascgalvin 5y ago
Biometrics have both a high False Acceptance Rate - they will accept invalid input - and a high False Rejection Rate - they will deny valid input. Scanners can be tuned one way or the other, preferring FAR or FRR, but either way, they are kind of unreliable. This is why multi-factor authentication is a thing. Generally, pick two: something you have, something you know, or something you are. If the scanner doesn't like your fingerprint this morning, just use your proximity badge instead, and if someone takes a photo of your fingerprint, it's still useless unless they also know your PIN. The issue is that a lot of our hardware, particularly phones and laptops, is single-factor authentication. And on top of that, this hardware knows the login to a bunch of other very sensitive material, like your bank accounts.
kingcharles 5y ago
Also remember, in the USA, the police can legally force your finger onto a reader to defeat the lock, without violating your 5th Amendment right against self-incrimination.
- _justinfunk 5y ago
  Remember (on an iPhone) you can squeeze the power button and one of the volume keys for a few seconds. This disables biometric authentication until a passcode is entered. This can protect you against this "attack vector".
  - kingcharles 5y ago
    It can protect you, but as I experienced, if you have your phone in your pocket and a government agent puts a loaded gun to your head and tells you not to move then you can't access this feature...
GuB-42 5y ago
No, the fingerprints are not hacked. The MacBook Pro scanner is. Fingerprints and biometrics in general are not a secret. Consider your fingerprint like your face. Anyone can reproduce your face, there are cameras everywhere, and it is probably already easy to find on the internet. "Hacking" your face by taking a picture is the most boring "hack" ever. Now, if I print your face on a piece of paper, wear it as a mask and try to say to a security guard that I am you, normally, he won't let me in. If he does, the problem is not that I managed to make a paper mask with a picture of you, this will always be possible, the problem is that your guard is stupid and you need a better one. And if your fingerprint scanner can be fooled by a dab of glue and a laser printer, you probably need a better scanner, something that Apple should be able to do. Smartphone manufacturers like Apple are usually good at bringing fancy tech to the masses, and they could work on defeating these old attacks.
- CountDrewku 5y ago
  Eh... fingerprints are quite a bit simpler than faces. They're just patterns. I don't know how you could detect a fake fingerprint. You'd need something that could tell there wasn't real skin on the device. I would say warmth but obviously he has the fake skin over his actual thumb so it's probably still warm.
  - GuB-42 5y ago
    Yes, I really meant fake fingers, not just fake fingerprints. And there is plenty of research on that subject. Possible ways of detecting a fake fingerprint (beside warmth): - Blood (we could use one of these cheap SpO2 sensors) - Capacitance - Perspiration and related skin resistance - Microscopic skin details And the usual machine learning solution of feeding thousands of real and fake fingerprints to a neural network and letting it decide. As all living things, fingers are far from simple, there are plenty of details beyond the obvious pattern. It is a bit like a banknote, you can photocopy a banknote and it is very east to identify the banknote you copied. But it is very hard to pass it off as a real one to someone who knows where to look.
krzyk 5y ago
OK, so here goes fingerprint scanner on phones that some thought is more secure than Face Unlock and similar.
scottLobster 5y ago
Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway. For your average everyday person fingerprint security is fine. The thief who snatches your phone when you step away from your table in the mall food court isn't going to be able to crack it via this method.
- Transisto 5y ago
  The problem is that none of the major OS seems to allow for multiple factor authentication.
- xoa 5y ago
  Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole different and enormously scarier/more challenging threat scenario. >Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. Isn't that genuinely getting pretty trivial in public though? And in turn I think that is a real argument for biometrics too. The amount of over-the-shoulder camera surveillance in business and urban areas is pretty scary at this point, as are the concealability and cheapness of even very tiny spy cams. There have been plenty of scandals around it even in things like AirBNBs or hotels, historically from the context of sex, but not a stretch to imagine that passwords could be a much bigger and more lucrative target. And ML/AI is getting ever more sophisticated, and humans entering PINs/passwords is pretty repetitive behavior with a high degree of uniformity in how it's done, at least the device-unlock level. Seems very amenable to highly reliable automated analysis, to the extent I'd be genuinely surprised if that's not secretly deployed already in surveillance states. I don't enter PINs/passwords in public anymore if I can possibly help it. It just seems scalable in a way that physical attacks aren't.
theandrewbailey 5y ago
Don't forget to change your fingerprints, face, and mother's maiden name regularly.
jeroenhd 5y ago
Biometrics are great for authentication but terrible for authorization. Anything sensitive should require both. There's nothing wrong with a fingerprint and a password or a fingerprint and an RFID card as an authorization/authentication pair; you just have to keep these things in mind. I've fallen to the laziness of using fingerprints on my devices as well, but they still require a password to decrypt the contents of the storage device on boot. For many, if not most, threat models, this is perfectly fine. I lock my phone to prevent people with messing with my contacts and scrolling through my messages. It's an inconvenience to bypass that requires preparation. A motivated attacker would just as easily spy over my shoulder if I were to use a password, either on my phone or on my laptop. I look at these mechanisms like the lock on a teenager's bedroom door. Those things aren't impenetrable and anyone with just a little lockpicking experience or access to some automated tools can open them in a minute. Unlike the locks on our front doors, built to keep intruders that don't want to risk physical damage to our windows out, they're a message: please don't violate my privacy. Violating that privacy is made moderately difficult by the mechanism itself, but it's hardly impossible. Unless you carry a password-protected authentication and key management token with you at all times, you're at risk of having your system broken into. Most of us don't need to worry about those kinds of things.
- krisrm 5y ago
  This doesn't make sense to me. In what use-cases do we use our personal computers authenticated but also unauthorized?
- hartator 5y ago
  > Biometrics are great for authentication but terrible for authorization What does that mean? Unlocking your MacBook gives access to your RSA keys and all is lost.
  - blakesley 5y ago
