15 ms·

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military g

• newsbinator 5y ago
  > Spiegel also reported another security hole from the conference: reading a user's PIN code from reflections in their pupils while taking selfies. https://www.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://www.dw.com/en/german-defense-minister-von-der-leyens...
  • Cd00d 5y ago
    I don't understand this one - when are people taking a selfie at the same time they're typing in their pin? I have an android phone, and I don't even unlock to take pictures. I just don't follow the timeline and geometry. Seems theoretical only maybe.
    • voakbasda 5y ago
      Take a selfie with someone unlocking their phone positioned over your shoulder. Seems very practical and surreptitious.
    • LocalH 5y ago
      Reflections of the fingerprint marks on the screen that are usually present for those who don't regularly wipe their screen off?
    • ARandomerDude 5y ago
      It's badly worded in the article but I think it means person A is entering his pin. Persons B, C, D, etc. take selfies in the vicinity of person A. By comparing multiple selfies from sightly different times, you can determine person A's pin.
      • deleted 5y ago
        [deleted]
    • nkrisc 5y ago
      I assume the intent is to capture it while surveilling someone while they enter their PIN, not necessarily from images harvested from social media or anything. Since many PIN entries show at most the most recently entered number, you'd need multiple images to capture the PIN. But if you can capture it from reflections in their eyes, then you can surveil them from a greater distance and more stealthily if you've got a good camera.
• PinguTS 5y ago
  And they distributed it with the Datenschleuder. Cannot remember the issue, but I have it still somewhere at home. It is like a highly distributed backup of that fingerprint.
  • landemva 5y ago
    State driver license in USA is a honey pot of thumb/finger scans. Anyone on HN think the NSA doesn't have access? NSA info sharing with trusted foreign countries makes a reliable distributed backup for use by foreign spooks.
    • nanidin 5y ago
      > State driver license in USA In which states? The only thing I have been fingerprinted for is in the US is The Global Entry program.
      • reaperducer 5y ago
        More and more states require fingerprints for driver licenses because of the RealID program. Eventually (soonish) you won't be able to use your driver license to fly without it being RealID compliant. One state I lived in gave me the option of not having a RealID-compliant license if I wanted to. Another didn't, so fingerprints were compulsory.
        • fragmede 5y ago
          heads up that the RealID deadline got pushed back to May 3, 2023
        • nanidin 5y ago
          As far as I can tell, Real ID does not require fingerprints, only digital color images of the face[0]. [0] https://www.biometricupdate.com/202101/real-id-law-quietly-passes-with-a-possible-win-for-government-watchdogs https://www.biometricupdate.com/202101/real-id-law-quietly-p...
        • 5y ago
• vletal 5y ago
  The title almost sounds like that they have a meaningful fingerprint ready to open her iPhone... Was that the case? Or do they have a somewhat accurate partial fingerprint? I failed to find recoding of the presentation.
  • DangerousPie 5y ago
    AFAIK iOS actually uses the pattern of veins below the fingertip rather than an image of the fingerprint itself. So I can't imagine this would be enough to unlock an iPhone.
    • joecool1029 5y ago
      You're sort of not wrong, touchid uses a capacitive sensor vs. a visual/camera sensor which has become more common in other devices. What this means is in theory you're measuring the electrical behavior of the outer layers of skin, and Apple claims goes as far as measuring subdermis. (This is also is why their touchid scanners don't work on wet fingers as the behavior is thrown off). However, they are showing their attack working on a Macbook Pro with touchid, which uses this sort of reader. So it's easier to fake in practice than it is in theory. Whatever material you lift the print off of should have to mimic the capacitive behavior of the finger and this looks like it busts Apple's claim that it can read the lower layers (or it tells us their default sensitivity is set too low for convenience)
  • raxxorrax 5y ago
    I am sure that the touchscreen of a phone could in many cases supply the necessary materials.
• EGreg 5y ago
  That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-is-hard-sell-11600597240#:~:text=A%20user%20needs%20to%20open,passcode%20sent%20to%20their%20phone https://www.wsj.com/articles/in-china-paying-with-your-face-.... The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.
