5 ms·

> Natanson said she does not use biometrics for her devices, but after investigators told her to try, “when she applied her index finger to the fingerprint read

> Natanson said she does not use biometrics for her devices, but after investigators told her to try, “when she applied her index finger to the fingerprint reader, the laptop unlocked.” Curious.

QuantumNomad_ 9mo ago
Probably enabled it at some point and forgot. Perhaps even during setup when the computer was new.
- NewsaHackO 9mo ago
  I want to say that is generous of her, but one thing that is weird is if I didn’t want someone to go into my laptop and they tried to force me to use my fingerprint to unlock it, I definitely wouldn’t use the finger I use to unlock it on the first try. Hopefully, Apple locks it out and forces a password if you use the wrong finger “accidentally” a couple of times.
  - altairprime 9mo ago
    Correct. That’s why my Touch ID isn’t configured to use the obvious finger.
    - throwawayq3423 9mo ago
      Honestly, that's clever.
- intrasight 9mo ago
  My recollection is the computers do by default ask the user to set up biometrics
b112 9mo ago
Very much so, because the question is... did she set it up in the past? How did it know the print even?
dyauspitr 9mo ago
She has to have set it up before. There is no way to divine a fingerprint any other way. I guess the only other way would be a faulty fingerprint sensor but that should default to a non-entry.
- giraffe_lady 9mo ago
  Could be a parallel construction type thing. They already have access but they need to document a legal action by which they could have acquired it so it doesn't get thrown out of court. I think this is pretty unlikely here but it's within the realm of possibility.
  - tsol 9mo ago
    Seems like it would be hard to fake. The was she tells it she put her finger on the pad and the OS unlocked the account. Sounds very difficult to do
    - operator-name 9mo ago
      I think they mean if they already have her fingerprint from somewhere else, and a secret backdoor into the laptop. Then they could login, setup biometrics and pretend they had first access when she unlocked it. All without revealing their backdoor.
- quesera 9mo ago
  > faulty fingerprint sensor The fingerprint sensor does not make access control decisions, so the fault would have to be somewhere else (e.g. the software code branch structure that decides what to do with the response from the secure enclave).
  - d1sxeyes 9mo ago
    If you're interested in this in more detail, check this out: https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/ https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/
ezfe 9mo ago
Why is this curious?
- macintux 9mo ago
  There appear to be a relatively few possibilities. * The reporter lied. * The reporter forgot. * Apple devices share fingerprint matching details and another device had her details (this is supposed to be impossible, and I have no reason to believe it isn't). * The government hacked the computer such that it would unlock this way (probably impossible as well). * The fingerprint security is much worse than years of evidence suggests. Mainly it was buried at the very end of the article, and I thought it worth mentioning here in case people missed it.
  - ezfe 9mo ago
    The reporter lying or forgetting seems to be the clear answer, there's really no reason to believe it's not one of those. And the distinction between the two isn't really important from a technical perspective. Fingerprint security being poor is also unlikely, because that would only apply if a different finger had been registered.
  - orwin 9mo ago
    My opinion is that she set it up, it didn't work at first, she didn't use it, forgot that it existed, and here we are. > Apple devices share fingerprint matching details and another device had her details I looked into it quite seriously for windows thinkpads, unless Apple do it differently, you cannot share fingerprint, they're in a local chip and never move.
    - fragmede 9mo ago
      So how does TouchID on an external keyboard work without having to re-set up fingerprints?
      - piperswe 9mo ago
        Presumably the fingerprint data is stored in the Mac's Secure Enclave, and the external keyboard is just a reader
nozzlegear 9mo ago
My read on this is that she tried to bluff, even though the odds were astronomically high that they'd call her on it. She didn't have anything to lose by trying a little white lie. It's what I would have done in the same situation, anyway.

> Natanson said she does not use biometrics for her devices, but after investigators told her to try, “when she applied her index finger to the fingerprint reader, the laptop unlocked.” Curious.

QuantumNomad_ 9mo ago

Probably enabled it at some point and forgot. Perhaps even during setup when the computer was new.

NewsaHackO 9mo ago
I want to say that is generous of her, but one thing that is weird is if I didn’t want someone to go into my laptop and they tried to force me to use my fingerprint to unlock it, I definitely wouldn’t use the finger I use to unlock it on the first try. Hopefully, Apple locks it out and forces a password if you use the wrong finger “accidentally” a couple of times.
- altairprime 9mo ago
  Correct. That’s why my Touch ID isn’t configured to use the obvious finger.
  - throwawayq3423 9mo ago
    Honestly, that's clever.
intrasight 9mo ago
My recollection is the computers do by default ask the user to set up biometrics

b112 9mo ago

Very much so, because the question is... did she set it up in the past? How did it know the print even?

dyauspitr 9mo ago

She has to have set it up before. There is no way to divine a fingerprint any other way. I guess the only other way would be a faulty fingerprint sensor but that should default to a non-entry.

giraffe_lady 9mo ago
Could be a parallel construction type thing. They already have access but they need to document a legal action by which they could have acquired it so it doesn't get thrown out of court. I think this is pretty unlikely here but it's within the realm of possibility.
- tsol 9mo ago
  Seems like it would be hard to fake. The was she tells it she put her finger on the pad and the OS unlocked the account. Sounds very difficult to do
  - operator-name 9mo ago
    I think they mean if they already have her fingerprint from somewhere else, and a secret backdoor into the laptop. Then they could login, setup biometrics and pretend they had first access when she unlocked it. All without revealing their backdoor.
quesera 9mo ago
> faulty fingerprint sensor The fingerprint sensor does not make access control decisions, so the fault would have to be somewhere else (e.g. the software code branch structure that decides what to do with the response from the secure enclave).
- d1sxeyes 9mo ago
  If you're interested in this in more detail, check this out: https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/ https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/

ezfe 9mo ago

Why is this curious?

macintux 9mo ago
There appear to be a relatively few possibilities. * The reporter lied. * The reporter forgot. * Apple devices share fingerprint matching details and another device had her details (this is supposed to be impossible, and I have no reason to believe it isn't). * The government hacked the computer such that it would unlock this way (probably impossible as well). * The fingerprint security is much worse than years of evidence suggests. Mainly it was buried at the very end of the article, and I thought it worth mentioning here in case people missed it.
- ezfe 9mo ago
  The reporter lying or forgetting seems to be the clear answer, there's really no reason to believe it's not one of those. And the distinction between the two isn't really important from a technical perspective. Fingerprint security being poor is also unlikely, because that would only apply if a different finger had been registered.
- orwin 9mo ago
  My opinion is that she set it up, it didn't work at first, she didn't use it, forgot that it existed, and here we are. > Apple devices share fingerprint matching details and another device had her details I looked into it quite seriously for windows thinkpads, unless Apple do it differently, you cannot share fingerprint, they're in a local chip and never move.
  - fragmede 9mo ago
    So how does TouchID on an external keyboard work without having to re-set up fingerprints?
    - piperswe 9mo ago
      Presumably the fingerprint data is stored in the Mac's Secure Enclave, and the external keyboard is just a reader

nozzlegear 9mo ago

My read on this is that she tried to bluff, even though the odds were astronomically high that they'd call her on it. She didn't have anything to lose by trying a little white lie. It's what I would have done in the same situation, anyway.