4 ms·

How does one forge biometrics? (Notice that I'm not asking how to spoof biometric readers with insecure designs, e.g., the one mythbusters busted). Anyway, th

How does one forge biometrics? (Notice that I'm not asking how to spoof biometric readers with insecure designs, e.g., the one mythbusters busted). Anyway, this is already the case – fingerprints are used as evidence of criminal liability. If someone forges my fingerprints, they could get me into a huge amount of trouble, in theory.

ars 15y ago
> How does one forge biometrics? At the end of the day a finger or an iris is a physical object you can make. Since it's impossible to keep the "key" secret, you can always copy it and make one - how hard you have to work to make it depends on how good the design is, but fundamentally there is no secret and without a secret it's useless for authentication. > If someone forges my fingerprints, they could get me into a huge amount of trouble, in theory. Yes, they can, and sometimes they do. But it's not common enough for police to worry about it.
- sunchild 15y ago
  But let's admit that there's no such thing as a secret, really, and it's more about how difficult a thing is to reproduce or reverse engineer. I mean, everything about security is just a big game of "hide the ball" and the question is how many hoops one must jump through to find the ball.
  - ars 15y ago
    Of course there are secrets. What you are trying to say is that system will let you do many attempts till you guess the secret. But with biometrics there are no guesses - you know exactly what it should look like. There is difficulty in implementation certainly, but a basic principle of security is that each increment of difficulty in the securer (like a longer password) should increase the difficulty of the attacker by an order of magnitude. Biometrics does not have this properly.
    - sunchild 15y ago
      Thanks for taking the time to respond here and elsewhere. You make some really interesting points, and I understand this topic much better now.

ars 15y ago

> How does one forge biometrics? At the end of the day a finger or an iris is a physical object you can make. Since it's impossible to keep the "key" secret, you can always copy it and make one - how hard you have to work to make it depends on how good the design is, but fundamentally there is no secret and without a secret it's useless for authentication. > If someone forges my fingerprints, they could get me into a huge amount of trouble, in theory. Yes, they can, and sometimes they do. But it's not common enough for police to worry about it.

sunchild 15y ago
But let's admit that there's no such thing as a secret, really, and it's more about how difficult a thing is to reproduce or reverse engineer. I mean, everything about security is just a big game of "hide the ball" and the question is how many hoops one must jump through to find the ball.
- ars 15y ago
  Of course there are secrets. What you are trying to say is that system will let you do many attempts till you guess the secret. But with biometrics there are no guesses - you know exactly what it should look like. There is difficulty in implementation certainly, but a basic principle of security is that each increment of difficulty in the securer (like a longer password) should increase the difficulty of the attacker by an order of magnitude. Biometrics does not have this properly.
  - sunchild 15y ago
    Thanks for taking the time to respond here and elsewhere. You make some really interesting points, and I understand this topic much better now.