    As the other commenter pointed out, he probably meant "great for identification but terrible for authentication".
  - 5y ago
no_time 5y ago
By "laser printer" do they mean regular office printer or laser engraver? It's a bit hard to believe that the super thin layer of black paint produces an imprint thats significant enough for this to work.
afrcnc 5y ago
Known since 2007: https://twitter.com/Makdaam/status/1462800634197987329 https://twitter.com/Makdaam/status/1462800634197987329
webel0 5y ago
[edit for clarity] As someone who doesn’t specialize in security, one claim that has stood out to me for not using fingerprints is that you can't run bcrypt (or some other salting algorithm) on fingerprints [1]. I don’t see any discussion of that here thus far. Is that still the case? I feel like I would have heard about developments in this area if something had changed. But perhaps I've always misunderstood the criticism? [1] https://www.rsaweb.co.za/fingerprint-security-fingerprints-are-not-safe/ https://www.rsaweb.co.za/fingerprint-security-fingerprints-a...
- tantalor 5y ago
  Says who?
  - webel0 5y ago
    Thanks for your comment. I have updated mine to include a reference. In short, I'm thinking about how fingerprints are stored.
- cool_scatter 5y ago
  Fingerprints are stored as data, and data is hashable. As someone who doesn't know the ins and outs of fingerprint readers, that sounds ludicrous. I also don't see why it would need to be hashed, however.
  - webel0 5y ago
    Thanks for your comment. I have updated my comment to try to be more precise.
daneel_w 5y ago
People commonly mistake biometrics for authentication; they are only shallow identification.
gannon- 5y ago
Could a similar concept apply to face-id passwords? What's stopping face-ID spoofing?
albert_e 5y ago
How about .... Fingerprint sensors + inbuilt IR sensors that verify that there is a "live" finger with blood and pulse behind that print. Would that help make FP authentication more robust?
- Spivak 5y ago
  Yes, if you're interested in this kind of stuff you basically have to work for the military because they're the only ones with the funding and motivation for this kind of stuff.
  - draugadrotten 5y ago
    Check out the LivDet - Liveness Detection Competitions - https://livdet.org/index.php https://livdet.org/index.php
trulyme 5y ago
The biggest problem imho is that we only have two states on our phones - locked and unlocked. Ideally, I should be able to unlock the phone and take photos using just my fingerprint. In my case I would also like to be able to call, message, play games and similar. But to access the 2fa app, cryptoasset app or similar, I must further authenticate in a way that I only reveal parts of my secret ("Enter 3rd, 8th and 11th character of your password:"). The assumption here is that I will mostly authenticate in a private setting, but sometimes I might not have that luxury.
- cblconfederate 5y ago
  "now place your left index, then your right pinky" etc.
- Labo333 5y ago
  Nice concept! It made me realize this is the purpose of PINs for some apps (eg Signal)
- menage 5y ago
  On Android (don't know about iOS) you can take photos without even unlocking - double press on the power button opens the camera. You can't access anything else (including existing photos in the camera roll).
  - redler 5y ago
    It works the same way on iPhones. The lock screen includes a camera button. When tapped, the phone enter a camera-only mode in which only photos taken during that session are accessible.
    - newscracker 5y ago
      You can also swipe the right on the screen to open the camera instead of pressing the camera button on the screen.
  - abletonlive 5y ago
trident5000 5y ago
24 hour fitness wanted my fingerprints to check into their gym. I had to explain to multiple employees why that was never going to happen.
m3kw9 5y ago
Biometrics is almost like security thru obscurity.
- fortuna86 5y ago
  I'd say it's a slight step up.
louissan 5y ago
James, is that you? https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Ftse4.mm.bing.net%2Fth%3Fid%3DOIP.8r8YKoDAPDASoPnV9Gb3agHaEA%26pid%3DApi&f=1 https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2F...
Sohcahtoa82 5y ago
Is anyone surprised by this? I've been telling my friends for a couple years now that unlocking via fingerprint is a convenience feature, not a security feature.
- deleted 5y ago
  [deleted]
cblconfederate 5y ago
i guess faceid should be even easier since u can recreate a face from a few public photos. Plus the good thing about fingerprints is that most people have learned from movies+tv that fingerprints are not secret and can be faked
grifball 5y ago
Myth busters did this: https://m.youtube.com/watch?v=MAfAVGES-Yc https://m.youtube.com/watch?v=MAfAVGES-Yc ?13? Years ago?
fukpaywalls2 5y ago
Well, they definitely can be hacked off
kartoshechka 5y ago
2FA can be bamboozled too, given that SMS is kinda a security joke
legrande 5y ago
Anyone else see this technique a few times in heist movies? I always knew it could be done, but having a blogpost detailing how to do this is is pretty cool.
cmaggiulli 5y ago
Fingerprints are usernames, not passwords
rogelin 5y ago
Firgerprints are usernames, not passwords.
rStar 5y ago
apple: use your fingerprint … gov: fingerprints are fungible … apple: use your eyeball then!
dxf 5y ago
The huge advantage of biometrics (fingerprints, FaceID, etc.) is the ease with which a user can unlock their phone. A passcode may be better than a fingerprint, but a fingerprint+longer passcode is better than a shorter passcode (or no passcode at all). Having a 12 character alphanumeric passphrase you enter each time you want to unlock is not something most users want to do. See e.g.: https://www.businesstoday.in/technology/news/story/what-kicked-off-touchid-innovation-apple-explains-in-200-page-report-288765-2021-02-19 https://www.businesstoday.in/technology/news/story/what-kick... Only about 49 per cent of the users were setting a passcode, which meant that the remaining 51 per cent were not benefiting from the data protection mechanism. When Apple dug in to understand the reason, the findings revealed that users unlock their devices a lot - on an average about 80 times a day. And about half of its users simply didn't want the inconvenience of having to enter their passcode into their device, at times. At that time, in 2012-2013, the default passcode length for iPhone was four digits, which happens to be six today. Apple realised that it needed to come up with a mechanism that's fast and secure, and doesn't involve typing in the passcode. That's when Apple introduced Touch ID, which was easy, fast and secure. The way that biometric authentication worked on Apple platforms was that the user must set a passcode to be able to use the biometrics. And just as Apple thought, there was a much higher adoption of biometric-based TouchID. Apple says over 92 per cent chose to use Touch ID and had therefore set the passcode, which in turn meant users were able to use Apple's data protection encryption system.
- mdp2021 5y ago
  > The huge advantage of biometrics ... is the ease with which a user can unlock their phone This does not prevent involuntary unlocking - it actually can allow for eased against-will unlocking. «Ease» and security may sometimes not be friends.
