8 ms·
Fingerprints can be recreated from the sounds made when you swipe a screen
- lvncelot 3y agoFirstly, wow, that is absolutely insane. I'm wondering about this part though: > The source of the finger-swiping sounds can be popular apps like Discord, Skype, WeChat, FaceTime, etc. Any chatty app where users carelessly perform swiping actions on the screen while the device mic is live. Is there really enough information left for this method after the sound has been lossily compressed by any of those apps?
- westmeal 3y agothat was my first thought too, this kind of reminds me of the 'figure out which key was pressed by listening to keystrokes' trick.
- samatman 3y agoThat attack is more about timing than about sound. There is some information available from the sound of a keystroke, with a very good microphone under ideal conditions each key could be identified uniquely, but that's not the main vector. Some sequences are easier to type than others by their very nature, and individual typists have idiosyncratic variance in how easily/fast/accurate they are at a given sequence. That's the main trick used to derive what's typed from a recording of it happening, and compression doesn't reduce that information, so long as the keypresses are audible.
- justinzollars 3y agoThis reads like a thrilling bond film. Scary!
- neontomo 3y agoI suppose I have to start shouting every time I swipe my screen now.
- qrobit 3y agoI am by no means competent but I believe frequencies of swiping and frequencies of you shouting differ substantially which will allow to separate them
- neontomo 3y agoI would assume you're correct if they were the same level of audio, but my joke was about overpowering the swiping sound entirely, to the point where a microphone wouldn't be able to pick it up anymore.
- hn_throwaway_99 3y agoThis would be amazing if true, but after being burned on a bunch of "too crazy to be true" tech stories recently (toothbrush bot armies anyone?) I'm very skeptical. The idea that there is enough resolution in the sound of a finger swipe to determine the fingerprint ridges on that finger is really suspect to me.
- arp242 3y agoI also have to admit my skepticism. Skimming through the paper, I don't think they emulated "real-world conditions" as claimed in the conclusion. They had participants swipe the screen 25 times in a row. Real-world conditions would be giving them 12 hours of recording throughout the day, or something like that, because knowing when and where to look is probably a major challenge on its own. I'll also add that even if true, it's probably not a huge practical issue. Fingerprints are mostly used to secure personal devices: phones, sometimes computers. If I were to have your full fingerprints then that would be mostly useless because I don't have access to your physical device. Even things like "purchase on App Store with fingerprints" usually works by having the fingerprint only secure a key on the device itself (rather than sending the fingerprint data over the network). And if you have access to your physical devices, then I almost certainly also have access to your fingerprints via the good ol' "dust for prints" technique. There was a "fingerprints for everything!" push a decade or so ago, and that was harshly criticized because you leave fingerprints everywhere, and you can even lift them from photographs. Certainly the "enormous economic and personnel losses, and even a potential compromise of national security" claim at the start of the paper seems rather exaggerated, even hysterical.
- PeterisP 3y agoI don't think that real-world conditions would be giving them 12 hours of recording throughout the day - a malicious app that explicitly asks people to swipe left/right on pictures of kittens is a very realistic attack scenario and would know exactly when and where to look for the swipes.
- mzs 3y agopaper is pretty convincing: https://www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2024-618-p...
- longwave 3y agoIf this is true does this mean we don't need fingerprint scanning hardware any more, but we can just use a microphone and software to unlock a device when the user runs their finger over any convenient surface?
- amanj41 3y agoGiven the full fingerprint reconstruction rates, it would likely be a while until the tech is reliable enough to do that, if ever.
- schaefer 3y ago>> Following tests, the researchers assert that they can successfully attack “up to 27.9% of partial fingerprints and 9.3% of complete fingerprints within five attempts at the highest security FAR [False Acceptance Rate] setting of 0.01%.” I wonder if I'm in the lucky majority, and my fingerprints sound secure
- deadbabe 3y agoPretty soon the sound of a heart beating when a person enters a room will allow you to easily identify them.
