3 ms·

Fingerprints are great as a security token, but they should not replace passwords completely. Together with a PIN they will be useful. "Led by Stephanie Schuck

Fingerprints are great as a security token, but they should not replace passwords completely. Together with a PIN they will be useful. "Led by Stephanie Schuckers, an associate professor of electrical and computer engineering at Potsdam, N.Y.-based Clarkson University, the researchers tested 66 Play-Doh copies of real fingerprints of 11 different people. The fake fingerprints were verified as the real deal 90 percent of the time." http://www.informationweek.com/biometric-readers-fooled-with-fake-finge/175001741 http://www.informationweek.com/biometric-readers-fooled-with...

Someone 13y ago
Almost 8 years ago. Fingerprint readers could have improved since then (the article even points out that they have software in the lab to do so). Anybody know how good the current crop of HW/SW combinations is?
- gcr 13y ago
  Sure, the high-end fingerprint scanners are reasonably good at this sort of liveness detection (eg. by detecting the pulse of blood flow or by inferring something about the 3D structure of the fingerprint so you can't just hold up a picture), but the cheap $20 scanners that many businesses use aren't going to be able to distinguish a real from a fake.
  - DannoHung 13y ago
    My girlfriend uses an app that lets her detect her heartrate by putting her finger in front of her camera while the light on the phone shines. I don't really see why whatever they're putting into the phone couldn't do something similar.
    - bsimpson 13y ago
      Instant Heart Rate by Azumio: http://www.azumio.com/apps/heart-rate/index.html http://www.azumio.com/apps/heart-rate/index.html
    - kalleboo 13y ago
      So hold your finger behind a gel with the fake fingerprint. Mythbusters tested a bunch of fingerprint readers and they could break even a few of the ones with "life" detection.
rdl 13y ago
The purpose of the fingerprint is basically to be an extra button the device. You could get 95% of the security benefit of this with a special new button on the iphone ("login") and a normal passcode. The value is having credentials stored in the secure element of the phone, or encrypted under keys in the secure element (which is a standard keystore API thing since ios5), with a set of APIs for apps to access them and present a UI action to the user. It's no different from the windows SAK (ctrl-alt-del) or the Mac "administrative user" dialog box.

Someone 13y ago

Almost 8 years ago. Fingerprint readers could have improved since then (the article even points out that they have software in the lab to do so). Anybody know how good the current crop of HW/SW combinations is?

gcr 13y ago
Sure, the high-end fingerprint scanners are reasonably good at this sort of liveness detection (eg. by detecting the pulse of blood flow or by inferring something about the 3D structure of the fingerprint so you can't just hold up a picture), but the cheap $20 scanners that many businesses use aren't going to be able to distinguish a real from a fake.
- DannoHung 13y ago
  My girlfriend uses an app that lets her detect her heartrate by putting her finger in front of her camera while the light on the phone shines. I don't really see why whatever they're putting into the phone couldn't do something similar.
  - bsimpson 13y ago
    Instant Heart Rate by Azumio: http://www.azumio.com/apps/heart-rate/index.html http://www.azumio.com/apps/heart-rate/index.html
  - kalleboo 13y ago
    So hold your finger behind a gel with the fake fingerprint. Mythbusters tested a bunch of fingerprint readers and they could break even a few of the ones with "life" detection.

rdl 13y ago

The purpose of the fingerprint is basically to be an extra button the device. You could get 95% of the security benefit of this with a special new button on the iphone ("login") and a normal passcode. The value is having credentials stored in the secure element of the phone, or encrypted under keys in the secure element (which is a standard keystore API thing since ios5), with a set of APIs for apps to access them and present a UI action to the user. It's no different from the windows SAK (ctrl-alt-del) or the Mac "administrative user" dialog box.