  - breser 5y ago
    At least on iPhones though they have a way to activate a mode that prevents the use of TouchID and FaceID. If I press the power button on my phone 5 times in a row that turns that off. Yes I still run the risk of my device being unlocked against my will if I'm caught by surprise. But I'm able to disable this functionality in places where I think the risk of that may be higher, e.g. while traveling. I'll still take the trade off of longer password (not just a few numbers) on my phone while using a biometric test for normal access. Of course not everyone may have the same threats to consider and others may make different choices. Doesn't make either of our choices wrong.
whirlwin 5y ago
So there is a difference here. On local hardware this is not that crucial. But on (portable) software relying on the fingerprint is more severe.
emodendroket 5y ago
Yes. But at a certain point one has to consider how much security is "enough." Someone could break into my house, even when locked, by kicking in the door or breaking a window, but I don't necessarily need to turn it into Fort Knox in response. If you are a high-value target, it is worth thinking about this, but for the average person, I think it might be a reasonable trade-off.
AtNightWeCode 5y ago
As an IT professional you should know to never use fingerprints or facial recognition for logins.
- mdp2021 5y ago
  It seems you are stating that biometrics should not be used to restrict account access according to specific individuals ("John can only access john.harrey and finance.12")
  - AtNightWeCode 5y ago
    Not bio-metrics but passive logons. Retina scanners can detect this I believe. Fingerprints are used by criminals to get access to services. Girl follow guy home. Drug him and then a team uses the fingerprints. May even take pictures to avoid having the person report to the police. It happened here in my city, in western Europe, so it can happen pretty much everywhere.
deleted 5y ago
[deleted]
100c1p43r 5y ago
Well, you just leave your "password" on the device ;)
elias94 5y ago
Have you ever seen the Charlie's Angels movies? They where taking the fingerprints using a beer bottle. Same method but 21 years ago.
paulpauper 5y ago
The big problem with fingerprint is you may void your 5th amendment right
neycoda 5y ago
So it's not easy.
ineedasername 5y ago
The problem with any lock is that, fundamentally, it is made to be opened when certain conditions are met. And that's putting aside any sort of brute force approach. Good security design is as much about asking, from first principles, "what conditions need to be met to open this?" as about considering how it might be attacked. For example, the condition to be met for a pad lock to open is not "when the proper key is inserted" or "the key pins are raised to the appropriate level". It's something more basic-- like "when the locking bar no longer blocks the shackle from rising." From that perspective, attacking the key hole and pins is only one of multiple vectors.
- amelius 5y ago
  Or you just open the lock with a bolt cutter.
  - ineedasername 5y ago
    Thumbprint locks on a laptop won't usefully respond to a bolt cutter. A padlock was just a convenient example. Even then, bolt cutters don't work in the strongest of them: angle grinders are a popular choice in that case, but are a lot more obvious. You can't hide a small angle grind up your coat sleeve and quickly snap the hasp on a bike lock. In any case, the bolt cutters approach is also why I stipulated "putting aside brute force". Because in the context of computer security as with this article, something a bit more subtle seems to be effective more often, especially against higher end security.
p2p_astroturf 5y ago
damn i need more sockpuppet accounts so i can list all my snarky comments: - no shit, use public keys - your 2FA can also be hacked - your company forcing 2FA is insufferable like all modern web - your KYC is literally pointless since i already gave those same ID photos to 100 different companies, few to none of which are competent enough to keep them secret EDIT: huh, this is actually a good article. but it's still ironic since it's coming from a company that follows all the standard snake oil
a-dub 5y ago
i find this whole in-screen fingerprint reader trend to be pretty funny. isn't glass excellent for capturing fingerprints? i suspect biometrics like fingerprints may play a role in the future, but the role they would play is more convenience in cases where the device knows its in a trusted environment. (that is, there will be more attention on devices tracking whether they've been separated from their owner, or if their owner is not behaving like their owner, and if so, requiring additional challenge) either that or we'll all be carrying keys. there are some cool wearables i've seen out there that i think talk nfc.
1vuio0pswjnm7 5y ago
If we had asked people thirty years ago whether a single company, not a police department or other government agency, could, with consent, collect the most human fingerprints in history, would people have been likely to point out various obstacles and/or doubt it was even possible. Further, would they ever agree that these prints could be collected not for employee access to company resources but for access to people's own personal effects! (Company retains remote access to devices storing personal effects.)
- srfilipek 5y ago
  Any good implementation has fingerprint information stored locally, encrypted, and never transmitted off device.
aaronleather 5y ago
these type of things always will be happen till the all gov. will not come together at one platform with strict Punishment like Death penalties for these type of crime (Fingerprints stolen, Rape, Murder...etc)
danielyaa5 5y ago
Isn’t this the point of requiring the password on startup. Seems like enough of a caveat for everyday users
makecheck 5y ago
A fingerprint is a user ID that is usually treated like a password, which is the main problem here. They should add at least a 2nd layer (that doesn’t reduce the convenience too much). For example, people could probably remember a simple Morse-code-like sequence of finger presses, e.g. your extra token is that you set it up to use “tap, tap, longpress, longpress, tap”.
Ayanti 5y ago
We can use fingerprints for additional security, but it has to be done carefully. If fingerprints or any biometric data is hacked, the users can change it, so they have to be contained. The best way I know is to use a mobile device with fingerprint or biometric input, which is saved only on the device. Then use the biometric to enable the user to accept the authentication request but use the mobile device specific info as a password replacement.
Ayanti 5y ago
We can use fingerprints for additional security, but it has to be done carefully. If fingerprints or any biometric data is hacked, the users can not change it, so they have to be contained. The best way I know is to use a mobile device with fingerprint or biometric input, which is saved only on the mobile device. Then use the biometric to enable the user to accept the authentication request but use the mobile device specific info as a password replacement.