- nonrandomstring 3y agoWhy bother when you can pick them up from any doorhandle, coffee cup, pen, table surface, or just a photograph at super high-res. Biometrics are form of (dubious) in-person identification, and their use for access control belongs in the all-time stupidest ideas in computing list.
- tommiegannert 3y agoThe nice thing about fingerprints is that if you refuse to give it to an adversary, they'll just cut the finger off. If your fingerprint doesn't work, you're clear. If you refuse to give them your password, there's virtually no limit to the possible extent of the torture. You can't prove that further torture is pointless. /s
- nonrandomstring 3y agoOf course, but people who indulge in torture are not seeking information. They're seeking satisfaction.
- hn_throwaway_99 3y agoI'm pretty sure that people who indulge in torture often want information.
- nonrandomstring 3y agoSure they may want it. But let's talk about Afghanistan and Iraq and how that worked out.
- SushiHippie 3y agohttps://xkcd.com/538/ https://xkcd.com/538/
- nonrandomstring 3y ago{{Alt-Text: Actual Actual Reality: Nobody really cares about his secrets. (Also, I would be hard pressed to find that wrench for $5.)}} If you're browing with javascript on and without text-only, you're missing a lot on the web ;)
- giantg2 3y agoShould be easy to obfuscate if true - use gloves, use dirt/grit on the screen, use oily fingers. Edit:why disagree? I bet you could even create textured screen protectors with randomized patterns to obfuscate they swipe.
- karaterobot 3y ago> “up to 27.9% of partial fingerprints and 9.3% of complete fingerprints within five attempts at the highest security FAR [False Acceptance Rate] setting of 0.01%.” I wonder how "partial" is defined. But anyway, the fact that you can even hear any sounds of swiping feels odd to me. Is this just something Apple could filter out of the audio data it provides to applications? I know nothing about audio processing.
- caymanjim 3y agoThis reminded me of power line frequency[1] being used to identify when and where recordings were taken. Governments keep historical records of subtle changes in power frequency and can extract the background hum to identify location and time. 1: https://en.wikipedia.org/wiki/Electrical_network_frequency_analysis https://en.wikipedia.org/wiki/Electrical_network_frequency_a...
- m463 3y agoI wonder if they can do that with gps. Like record a short blip of "unlocked" gps spectrum, then recreate the location offline later using saved ephemerals and other data.
- thanatosmin 3y agoReading the paper, it looks like they just demonstrate classification by left loop/right loop/whorl. That's a long way from recreating a full fingerprint.
- whatshisface 3y agoIt's also a long way from what I had thought would have been possible.
- TeMPOraL 3y agoAnd a good reminder that everything you do radiates information about it all the time, everywhere, at the speed of light.
- deleted 3y ago[deleted]
- pixl97 3y agoMy less polite way of saying this is "Entropy is a bitch"
- ben_w 3y agoThat's a very different point.
- pixl97 3y agoThey are pretty similar. When you look at things like privacy and security in light of human actions and behaviors, then look at our ability to record the entropy from those actions, a whole lot of what we thought was private can be divined by those that can collect enough of this waste.
- whatshisface 3y agoThey're related by the time reversibility of quantum mechanics and the necessary implication that disorder is the broad mixing of initial information.
- mathgradthrow 3y agoFingerprints aren't secure. You literally leave them on anything you touch.
- tomasreimers 3y agoReminds me of a sidechannel attack I demo'd in college: https://medium.com/@tomasreimers/axolotl-a-keylogger-for-iphone-and-android-a8b7b62cdab4 https://medium.com/@tomasreimers/axolotl-a-keylogger-for-iph...
- neonate 3y agohttps://www.ndss-symposium.org/wp-content/uploads/2024-618-paper.pdf https://www.ndss-symposium.org/wp-content/uploads/2024-618-p...
- Lomacar 3y agoThis sounds completely impossible. First off, swiping a finger on a greasy glass screen doesn't make any sound, at least nothing that a phone microphone could pick up. Secondly, how on earth could you possibly reconstruct a fingerprint from a sound of it moving on a surface?!