3 ms·
> Biometrics can't be revoked, so if your gym leaks your fingerprint images (linked to your name), that's a mistake that in practice simply cannot be fixed. You
by PragmaticPulp 4y ago
> Biometrics can't be revoked, so if your gym leaks your fingerprint images (linked to your name), that's a mistake that in practice simply cannot be fixed. You just can't use that finger for sensitive biometrics ever again. People should not be forced to take the risk.
Fingerprint scanner systems don’t store photos of your fingerprint. They store information that can be used to match against your fingerprint within their own system, but they can’t be used to reconstruct your fingerprint.
- greedo 4y agoIn a perfect world, this would be the case. Just as in a perfect world, no one would store un-hashed passwords.
- kube-system 4y agoMany fingerprint scanners are just optical and just return an image of the finger, and it is up to the implementation of the security software as to whether or not that image is converted to a hash and/or disposed of securely. And just like password hashes, some fingerprint hashes can be broken.
- indymike 4y agoThis is what I found on my laptop when I got the fingerprint reader working: The scanner was surprisingly low-resolution (92x62px), and nothing like the "5000ppi super secure" scanner I was expecting... The driver would get a scan from the reader and the driver passed that scan on to whatever was asking for a scan. Not so secure. Regardless fingerprints are really bad for security because they can be detached from the finger or recreated from things you touch. They are probably slightly better than nothing, but with such low resolution, I suspect that if we let 100 random people try to unlock my laptop with their finger... someone would get in... but I could be wrong.
- kube-system 4y agoI don't really think there's such thing as a "good" or "bad" authentication factor. The suitability of an authentication scheme is entirely dependent on the requirements of the problem one is trying to solve. For identifying a fast food worker at a cash register, they are (functionally, not legally or morally) a good fit for the problem, because they are hard for a coworker to replicate, and not likely to lose. For applications in which you need to protect against high skilled attackers, they're not as great.
- tgsovlerkhgsel 4y agoa) the data can often be used to recreate a fake fingerprint that isn't identical but will be accepted, sometimes even by systems from different vendors b) what they actually store varies, and I'm sure some systems do just store the picture (your passport does, for example), some likely don't store it in the database but happen to have a temp folder somewhere with everything they scanned, and some claim they don't store it and then store it under advanced military-grade 512 bit RSA encryption with the key stored next to the images. The software quality of biometrics systems is among the worst I've seen. Worse even than embedded/IOT stuff.
- blowski 4y ago> the data can often be used to recreate a fake fingerprint that isn't identical but will be accepted, sometimes even by systems from different vendors Do you have an example of this happening?
- lightedman 4y agoWhere I work, we use a fingerprint scanner to clock in/out. My right index and left ring finger are similar enough in their prints that either will work for the device.
- tgsovlerkhgsel 4y agohttps://www.google.com/search?q=reconstruction+of+fingerprint+images+from+minutiae https://www.google.com/search?q=reconstruction+of+fingerprin... has a number of different papers.
- blowski 4y agoThese all seem to be academic studies. I can't see any links that show a fingerprint being reconstructed and then used on a different system.