792 points by SerCe 5y ago

> while your fingerprint is unique to you, Has this been proven to some degree or is it merely a conjecture. I suppose by now, governments have collected enough fingerprints to pretty much confirm this, but I haven’t seen any studies.

the_arun 5y ago

Using same idea, could’t AI generate FaceId from videos?

lordnacho 5y ago
Sounds likely. When you train FaceID you are filmed. What's to stop someone from using film of you giving a speech? At best the biometric locks are like locks on your house. Stops most people but not someone really determined.
- cool_scatter 5y ago
  It uses an IR camera as a proximity sensor. A video isn't good enough. You would need AI to construct an accurate 3D model of the face based on it.
  - lordnacho 5y ago
    Yes that's what I meant, someone could construct the necessary biometrics from a video and some ML.
acdha 5y ago
FaceID is more complicated: it uses an infrared camera and projects an array of dots on your face so the problem wouldn't just be generating a realistic video of a face but more along the lines of constructing a mask which would have similar 3D structure including how it reflects infrared light.

deleted 5y ago

[deleted]

1cvmask 5y ago

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

newsbinator 5y ago
> Spiegel also reported another security hole from the conference: reading a user's PIN code from reflections in their pupils while taking selfies. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens...
- Cd00d 5y ago
  I don't understand this one - when are people taking a selfie at the same time they're typing in their pin? I have an android phone, and I don't even unlock to take pictures. I just don't follow the timeline and geometry. Seems theoretical only maybe.
  - voakbasda 5y ago
    Take a selfie with someone unlocking their phone positioned over your shoulder. Seems very practical and surreptitious.
  - LocalH 5y ago
    Reflections of the fingerprint marks on the screen that are usually present for those who don't regularly wipe their screen off?
  - ARandomerDude 5y ago
    It's badly worded in the article but I think it means person A is entering his pin. Persons B, C, D, etc. take selfies in the vicinity of person A. By comparing multiple selfies from sightly different times, you can determine person A's pin.

SEJeff 5y ago

Fingerprints are usernames, not passwords. Here is an excellent (and timeless) post on this fact: https://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

darkwater 5y ago
I always thought that since the beginning, but unfortunately the world went into another direction. People always said "something you have and something you know", but now for most cases it's just "something you have - your body". Obviously if in the future remote mind-readers are invented, the "something you know" part will also get obsolete, but for now we should stick to it.
- braincoke 5y ago
  I believe it's - Something you have (key, device,...) - Something you know - Something you are (biometry) In Europe there is a regulation (PSD2) that defines a strong authentication as 2 of the 3 listed above.
  - amalcon 5y ago
    I've always disliked this breakdown. My body is something I have -- it's just potentially (not always practically -- see the article) more difficult to clone or otherwise use without my consent than a key fob or something. Edit: To be clear, I don't think this is an argument for biometrics, but rather an argument against them. They can't complement something I have in a two factor scheme, because my biometrics are something I have.
    - jagged-chisel 5y ago
      But it's the parts that are easily forgeable (fingerprints, retinas, etc) that are being relied upon. By "forgeable" I mean "things that someone else can also have by creating copies." I don't think we have yet good metrics on how to detect specific individuals using a full-body scan. Not to mention the invasiveness of creating your personal initial dataset. Most folks won't stand for it. So right back to parts that are forgeable...

delineator 5y ago

> you leave your fingerprint on taxi doors, iPhone screens, and glasses of wine at your local restaurant. DNA is similar - you leave hairs in taxis, public toilets, etc.

m00dy 5y ago

Do you think that a 3d printer can replace the whole process ?

gruez 5y ago
It probably lacks the resolution to do it. That said, why do you want that when a 2d printer works fine?
- Workaccount2 5y ago
  Only optical scanners would be fooled, capacitive and ultrasonic readers actually read the 3D ridges of your finger.
  - gruez 5y ago
    The 3d ridges from the 2d printer comes from the raised lettering, which is transferred to the dried acetate glue.
- resoluteteeth 5y ago
  FDM printers probably don't have a high enough resolution, but I wonder if new high resolution resin printers like the phrozen sonic 8k mini ($600) have a high enough resolution to do it.

voidmain 5y ago

Biometrics are not secrets (it must be assumed that attackers always possess all biometric data), but they can nevertheless be a good form of authentication when combined with situational awareness. If you try to use one of these hot glued fingerprints in front of a security guard, it isn't going to go well for you. At the moment, humans are still necessary for situational awareness, but probably machines can get there pretty soon. A phone, for example, that monitors its surroundings continuously and has enough intelligence to reliably distinguish normal access by its owner from duress or the presentation of fake biometrics seems like it's within reach of current technology (though it doesn't actually exist).