  • js4ever 5y ago
    Even for that it's not safe if anyone can bypass it with a $5 trick. It's definitely a thumb idea
    • y4mi 5y ago
      You can unlock most home doors within seconds even without having the key Nonetheless, we still lock our doors and thieves often break in, even though picking the lock is both safer and less likely to arouse suspicion. Your argument makes sense, but we humans aren't really rational
      • fragmede 5y ago
        Breaking into my house doesn't get you my password for all of my accounts though, no matter how much of an invasion of my space it is.
      • Aengeuad 5y ago
        There's a good reason why criminals don't carry lockpicks around and that's because they're regulated, in much of the world mere possession of them outside of your residence is a criminal offence and even in places where you can carry them legally they not only show prior intent, their use in criminal activities carries a charge just like breaking and entering. I'd also argue that being stuck picking a stubborn lock for 2-3 minutes is significantly more suspicion arousing than the literal seconds it takes to break a window but that's neither here nor there. On the rationality of having locks when criminals can very easily break a window, the old saying that locks keep honest people out rings true. Locks do serve a purpose even if they do very little to slow criminals down. To bring the analogy full circle fingerprint readers always seemed like windows to me in how easy they are to bypass, luckily they're more of a luxury than a necessity. :-)
• yeetaccount2 5y ago
  I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” techniques to do the same with DNA evidence…might be something that would get you a contract with the CIA/NSA.
  • landemva 5y ago
    'what if somebody ...' made SaaS service to upload pictures and overnight ship the fingertip.
    • jcims 5y ago
      Would make for a good Black Mirror episode.
    • yeetaccount2 5y ago
      Sounds like they’d get lots of subpoenas.
    • qw 5y ago
      It would probably cause a huge media storm. Then the politicians would "fix it" by replacing it with face recognition... (suddenly Face/Off is no longer science fiction)
      • reaperducer 5y ago
        suddenly Face/Off is no longer science fiction Didn't a woman in France already have a face transplant?
        • brezelgoring 5y ago
          I don't think it was the type of transplant Face/Off was depicting, hers was very natural-looking but also visibly not a normal face. I'd like to see Mission: Impossible type transplants, or even masks like the ones they use, for that matter.
• jrootabega 5y ago
  And, in some cases, not considered protected by law, which overlaps well with #2 and #3.
• sm4rk0 5y ago
  The video from the conference, in German: https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272...
• Spivak 5y ago
  This meme really really has to die. It's so annoying that it's spread so far. Biometric security (i.e something you are) does not need to be secret nor revoked. That's the entire point. It's a piece of information that even when it's known by everyone still can't be reproduced. The strength of a security system based on biometrics is exactly how well that system can detect that it's reading from an living breathing human. - Perfect: A human guard manually taking a fingerprint reading. Can't be beat because the guard can obviously see that it's not really your hand. - Shit: A camera that compares pictures. The entire industry is about making an autonomous system that gets as close as possible to perfect. It's fine to say that you don't think it's good enough right now but "oh no I lifted a fingerprint from a photo" isn't some security breach.
  • philovivero 5y ago
    > That's the entire point. It's a piece of information that even when it's known by everyone still can't be reproduced. And yet, it can be reproduced. So it seems like the entire point is... invalid.
    • Spivak 5y ago
      Produce me a living breathing human with a chosen fingerprint -- biometrics are not "a picture of your fingerprint is the password."
      • fragmede 5y ago
        But similar to hash collisions, a total break (arbitrary hash values can be output) isn't required for it to be a problem. Where fingerprint scanners aren't magic (especially given the sloppiness of input data), that they're defeatable in corner cases should be enough to be worrisome.
        • Spivak 5y ago
          Right but exactly like hashing you can set the difficulty of breaking it to your risk tolerance. Your phone should probably be a little loose but the retina scanner at the datacenter of the dod will be a lot stricter.
• ozim 5y ago
  Pin/password can also be hacked and there is no need for fancy 3D printer. Someone can use their smartphone to film other person as they type stuff in, no need for printing fake print. They can steal phone/laptop as soon as they are done filming. This is the case that fingerprint sensors are preventing. Pointing out problems is useless - as people don't have alternative that would be "all-mighty secure without flaws". It should be defense in depth not - and that is already there for example banking apps - you need fingerprint to unlock the phone and banking app requires its own specific PIN. Getting those 2 things makes it much harder for bad guys to do something like money transfer. Yeah they might get your photos and other stuff - but probably there are secure store apps that would encrypt your photos if you have ones that you really want to protect.
