5 ms·

When you unlock your MacBook you are opting in to unlock the MacBook and you don't need to use it. Also, it is protected by a Secure Enclave and the actual fing

When you unlock your MacBook you are opting in to unlock the MacBook and you don't need to use it. Also, it is protected by a Secure Enclave and the actual fingerprint isn't stored. Reading the bill it even points this out. Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

crazygringo 4y ago
Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks. I don't know of any general-purpose fingerprint readers for authentication that store the original image. Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways.
- fragmede 4y ago
  That is a huge presumption and, as GP pointed out, the problem is if your fingerprint gets leaked, it's rather difficult to change it. Apple did a great job with TouchID but security experts went all over it trying to poke holes. Most other fingerprint systems don't get anywhere near the same amount of scrutiny. So in an unfortunate turn of fate, Apple's awesome implementation of fingerprint authentication on the iPhone resulted inthe general public being comfortable with fingerprint auth in other places, when they really shouldn't be.
  - loeg 4y ago
    You leak your fingerprints everywhere you go on every surface you touch. Fingerprints are highly convenient but they have never been an especially secure mechanism for locking devices.
    - A4ET8a8uTh0 4y ago
      But, and here is the important part, those 'leaked fingerprints' in the wild are not digitally preserved. It would actually take some effort to preserve on a scene. The comparison is not apt.
      - pixl97 4y ago
        What form must a malicious fingerprint scanner take by law? When it comes to fingerprints you must assume that the attacker has the ability to control the scene and the ability to retry until successful.
        A4ET8a8uTh0 4y ago
        Is it not an argument against using fingerprints as a basis for id verification to begin with?
        libraryatnight 4y ago
        Yeah it just seems like a bad idea. It's like we never got over how cool it is that fingerprints can be a unique identifier, and we jut assume it must be a good one.
      - crazygringo 4y ago
        Just like it actually takes some effort to hack a fingerprint reader.
        A4ET8a8uTh0 4y ago
        You are missing the point. The point is that reader has those preserved and stored somewhere, while fingerprints that a person just leaves about by going about their day are not. Just the fact that they are stored is an issue. Note, this is a response to the original question of 'pfft, a person leaves fingerprints all the time anyway'. Again, the comparison is just not apt.
- reaperducer 4y ago
  Lots of assumptions and "shoulds," but the reality is that the tech industry makes mistakes with security all the time. Every month or so there's another horror story on HN about some company storing passwords as plain text. Just because something can be done right does not mean it is done right.
- lozenge 4y ago
  If the fingerprint worked across multiple computers, they did store the fingerprint. Maybe it wasn't an image, but it would need to be informative enough to distinguish between multiple employees. Embedded fingerprint readers only provide a matches user/doesn't match user result.
  - acdha 4y ago
    There’s no technical reason why they couldn’t share hashes across devices. It might be specific to a particular model of scanner but presumably they’re buying a lot of a standard model.
- acdha 4y ago
  Unless you have first-hand knowledge of the devices they used, you can’t assume sensible developers. For example, HTC shipped this mess: https://www.theverge.com/2015/8/10/9126027/htc-fingerprint-scanner-vulnerability-one-max https://www.theverge.com/2015/8/10/9126027/htc-fingerprint-s... Similarly, a vendor of facility access control systems left fingerprint scans in an exposed ElasticSearch instance: https://www.vpnmentor.com/blog/report-biostar2-leak/ https://www.vpnmentor.com/blog/report-biostar2-leak/
  - deleted 4y ago
    [deleted]
- gautamdivgi 4y ago
  You’re assuming a lot here. Most IOT security is on shaky ground. They probably went with the cheapest vendor too. There isn’t a compromise reported but I’m willing to bet that whatever was implemented was very insecure.
- agwa 4y ago
  > Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways. If an attacker had a fingerprint and wanted to figure out who it belonged to, they could hash it and compare the hash against a database of leaked names and hashes. Salting doesn't prevent this, unless the hash is intentionally slow, in which case the attacker would merely be slowed down. Also, how much entropy is in a fingerprint anyways? If it's low, an attacker could generate every possible fingerprint and hash it to build a mapping from hash to actual fingerprint. Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise.
  - NoZebra120vClip 4y ago
    >Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise. This exactly!! QFT! No biometrics should ever be used for shared or public devices! Biometrics are fine for personal devices that are always with us, and not shared by others, especially anyone outside our family/household. I've made my peace with biometrics as far as unlocking my phone via fingerprint. My threat model is such that a fingerprint lock is often safer than pecking in a long password. (Because I'm often surrounded by shoulder surfers.) So yeah, if a restaurant is forcing employees to scan fingerprints (or retinas or DNA or saliva or what have you) on public or shared devices for purposes of clocking in, or payroll, or whatever, then that is wrong and a perversion of biometric authentication. The company would be much better served by a correct application of security techniques. And yes, if this means going back to passwords for awhile, then so be it. Passwords are a good first-line auth measure for shared devices that are not open to the public (let's assume that this restaurant's devices were only physically accessible by employees in the back office or something.) Another idea is to let the employees authenticate using their smartphone. My bank has something set up with this. You install a smartphone app, it authenticates you, and it vouches when you set foot in the bank so that the teller already has your account pulled up. Then, in terms of biometric locking for the smartphone, knock yourself out; the company has no need to collect the data, just interface to an app.
- fallingknife 4y ago
  How can you store a hash of a fingerprint for this use case? A fingerprint reader needs to recognize close matches in the input data as valid.
  - loeg 4y ago
    https://en.wikipedia.org/wiki/Locality-sensitive_hashing https://en.wikipedia.org/wiki/Locality-sensitive_hashing You essentially have N different hashes and require at least N - M (M < N) matches.
- sanp 4y ago
  Even if that were the case, the still did not get consent and that is the problem. “Secure” fingerprint access does not excuse the lack of consent.
- saghm 4y ago
  > Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks. Presumably they would have checked if their policy was legal before implementing it too. The problem is that they haven't really earned the presumption of diligence in this matter.
batch12 4y ago
I may have missed this. Were they storing hashes of images or points of images- or were they storing the original image? Any platform worth its salt would hash and salt the fingerprint data and it'd be worthless elsewhere as other systems would have different hashes.
gruez 4y ago
>is at heightened risk for identity theft This feels like pearl clutching to me. While it's probably technically true that having your fingerprint leaked increases your risk of identity theft by some non-zero amount, in the overwhelming majority of the cases it's effectively zero, because for the overwhelming majority of people the only place they have their fingerprints enrolled is on their phones. In the event you somehow acquire stolen fingerprint image data, it will be very difficult to use those to perform identity theft at mass scale, because you need physical access to phones. >and is likely to withdraw from biometric-facilitated transactions. What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.
- boppo1 4y ago
  I mean, you could leave someone's fingerprints at the scene of a crime.
  - brookst 4y ago
    You could also write a confession in their name and leave it at the crime scene. I don’t think this happens a lot.
  - gruez 4y ago
    If you're out to frame someone for a crime, I have a feeling that you're not going to stop just because you can't buy the victim's fingerprint on darknet markets. You can follow the person around and lift fingerprints off objects that he touched, for instance.
- mandmandam 4y ago
  Post a hi-res scan of your fingerprints with your name and address, and see what happens - it might be a learning experience for you... Note: I don't actually recommend you do this - it opens you up to the very real dangers which you're claiming don't exist.
  - 4y ago