capitainenemo 5y ago
You think the typical security guard would notice a print if it was glued on the finger? At workplaces I've worked at in the past they weren't watching the flow of traffic through the gate all that carefully...
- joenathanone 5y ago
  Additionally a little social engineering would get right past an attentive guard, just strike up a little small talk to distract their attention.
- acdha 5y ago
  I think this depends on how well they do liveness tests: it's expensive to have guards checking everyone's hands (but certainly not prohibitively so if you have that level of threat) but it'd be a lot cheaper if your sensors are fairly good at raising an alarm to attract scrutiny.
jbaczuk 5y ago
I bet you could make one that looks like part of your skin pretty easily.

sparkling 5y ago

This should not be news to anyone. Chaos Computer Club demonstrated almost the same technique in this 2006 video https://www.youtube.com/watch?v=OPtzRQNHzl0 https://www.youtube.com/watch?v=OPtzRQNHzl0

rvz 5y ago
Yeah, this isn't new. It's just cheaper.
- deleted 5y ago
  [deleted]
hannob 5y ago
Exactly, just wanted to link this as well. There's of course nothing wrong with pointing out already known security flaws, but it's good practice to mention when this is a well known thing and reference prior work - which the post by kraken does not do.
say_it_as_it_is 5y ago
MacGyver did it in the 80s

zeven7 5y ago

Is modern facial recognition any better or is it also considered bad to use for anything sensitive?

rei_ayanami 5y ago
That would also be username like one other user mentioned. Not passwords.
- zeven7 5y ago
  I know that's something people say, but that doesn't actually give me the information I need to be informed about how secure or insecure it is and how hard it is to bypass.

immmmmm 5y ago

in biometrics this is called a Presentation Attack (PA), here the fake fingerprint is the analog of presenting a photograph, video or 3dp mask to a face recognition system. this is usually mitigated by the use of Presentation Attack Detection (PAD) systems, either hardware, software or hybrid. in this particular case it can easily be mitigated by some hardware that measures the amount of water in the biometric sample, for instance capacitive sensor, transparent conductive electrodes or maybe even better some optical sensor that is sensitive to SWIR wavelengths reflectivity differences (1000 and 1200 nm would be great here). a short scholar search will indeed reveal that this is a very active area of research, and probably will reveal tens of papers from our group which is a leader in this.

newsbinator 5y ago
Would this be foiled by a latex glove printed with that fingerprint and worn to scan in?
- immmmmm 5y ago
  the capacitive one yes probably, the two other i doubt it. sure you can always use a conductive coating as well as a material that mimic optical propreties of skin. the question is not IF a system will be spoofed, the question is WHEN.
kspacewalk2 5y ago
For devices like phones and laptops, this sounds too complicated. Why not instead just use passwords, patterns, etc? I doubt anyone who's genuinely sensitive about their device being secure uses biometrics to unlock it anyway, so this seems to be just a convenience feature for the casual user with minimal security concerns. As such, making it more complicated doesn't seem worth it. And if we're talking about authenticating people in truly secure environments, my gut tells me that adding a couple more factors to even a simple fingerprint reader ought to be more secure and robust than making a super-complicated fingerprint reader and leaving it as the only factor.
deleted 5y ago
[deleted]

evancoop 5y ago

The broader argument here is less about fingerprints, and more about using anything immutable as authentication. You cannot change your fingerprints. You cannot change your social security number (at least not easily). These should therefore, NEVER be a primary method to authorize access to anything. Once stolen, the proverbial horse is out of the barn.

h2odragon 5y ago
You can in fact change your fingerprints; glassblowing and metalwork, for example, offer numerous opportunities to do so.
- Joker_vD 5y ago
  Don't they regenerate? I vaguely recall reading that criminals have tried lots of surgical ideas but none would last longer than a couple of months.
  - h2odragon 5y ago
    if they do you're not burning deep enough I dunno, I have psoriasis on my hands bad enough that sometimes i dont properly speaking have skin on some fingertips, so my experiences aren't normal. I recall hitting someones' demo of the "first PAM integrated fingerprint ID system" in '98 and crashing their machine repeatedly with my thumb. It couldn't even scan me.
TheJoeMan 5y ago
It would be funny to use this technique to make fake fingerprints that are used as the keys. “Hardware key on MBP!”

scott00 5y ago

The method in the article required an hour of photoshop work. Anybody know how much expertise is required for that step?

ruph123 5y ago

The uniqueness of fingerprints is also questionable. e.g.: https://mathblog.com/are-fingerprints-unique/ https://mathblog.com/are-fingerprints-unique/

lordnacho 5y ago
One thing that's never been explained to me is how large the space is. Does everyone have one big swirl on their thumb that goes clockwise or counter-clockwise? Could you have two swirls? What is the space of potential fingerprints?
- JohnFen 5y ago
  Fingerprint scanners compile a small set of identifying features (typically where ridges end or split). They don't characterize the entire fingerprint. The higher quality the scanning system, the more identifying features they use -- so the size of the search space is both smaller than most people think, and varies depending on the quality of the system.

101_101 5y ago

humm cheaper than a rubber hose, but too slow.

thomascgalvin 5y ago

Biometrics have both a high False Acceptance Rate - they will accept invalid input - and a high False Rejection Rate - they will deny valid input. Scanners can be tuned one way or the other, preferring FAR or FRR, but either way, they are kind of unreliable. This is why multi-factor authentication is a thing. Generally, pick two: something you have, something you know, or something you are. If the scanner doesn't like your fingerprint this morning, just use your proximity badge instead, and if someone takes a photo of your fingerprint, it's still useless unless they also know your PIN. The issue is that a lot of our hardware, particularly phones and laptops, is single-factor authentication. And on top of that, this hardware knows the login to a bunch of other very sensitive material, like your bank accounts.

kingcharles 5y ago

Also remember, in the USA, the police can legally force your finger onto a reader to defeat the lock, without violating your 5th Amendment right against self-incrimination.