  • rhn_mk1 5y ago
    > This is the case that fingerprint sensors are preventing. They aren't. Your parent post already mentioned that they were extracted by filming. Passwords don't have the other 2 problems, and I'm not really sure what is gained by not talking about them.
    • ozim 5y ago
      For fingerprint it is "using several close-range photos in order to capture every angle" - to get PIN, I need one angle and probably not even close-range of video and even weird angle if I have to sneak up onto someone in a metro or in a coffee shop.
      • UncleEntity 5y ago
        well, TFA used one photo...
        • ozim 5y ago
          How convenient for them that they: 1) did not write what are needed parameters of the photo or quality of left fingerprint 2) it does not look like they used photo from an angle of the screen as in article but some other closeup 3) somehow unlock stuff with thumb where most people use index finger 4) then they use index finger to operate "thumb" print 5) who touches screen like that with thumb, who touches back of the phone like that In the end with PIN I can look over someones shoulder and not even have to make a video. I agree with the premise of what they say that people might think fingerprint is "super secure" while it is not... But it is secure enough for most of the people and more secure that typing in PIN or short password or for people using 0000 or 1234 as PIN.
• throw0101a 5y ago
  > The core problems with biometrics are that: … is that they're treated as passwords instead of usernames. The three problems you list all have the biometric=password assumption in them. See also using the American SSN usage: it's treated like a (secret) token, and so when it leaks it can be used to access sensitive information. Using it as 'just' a username would probably reduce a lot of problems as well.
  • int0x2e 5y ago
    Exactly. This is a point everyone seems to gloss over but is fundamental to the entire concept of using biometrics.
  • strbean 5y ago
    > American SSN usage Nothing like a secret token that can be reliably guessed using only your birth month+year and place of birth!
    • deleted 5y ago
      [deleted]
    • booi 5y ago
      wait it's based on birth month/year/place? is there an algorithm to generate it or something?
      • lelandbatey 5y ago
        There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is the Serial Number Certain geographic areas get certain "Areas Numbers", then Group Numbers are assigned consecutively, then Serial Numbers are assigned consecutively. This entire system of consecutive assignment makes it trivial to guess pretty well, or even exactly, what someone's SSN is.
• eden_hazard 5y ago
  How the heck did they get the fingerprint from that? Is there actually tech to enhance blurry images like that?
  • endymi0n 5y ago
    iirc they had a waiter as a conspirator serving that guy at a banquet
    • sm4rk0 5y ago
      There were (at least) two such "stunts" in the past involving German ministers: In 2008. "fingerprint of then interior minister and current Finance Minister Wolfgang Schäuble" was sourced from a glass: https://freerepublic.com/focus/f-news/1995935/posts https://freerepublic.com/focus/f-news/1995935/posts In 2014. "A speaker at the yearly conference of the Chaos Computer Club has shown how fingerprints can be faked using only a few photographs. To demonstrate, he copied the thumbprint of the German defense minister" Ursula von der Leyen https://m.dw.com/en/german-defense-minister-von-der-leyens-fingerprint-copied-by-chaos-computer-club/a-18154832 https://m.dw.com/en/german-defense-minister-von-der-leyens-f...
  • syntheticcorp 5y ago
    They used several close range photos, not the one in the article.
  • cinntaile 5y ago
    It says several images were used. You can't generate a correct fingerprint from that blurry fingerprint picture. The data has to exist in order to reproduce it.
• runarberg 5y ago
  I really like it in Demolition Man, how they thought of a future which used biometrics for secure access (in that case retina scan). But they also saw how easy it was to bypass it when Simon (Wesley Snipes) simply takes the eye of the warden to escape his prison. I don’t think this was intentional but they managed to demonstrate (or at least for-shadow) the incompetent police force of the future this way.
• babypuncher 5y ago
  My problem with this reasoning is that it leads people to think that biometrics therefore shouldn't be used. Can biometrics be spoofed? Absolutely. Is it likely to happen to the average person? Not at all. For a typical everyday user, a fingerprint or face scan is probably more secure than the common alternatives of "sticky note" passwords, easily guessed PINs, or no authentication at all. Biometrics are a compromise between security and convenience. Before iPhones got Touch ID, it was not uncommon for people to just not put a lock on their phone out of convenience. Now it is impossible to find an iPhone out in the wild that is not fully encrypted. The average level of security on consumer devices that hold sensitive information has increased dramatically thanks to biometrics.