crazygringo 4y ago

Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks. I don't know of any general-purpose fingerprint readers for authentication that store the original image. Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways.

fragmede 4y ago
That is a huge presumption and, as GP pointed out, the problem is if your fingerprint gets leaked, it's rather difficult to change it. Apple did a great job with TouchID but security experts went all over it trying to poke holes. Most other fingerprint systems don't get anywhere near the same amount of scrutiny. So in an unfortunate turn of fate, Apple's awesome implementation of fingerprint authentication on the iPhone resulted inthe general public being comfortable with fingerprint auth in other places, when they really shouldn't be.
- loeg 4y ago
  You leak your fingerprints everywhere you go on every surface you touch. Fingerprints are highly convenient but they have never been an especially secure mechanism for locking devices.
  - A4ET8a8uTh0 4y ago
    But, and here is the important part, those 'leaked fingerprints' in the wild are not digitally preserved. It would actually take some effort to preserve on a scene. The comparison is not apt.
    - pixl97 4y ago
      What form must a malicious fingerprint scanner take by law? When it comes to fingerprints you must assume that the attacker has the ability to control the scene and the ability to retry until successful.
      - A4ET8a8uTh0 4y ago
        Is it not an argument against using fingerprints as a basis for id verification to begin with?
        libraryatnight 4y ago
        Yeah it just seems like a bad idea. It's like we never got over how cool it is that fingerprints can be a unique identifier, and we jut assume it must be a good one.
    - crazygringo 4y ago
      Just like it actually takes some effort to hack a fingerprint reader.
      - A4ET8a8uTh0 4y ago
        You are missing the point. The point is that reader has those preserved and stored somewhere, while fingerprints that a person just leaves about by going about their day are not. Just the fact that they are stored is an issue. Note, this is a response to the original question of 'pfft, a person leaves fingerprints all the time anyway'. Again, the comparison is just not apt.
reaperducer 4y ago
Lots of assumptions and "shoulds," but the reality is that the tech industry makes mistakes with security all the time. Every month or so there's another horror story on HN about some company storing passwords as plain text. Just because something can be done right does not mean it is done right.
lozenge 4y ago
If the fingerprint worked across multiple computers, they did store the fingerprint. Maybe it wasn't an image, but it would need to be informative enough to distinguish between multiple employees. Embedded fingerprint readers only provide a matches user/doesn't match user result.
- acdha 4y ago
  There’s no technical reason why they couldn’t share hashes across devices. It might be specific to a particular model of scanner but presumably they’re buying a lot of a standard model.
acdha 4y ago
Unless you have first-hand knowledge of the devices they used, you can’t assume sensible developers. For example, HTC shipped this mess: https://www.theverge.com/2015/8/10/9126027/htc-fingerprint-scanner-vulnerability-one-max https://www.theverge.com/2015/8/10/9126027/htc-fingerprint-s... Similarly, a vendor of facility access control systems left fingerprint scans in an exposed ElasticSearch instance: https://www.vpnmentor.com/blog/report-biostar2-leak/ https://www.vpnmentor.com/blog/report-biostar2-leak/
- deleted 4y ago
  [deleted]
gautamdivgi 4y ago
You’re assuming a lot here. Most IOT security is on shaky ground. They probably went with the cheapest vendor too. There isn’t a compromise reported but I’m willing to bet that whatever was implemented was very insecure.
agwa 4y ago
> Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways. If an attacker had a fingerprint and wanted to figure out who it belonged to, they could hash it and compare the hash against a database of leaked names and hashes. Salting doesn't prevent this, unless the hash is intentionally slow, in which case the attacker would merely be slowed down. Also, how much entropy is in a fingerprint anyways? If it's low, an attacker could generate every possible fingerprint and hash it to build a mapping from hash to actual fingerprint. Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise.
- NoZebra120vClip 4y ago
  >Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise. This exactly!! QFT! No biometrics should ever be used for shared or public devices! Biometrics are fine for personal devices that are always with us, and not shared by others, especially anyone outside our family/household. I've made my peace with biometrics as far as unlocking my phone via fingerprint. My threat model is such that a fingerprint lock is often safer than pecking in a long password. (Because I'm often surrounded by shoulder surfers.) So yeah, if a restaurant is forcing employees to scan fingerprints (or retinas or DNA or saliva or what have you) on public or shared devices for purposes of clocking in, or payroll, or whatever, then that is wrong and a perversion of biometric authentication. The company would be much better served by a correct application of security techniques. And yes, if this means going back to passwords for awhile, then so be it. Passwords are a good first-line auth measure for shared devices that are not open to the public (let's assume that this restaurant's devices were only physically accessible by employees in the back office or something.) Another idea is to let the employees authenticate using their smartphone. My bank has something set up with this. You install a smartphone app, it authenticates you, and it vouches when you set foot in the bank so that the teller already has your account pulled up. Then, in terms of biometric locking for the smartphone, knock yourself out; the company has no need to collect the data, just interface to an app.
fallingknife 4y ago
How can you store a hash of a fingerprint for this use case? A fingerprint reader needs to recognize close matches in the input data as valid.
- loeg 4y ago
  https://en.wikipedia.org/wiki/Locality-sensitive_hashing https://en.wikipedia.org/wiki/Locality-sensitive_hashing You essentially have N different hashes and require at least N - M (M < N) matches.
sanp 4y ago
Even if that were the case, the still did not get consent and that is the problem. “Secure” fingerprint access does not excuse the lack of consent.
saghm 4y ago
> Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks. Presumably they would have checked if their policy was legal before implementing it too. The problem is that they haven't really earned the presumption of diligence in this matter.

batch12 4y ago

I may have missed this. Were they storing hashes of images or points of images- or were they storing the original image? Any platform worth its salt would hash and salt the fingerprint data and it'd be worthless elsewhere as other systems would have different hashes.

gruez 4y ago

>is at heightened risk for identity theft This feels like pearl clutching to me. While it's probably technically true that having your fingerprint leaked increases your risk of identity theft by some non-zero amount, in the overwhelming majority of the cases it's effectively zero, because for the overwhelming majority of people the only place they have their fingerprints enrolled is on their phones. In the event you somehow acquire stolen fingerprint image data, it will be very difficult to use those to perform identity theft at mass scale, because you need physical access to phones. >and is likely to withdraw from biometric-facilitated transactions. What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.

boppo1 4y ago
I mean, you could leave someone's fingerprints at the scene of a crime.
- brookst 4y ago
  You could also write a confession in their name and leave it at the crime scene. I don’t think this happens a lot.
- gruez 4y ago
  If you're out to frame someone for a crime, I have a feeling that you're not going to stop just because you can't buy the victim's fingerprint on darknet markets. You can follow the person around and lift fingerprints off objects that he touched, for instance.
mandmandam 4y ago
Post a hi-res scan of your fingerprints with your name and address, and see what happens - it might be a learning experience for you... Note: I don't actually recommend you do this - it opens you up to the very real dangers which you're claiming don't exist.
- 4y ago