_justinfunk 5y ago
Remember (on an iPhone) you can squeeze the power button and one of the volume keys for a few seconds. This disables biometric authentication until a passcode is entered. This can protect you against this "attack vector".
- kingcharles 5y ago
  It can protect you, but as I experienced, if you have your phone in your pocket and a government agent puts a loaded gun to your head and tells you not to move then you can't access this feature...

GuB-42 5y ago

No, the fingerprints are not hacked. The MacBook Pro scanner is. Fingerprints and biometrics in general are not a secret. Consider your fingerprint like your face. Anyone can reproduce your face, there are cameras everywhere, and it is probably already easy to find on the internet. "Hacking" your face by taking a picture is the most boring "hack" ever. Now, if I print your face on a piece of paper, wear it as a mask and try to say to a security guard that I am you, normally, he won't let me in. If he does, the problem is not that I managed to make a paper mask with a picture of you, this will always be possible, the problem is that your guard is stupid and you need a better one. And if your fingerprint scanner can be fooled by a dab of glue and a laser printer, you probably need a better scanner, something that Apple should be able to do. Smartphone manufacturers like Apple are usually good at bringing fancy tech to the masses, and they could work on defeating these old attacks.

CountDrewku 5y ago
Eh... fingerprints are quite a bit simpler than faces. They're just patterns. I don't know how you could detect a fake fingerprint. You'd need something that could tell there wasn't real skin on the device. I would say warmth but obviously he has the fake skin over his actual thumb so it's probably still warm.
- GuB-42 5y ago
  Yes, I really meant fake fingers, not just fake fingerprints. And there is plenty of research on that subject. Possible ways of detecting a fake fingerprint (beside warmth): - Blood (we could use one of these cheap SpO2 sensors) - Capacitance - Perspiration and related skin resistance - Microscopic skin details And the usual machine learning solution of feeding thousands of real and fake fingerprints to a neural network and letting it decide. As all living things, fingers are far from simple, there are plenty of details beyond the obvious pattern. It is a bit like a banknote, you can photocopy a banknote and it is very east to identify the banknote you copied. But it is very hard to pass it off as a real one to someone who knows where to look.

krzyk 5y ago

OK, so here goes fingerprint scanner on phones that some thought is more secure than Face Unlock and similar.

scottLobster 5y ago

Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway. For your average everyday person fingerprint security is fine. The thief who snatches your phone when you step away from your table in the mall food court isn't going to be able to crack it via this method.

Transisto 5y ago
The problem is that none of the major OS seems to allow for multiple factor authentication.
xoa 5y ago
Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole different and enormously scarier/more challenging threat scenario. >Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. Isn't that genuinely getting pretty trivial in public though? And in turn I think that is a real argument for biometrics too. The amount of over-the-shoulder camera surveillance in business and urban areas is pretty scary at this point, as are the concealability and cheapness of even very tiny spy cams. There have been plenty of scandals around it even in things like AirBNBs or hotels, historically from the context of sex, but not a stretch to imagine that passwords could be a much bigger and more lucrative target. And ML/AI is getting ever more sophisticated, and humans entering PINs/passwords is pretty repetitive behavior with a high degree of uniformity in how it's done, at least the device-unlock level. Seems very amenable to highly reliable automated analysis, to the extent I'd be genuinely surprised if that's not secretly deployed already in surveillance states. I don't enter PINs/passwords in public anymore if I can possibly help it. It just seems scalable in a way that physical attacks aren't.

theandrewbailey 5y ago

Don't forget to change your fingerprints, face, and mother's maiden name regularly.

jeroenhd 5y ago

Biometrics are great for authentication but terrible for authorization. Anything sensitive should require both. There's nothing wrong with a fingerprint and a password or a fingerprint and an RFID card as an authorization/authentication pair; you just have to keep these things in mind. I've fallen to the laziness of using fingerprints on my devices as well, but they still require a password to decrypt the contents of the storage device on boot. For many, if not most, threat models, this is perfectly fine. I lock my phone to prevent people with messing with my contacts and scrolling through my messages. It's an inconvenience to bypass that requires preparation. A motivated attacker would just as easily spy over my shoulder if I were to use a password, either on my phone or on my laptop. I look at these mechanisms like the lock on a teenager's bedroom door. Those things aren't impenetrable and anyone with just a little lockpicking experience or access to some automated tools can open them in a minute. Unlike the locks on our front doors, built to keep intruders that don't want to risk physical damage to our windows out, they're a message: please don't violate my privacy. Violating that privacy is made moderately difficult by the mechanism itself, but it's hardly impossible. Unless you carry a password-protected authentication and key management token with you at all times, you're at risk of having your system broken into. Most of us don't need to worry about those kinds of things.

krisrm 5y ago
This doesn't make sense to me. In what use-cases do we use our personal computers authenticated but also unauthorized?
hartator 5y ago
> Biometrics are great for authentication but terrible for authorization What does that mean? Unlocking your MacBook gives access to your RSA keys and all is lost.
- blakesley 5y ago
  As the other commenter pointed out, he probably meant "great for identification but terrible for authentication".
- 5y ago

no_time 5y ago

By "laser printer" do they mean regular office printer or laser engraver? It's a bit hard to believe that the super thin layer of black paint produces an imprint thats significant enough for this to work.

afrcnc 5y ago

Known since 2007: https://twitter.com/Makdaam/status/1462800634197987329 https://twitter.com/Makdaam/status/1462800634197987329

webel0 5y ago

[edit for clarity] As someone who doesn’t specialize in security, one claim that has stood out to me for not using fingerprints is that you can't run bcrypt (or some other salting algorithm) on fingerprints [1]. I don’t see any discussion of that here thus far. Is that still the case? I feel like I would have heard about developments in this area if something had changed. But perhaps I've always misunderstood the criticism? [1] https://www.rsaweb.co.za/fingerprint-security-fingerprints-are-not-safe/ https://www.rsaweb.co.za/fingerprint-security-fingerprints-a...

