3 ms·

Almost ten years ago I bought a Logitech keyboard with a fingerprint reader. People were saying that fingerprint readers would be the end of passwords. The keyb

by tbenst 13y ago

Almost ten years ago I bought a Logitech keyboard with a fingerprint reader. People were saying that fingerprint readers would be the end of passwords. The keyboard came with a nice piece of software that automatically entered passwords on websites upon a verified fingerprint. It didn't happen. I would attribute it to two main frustrations: the readers only worked inconsistently due to particulate build up, and would occasionally have false positives. I think false positives are an inherent risk with fingerprint readers and in any case are not suitable for security as lifting a fingerprint from someone unwittingly is easy. See the Mythbusters episode on stealing a thumbprint: http://www.youtube.com/watch?v=3Hji3kp_i9k http://www.youtube.com/watch?v=3Hji3kp_i9k

gcr 13y ago
What's worse: if someone can get to the software fingerprint image stored in the computer, they can create fake fingers that work in conventional fingerprint scanners. http://youtu.be/K1Sx_BmfZ8I http://youtu.be/K1Sx_BmfZ8I Having a stolen fingerprint is worse than a stolen password. For one, people tend to trust fingers more; for the other, it's impossible to change your fingerprint, unlike your password. I really can't trust these kinds of consumer technologies until their designers use revocable biometric systems to protect the fingerprint template. That area of the literature is quite well studied, but everyone seems to ignore it.
- evan_ 13y ago
  Surely it's not just storing a .png of your fingerprint.
  - gcr 13y ago
    Actually, it is. From the video: "The government is moving to storing them in WSQ format, which is literally just an image." More details on WSQ format: http://en.wikipedia.org/wiki/Wavelet_Scalar_Quantization http://en.wikipedia.org/wiki/Wavelet_Scalar_Quantization Even if you just store minutiae points (lists of X,Y coordinates of "interesting" points in the image like ends, bifurcations, etc), recent research shows how to generate a plausible fingerprint image that has those same minutiae. Here's one work: http://www.cse.msu.edu/biometrics/Publications/Fingerprint/FengJain_FMModel_ICB09.pdf http://www.cse.msu.edu/biometrics/Publications/Fingerprint/F... Take a look at the pretty figures. This was done four years ago; it's only gotten better since then.
- adolph 13y ago
  Just use a different finger. You get ten revocations before you have to take off your shoe.
  - gcr 13y ago
    Some governments etc. force you to submit to giving fingerprints of all ten fingers. If an adversary steals just that biometric database, you're done. That's it. No more fingers to use. Any civil worker who takes fingerprints isn't going to let you put your foot on the fingerprint scanner to verify your identity, and the next customers certainly don't want to touch the device after you've had your way with it.
    - adolph 13y ago
      Well sure, great points! Nonetheless, for those not living in dystopia a cell phone fingerprint login may be handy.

by tbenst 13y ago

gcr 13y ago

What's worse: if someone can get to the software fingerprint image stored in the computer, they can create fake fingers that work in conventional fingerprint scanners. http://youtu.be/K1Sx_BmfZ8I http://youtu.be/K1Sx_BmfZ8I Having a stolen fingerprint is worse than a stolen password. For one, people tend to trust fingers more; for the other, it's impossible to change your fingerprint, unlike your password. I really can't trust these kinds of consumer technologies until their designers use revocable biometric systems to protect the fingerprint template. That area of the literature is quite well studied, but everyone seems to ignore it.

evan_ 13y ago
Surely it's not just storing a .png of your fingerprint.
- gcr 13y ago
  Actually, it is. From the video: "The government is moving to storing them in WSQ format, which is literally just an image." More details on WSQ format: http://en.wikipedia.org/wiki/Wavelet_Scalar_Quantization http://en.wikipedia.org/wiki/Wavelet_Scalar_Quantization Even if you just store minutiae points (lists of X,Y coordinates of "interesting" points in the image like ends, bifurcations, etc), recent research shows how to generate a plausible fingerprint image that has those same minutiae. Here's one work: http://www.cse.msu.edu/biometrics/Publications/Fingerprint/FengJain_FMModel_ICB09.pdf http://www.cse.msu.edu/biometrics/Publications/Fingerprint/F... Take a look at the pretty figures. This was done four years ago; it's only gotten better since then.
adolph 13y ago
Just use a different finger. You get ten revocations before you have to take off your shoe.
- gcr 13y ago
  Some governments etc. force you to submit to giving fingerprints of all ten fingers. If an adversary steals just that biometric database, you're done. That's it. No more fingers to use. Any civil worker who takes fingerprints isn't going to let you put your foot on the fingerprint scanner to verify your identity, and the next customers certainly don't want to touch the device after you've had your way with it.
  - adolph 13y ago
    Well sure, great points! Nonetheless, for those not living in dystopia a cell phone fingerprint login may be handy.