  • raxxorrax 5y ago
    A gesture unlock will provide the same and does not need a biological marker. I believe biometrics aren't necessary to establish security and in the worst case reveal unnecessary information.
    • babypuncher 5y ago
      Reveal unnecessary information to whom? Both Windows Hello and iOS TouchID/FaceID never allow biometric data to leave the device. In the case of iOS, that data never even leaves the secure enclave.
      • raxxorrax 5y ago
        By their own statements that might be true.
• arisAlexis 5y ago
  Me and my team have developed a solution for the 3 problems mentioned. Anyone interested to discuss further find my email on my profile.
• trie 5y ago
  > 1) Not revokable (unlike compromised credentials) Isn't that what Cancelable Biometrics e.g. [0] is about [0] https://ieeexplore.ieee.org/document/7192838 https://ieeexplore.ieee.org/document/7192838
• jiveturkey 5y ago
  those aren’t a problem when the biometric is used correctly. eg not as single factor authentication
• passivate 5y ago
  I'm sure the military has better than average tech when it comes to security, but I wonder if they're agile enough to embrace the rapid technological change that is necessary to stay on the bleeding edge. These days when I hear military + security in the same sentence I think of aging warships running windows 2000, using oddball niche technology supplied by equally oddball government contractors/vendors.
  • monopoledance 5y ago
    Isn't Windows 2000 kind of a very respected operating system doing a lot of things right? You assume 'old' strictly implies outdated, or bad, which isn't true. E.g. good passwords are still undefeated. And security protocol redundancies surely can make intrusion impractical, even if individual components fail. I assume, military hard- and software to be made meticulously, double checking everything, on literally battle tested chips and gear. I mean, I really had no contact with anything military ever, so that's a guess based on aircraft and space development, pictures of überfunctional UIs and the ridiculous finances of the US military.
    • passivate 5y ago
      I'm not speaking from personal experience either, sorry if I seemed to imply that. I just meant it as a general comment with regards to anything that the military does. There is so much red-tape surrounding procurement, implementation that I wonder if they are agile enough to be on the cutting edge. I don't mean to diss W2k in general, Its an OS that is well understood by now - weaknesses, mitigations, etc. Slowmoving entities like the government accrue so much cruft that it makes it exceedingly difficult to move to newer (and possibly better) platforms to take advantage of newer security tech.
      • monopoledance 5y ago
        If I understand correctly, the military doesn't really want to be cutting edge, as things go boom with yesterday's tech, without the trade-offs of untested, novel "innovations". I think there isn't much advantage in new developments, apart from convenience. And for W2k, I wasn't merely suggesting it's well-tested, but also a different, better thing than say WindowsXP. At least, I got the impression operating systems folks reference it for a "many good ideas" kinda thing. Sorry, I don't have any expertise in any of this and talk mostly out of my ass.
• gioele 5y ago
  Just a remark: the person whose fingerprints have been reconstructed and that was the defense minister of Germany at time of the stunt (Ursula von der Leyen), is now the president of the European Commission (~= head of the EU government).
• User23 5y ago
  I’ve always thought it’s really silly to use something you leave on everything you touch as a credential.
• Tagbert 5y ago
  In the case of Apple’s TouchID, the fingerprint is less a password and more of a session extender. You need to login with ID and password to establish a session. Then the fingerprint gives you access to that session. Once the session ends, you need to reestablish your credentials. This obviously not as secure as a system when you must use your credentials frequently to maintain access, but it seems entirely appropriate for the level of security needed by most individuals on their phones. Especially as the alternative is often a super simple password or even no password at all. TouchID makes a moderate level of security palatable enough for people to actually use.
  • monopoledance 5y ago
    Potatoes, potatoes, or something. So far I haven't encountered a device where a fingerprint was used to unlock disk encryption, so your objection is actually implied, I think. Especially, with the increasing uptime of Apple's new hardware, a running session is what you more often than not got these days. No matter how you twist it, biometrics are fundamentally flawed and not even Apple can magically fix that. At least one component of access needs to be a secret, which cannot be extracted without cooperation, or "cooperation".
• eftychis 5y ago
  One of my first examples. That story was ironic in so many levels.
• aqeelat 5y ago
  How would liveliness be faked?
  • detaro 5y ago
    A common attack is a thin fake fingerprint you put on your actual (alive) finger.