tantalor 5y ago
Says who?
- webel0 5y ago
  Thanks for your comment. I have updated mine to include a reference. In short, I'm thinking about how fingerprints are stored.
cool_scatter 5y ago
Fingerprints are stored as data, and data is hashable. As someone who doesn't know the ins and outs of fingerprint readers, that sounds ludicrous. I also don't see why it would need to be hashed, however.
- webel0 5y ago
  Thanks for your comment. I have updated my comment to try to be more precise.

daneel_w 5y ago

People commonly mistake biometrics for authentication; they are only shallow identification.

gannon- 5y ago

Could a similar concept apply to face-id passwords? What's stopping face-ID spoofing?

albert_e 5y ago

How about .... Fingerprint sensors + inbuilt IR sensors that verify that there is a "live" finger with blood and pulse behind that print. Would that help make FP authentication more robust?

Spivak 5y ago
Yes, if you're interested in this kind of stuff you basically have to work for the military because they're the only ones with the funding and motivation for this kind of stuff.
- draugadrotten 5y ago
  Check out the LivDet - Liveness Detection Competitions - https://livdet.org/index.php https://livdet.org/index.php

trulyme 5y ago

The biggest problem imho is that we only have two states on our phones - locked and unlocked. Ideally, I should be able to unlock the phone and take photos using just my fingerprint. In my case I would also like to be able to call, message, play games and similar. But to access the 2fa app, cryptoasset app or similar, I must further authenticate in a way that I only reveal parts of my secret ("Enter 3rd, 8th and 11th character of your password:"). The assumption here is that I will mostly authenticate in a private setting, but sometimes I might not have that luxury.

cblconfederate 5y ago
"now place your left index, then your right pinky" etc.
Labo333 5y ago
Nice concept! It made me realize this is the purpose of PINs for some apps (eg Signal)
menage 5y ago
On Android (don't know about iOS) you can take photos without even unlocking - double press on the power button opens the camera. You can't access anything else (including existing photos in the camera roll).
- redler 5y ago
  It works the same way on iPhones. The lock screen includes a camera button. When tapped, the phone enter a camera-only mode in which only photos taken during that session are accessible.
  - newscracker 5y ago
    You can also swipe the right on the screen to open the camera instead of pressing the camera button on the screen.
- abletonlive 5y ago

trident5000 5y ago

24 hour fitness wanted my fingerprints to check into their gym. I had to explain to multiple employees why that was never going to happen.

m3kw9 5y ago

Biometrics is almost like security thru obscurity.

fortuna86 5y ago
I'd say it's a slight step up.

louissan 5y ago

James, is that you? https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2Ftse4.mm.bing.net%2Fth%3Fid%3DOIP.8r8YKoDAPDASoPnV9Gb3agHaEA%26pid%3DApi&f=1 https://external-content.duckduckgo.com/iu/?u=https%3A%2F%2F...

Sohcahtoa82 5y ago

Is anyone surprised by this? I've been telling my friends for a couple years now that unlocking via fingerprint is a convenience feature, not a security feature.

deleted 5y ago
[deleted]

cblconfederate 5y ago

i guess faceid should be even easier since u can recreate a face from a few public photos. Plus the good thing about fingerprints is that most people have learned from movies+tv that fingerprints are not secret and can be faked

grifball 5y ago

Myth busters did this: https://m.youtube.com/watch?v=MAfAVGES-Yc https://m.youtube.com/watch?v=MAfAVGES-Yc ?13? Years ago?

fukpaywalls2 5y ago

Well, they definitely can be hacked off

kartoshechka 5y ago

2FA can be bamboozled too, given that SMS is kinda a security joke

legrande 5y ago

Anyone else see this technique a few times in heist movies? I always knew it could be done, but having a blogpost detailing how to do this is is pretty cool.

cmaggiulli 5y ago

Fingerprints are usernames, not passwords

rogelin 5y ago

Firgerprints are usernames, not passwords.

rStar 5y ago

apple: use your fingerprint … gov: fingerprints are fungible … apple: use your eyeball then!

dxf 5y ago

The huge advantage of biometrics (fingerprints, FaceID, etc.) is the ease with which a user can unlock their phone. A passcode may be better than a fingerprint, but a fingerprint+longer passcode is better than a shorter passcode (or no passcode at all). Having a 12 character alphanumeric passphrase you enter each time you want to unlock is not something most users want to do. See e.g.: https://www.businesstoday.in/technology/news/story/what-kicked-off-touchid-innovation-apple-explains-in-200-page-report-288765-2021-02-19 https://www.businesstoday.in/technology/news/story/what-kick... Only about 49 per cent of the users were setting a passcode, which meant that the remaining 51 per cent were not benefiting from the data protection mechanism. When Apple dug in to understand the reason, the findings revealed that users unlock their devices a lot - on an average about 80 times a day. And about half of its users simply didn't want the inconvenience of having to enter their passcode into their device, at times. At that time, in 2012-2013, the default passcode length for iPhone was four digits, which happens to be six today. Apple realised that it needed to come up with a mechanism that's fast and secure, and doesn't involve typing in the passcode. That's when Apple introduced Touch ID, which was easy, fast and secure. The way that biometric authentication worked on Apple platforms was that the user must set a passcode to be able to use the biometrics. And just as Apple thought, there was a much higher adoption of biometric-based TouchID. Apple says over 92 per cent chose to use Touch ID and had therefore set the passcode, which in turn meant users were able to use Apple's data protection encryption system.

mdp2021 5y ago
> The huge advantage of biometrics ... is the ease with which a user can unlock their phone This does not prevent involuntary unlocking - it actually can allow for eased against-will unlocking. «Ease» and security may sometimes not be friends.
- breser 5y ago
  At least on iPhones though they have a way to activate a mode that prevents the use of TouchID and FaceID. If I press the power button on my phone 5 times in a row that turns that off. Yes I still run the risk of my device being unlocked against my will if I'm caught by surprise. But I'm able to disable this functionality in places where I think the risk of that may be higher, e.g. while traveling. I'll still take the trade off of longer password (not just a few numbers) on my phone while using a biometric test for normal access. Of course not everyone may have the same threats to consider and others may make different choices. Doesn't make either of our choices wrong.

whirlwin 5y ago

So there is a difference here. On local hardware this is not that crucial. But on (portable) software relying on the fingerprint is more severe.

emodendroket 5y ago

Yes. But at a certain point one has to consider how much security is "enough." Someone could break into my house, even when locked, by kicking in the door or breaking a window, but I don't necessarily need to turn it into Fort Knox in response. If you are a high-value target, it is worth thinking about this, but for the average person, I think it might be a reasonable trade-off.

AtNightWeCode 5y ago

As an IT professional you should know to never use fingerprints or facial recognition for logins.

mdp2021 5y ago
It seems you are stating that biometrics should not be used to restrict account access according to specific individuals ("John can only access john.harrey and finance.12")
- AtNightWeCode 5y ago
  Not bio-metrics but passive logons. Retina scanners can detect this I believe. Fingerprints are used by criminals to get access to services. Girl follow guy home. Drug him and then a team uses the fingerprints. May even take pictures to avoid having the person report to the police. It happened here in my city, in western Europe, so it can happen pretty much everywhere.

deleted 5y ago

[deleted]

100c1p43r 5y ago

Well, you just leave your "password" on the device ;)

elias94 5y ago

Have you ever seen the Charlie's Angels movies? They where taking the fingerprints using a beer bottle. Same method but 21 years ago.

paulpauper 5y ago

The big problem with fingerprint is you may void your 5th amendment right

neycoda 5y ago

So it's not easy.

ineedasername 5y ago

The problem with any lock is that, fundamentally, it is made to be opened when certain conditions are met. And that's putting aside any sort of brute force approach. Good security design is as much about asking, from first principles, "what conditions need to be met to open this?" as about considering how it might be attacked. For example, the condition to be met for a pad lock to open is not "when the proper key is inserted" or "the key pins are raised to the appropriate level". It's something more basic-- like "when the locking bar no longer blocks the shackle from rising." From that perspective, attacking the key hole and pins is only one of multiple vectors.

amelius 5y ago
Or you just open the lock with a bolt cutter.
- ineedasername 5y ago
  Thumbprint locks on a laptop won't usefully respond to a bolt cutter. A padlock was just a convenient example. Even then, bolt cutters don't work in the strongest of them: angle grinders are a popular choice in that case, but are a lot more obvious. You can't hide a small angle grind up your coat sleeve and quickly snap the hasp on a bike lock. In any case, the bolt cutters approach is also why I stipulated "putting aside brute force". Because in the context of computer security as with this article, something a bit more subtle seems to be effective more often, especially against higher end security.

p2p_astroturf 5y ago

damn i need more sockpuppet accounts so i can list all my snarky comments: - no shit, use public keys - your 2FA can also be hacked - your company forcing 2FA is insufferable like all modern web - your KYC is literally pointless since i already gave those same ID photos to 100 different companies, few to none of which are competent enough to keep them secret EDIT: huh, this is actually a good article. but it's still ironic since it's coming from a company that follows all the standard snake oil

a-dub 5y ago

i find this whole in-screen fingerprint reader trend to be pretty funny. isn't glass excellent for capturing fingerprints? i suspect biometrics like fingerprints may play a role in the future, but the role they would play is more convenience in cases where the device knows its in a trusted environment. (that is, there will be more attention on devices tracking whether they've been separated from their owner, or if their owner is not behaving like their owner, and if so, requiring additional challenge) either that or we'll all be carrying keys. there are some cool wearables i've seen out there that i think talk nfc.

1vuio0pswjnm7 5y ago

If we had asked people thirty years ago whether a single company, not a police department or other government agency, could, with consent, collect the most human fingerprints in history, would people have been likely to point out various obstacles and/or doubt it was even possible. Further, would they ever agree that these prints could be collected not for employee access to company resources but for access to people's own personal effects! (Company retains remote access to devices storing personal effects.)

srfilipek 5y ago
Any good implementation has fingerprint information stored locally, encrypted, and never transmitted off device.

aaronleather 5y ago

these type of things always will be happen till the all gov. will not come together at one platform with strict Punishment like Death penalties for these type of crime (Fingerprints stolen, Rape, Murder...etc)

danielyaa5 5y ago

Isn’t this the point of requiring the password on startup. Seems like enough of a caveat for everyday users

makecheck 5y ago

A fingerprint is a user ID that is usually treated like a password, which is the main problem here. They should add at least a 2nd layer (that doesn’t reduce the convenience too much). For example, people could probably remember a simple Morse-code-like sequence of finger presses, e.g. your extra token is that you set it up to use “tap, tap, longpress, longpress, tap”.

Ayanti 5y ago

We can use fingerprints for additional security, but it has to be done carefully. If fingerprints or any biometric data is hacked, the users can change it, so they have to be contained. The best way I know is to use a mobile device with fingerprint or biometric input, which is saved only on the device. Then use the biometric to enable the user to accept the authentication request but use the mobile device specific info as a password replacement.

Ayanti 5y ago

We can use fingerprints for additional security, but it has to be done carefully. If fingerprints or any biometric data is hacked, the users can not change it, so they have to be contained. The best way I know is to use a mobile device with fingerprint or biometric input, which is saved only on the mobile device. Then use the biometric to enable the user to accept the authentication request but use the mobile device specific info as a password replacement.