7 ms·

Serious question -- what is the big deal if someone gets your fingerprints? I can't think of the last time my fingerprint was used as some infallible method of

• pilif 13y ago
  The problem is that I can't change my fingerprint. If it gets out by some third-party abusing the secret backdoor (or just abusing whatever other place you have your fingerprint stored), then they can potentially forge your fingerprint when committing a crime or when otherwise attempting to access resources you have access to. When a third-party loses your password, you change it and life goes on (you are not reusing passwords, are you?). When a third-party loses your fingerprint, what do you do? Cut off your fingers? Grow a new hand? Yes. The fingerprint information is supposed to be irreversibly hashed. But so are passwords. And yet we still see them being stored unencrypted. No. I'm very careful with my fingerprints. Also, the data on my phone must be some of the most valuable data I have. When I lose my phone and you gain access, you immediately own all my online identities. My phone has SSH keys, it has the password to my Email account stored in its keychain (very handy for all these "I have forgotten my password" features on all the sites), it has my 2 factor authentication tokens - I can't even begin to imagine how bad it would be if somebody had access to my phone. Yours is probably as valuable to you.
  • therobot24 13y ago
    you can rub off your fingerprints, it does occur, however is not very practical (though better than cutting off your hand)
    • hjnilsson 13y ago
      They'll grow back eventually. So cutting off is the only option.
      • therobot24 13y ago
        I hardly doubt cutting them off is the only option. Tissue damage is definitely required, but burning (such as a chemical burn) would also work.
      • RyJones 13y ago
        I don't have fingerprints. A large part of the world population doesn't have readable prints. What now? People on blood thinners, elderly people, Asians, women all have less distinctive prints. I don't have prints due to psoriasis. Fingerprints are a horrible biometric.
        • gfodor 13y ago
          Saying that fingerprints are a bad biometric because some people can't use them is like saying escalators are a bad idea because some people can't use them. They might be a bad biometric but it's not because they aren't universally available to everyone.
          • RyJones 13y ago
            When it's used as a gate, it is an issue. It took the Seattle PD and whatever agency actually issues civilian CAC (HSPD-12) a long, long time to get enough prints to allow me access to do my job. Both eventually had to accept three very partial prints as evidence.
            • cremnob 13y ago
              Looks like you'll be using the passcode as usual.
  • martin-adams 13y ago
    The problem I see is that if they have a copy of your fingerprint, and then their computer says that matches a crime of sorts, what do you do then? You have to consider the false positives.
    • therobot24 13y ago
      the probability of a false match + you being in the area with no alibi is very slim
  • gfodor 13y ago
    This makes sense. However, the cops already have many peoples' fingerprints once they've been booked, and in general if someone wants your fingerprints they can usually get them. I think the question of fingerprint forgery is an important one but I would assume that in a real trial the evidence presented also considers the likelihood the fingerprints were forged. That said, I can see how this could potentially dramatically increase the availability of public fingerprints if it were hacked. More importantly the fact you can't reset your fingerprint is something I overlooked. I do think that in general though anyone building a system that relies exclusively on a fingerprint as a highly hack-resistent security measure is foolhardy regardless of how prevalent fingerprint data is. In other words, your iPhone passcode isn't protecting your data anymore than your fingerprint if someone gets their hands on your phone, so I don't really see how this point is material to if it's a good idea to use fingerprints to unlock phones.
  • sliverstorm 13y ago
    They probably already have your fingerprint. I believe you usually have to give it to the DMV to get your license.
    • hack_edu 13y ago
      Which offers a perfect chance for cross-referencing!
    • pilif 13y ago
      In the country where I live (Switzerland), getting a drivers license thankfully does not involve somebody taking your fingerprint. Also, public transportation here rules to such an extent that not even having a drivers license is a perfectly valid option. I don't have one for example. My passport also is one of the last ones you could get without it containing any biometric data. As such, I'm reasonably sure that no third-party ever had access to my fingerprint. And I'd love for it to stay like this (see my parent comment for the reasons why)
      • sliverstorm 13y ago
        Why do you care if anybody gets your fingerprint, if you have already decided nobody can be trusted with your fingerprint and thus will never trust fingerprint based authentication? Once you are at that point, it's like your eye color or something. I don't care if other people get my eye color, because I will never use it to authenticate.
        • mcintyre1994 13y ago
          I'd hypothesise it's more likely somebody will use your fingerprint to identify you than your eye colour. For example, at a crime scene if your fingerprints are found you can hardly say "oh, I don't trust my fingerprint so I won't authenticate with it, ignore that" - like it or not, it's seen as being at least something to investigate. On the flip side I imagine a witness who reports only "green eyes" won't have their case followed for very long.
  • simonholroyd 13y ago
    >> I'm very careful with my fingerprints. What does that even mean? You wear gloves in public all the time? You wipe down everything you touch? Which makes me wonder, aren't one's finger prints all over your iPhone exterior anyway. If someone steals one's phone wouldn't it be easier to dust it for prints than crack the security on the digital copy?
    • iyulaev 13y ago
      Which makes me wonder, aren't one's finger prints all over your iPhone exterior anyway. If someone steals one's phone wouldn't it be easier to dust it for prints than crack the security on the digital copy? Ding ding ding! We have a winner. Almost as silly as not using a biometric logic because "what if they use a backdoor to get a photo of my face?"
      • hadem 13y ago
        Right but his also assumes that you have physical access to the device! That, and a finger printing kit and time to spare...
    • minor_nitwit 13y ago
      Which makes the idea of a fingerprint reader on a phone somewhat nonsensical. Your password is all over the phone, and Mythbusters has proven how easy these are to fake.
      • LaGrange 13y ago
        Actually, it doesn't, because properly used biometric isn't a sole auth method. You want to use it coupled with at least a pin - then suddenly just looking over your shoulder isn't enough, you have to handle the phone carefully, or steal the fingerprints off your glass. That's more work, and makes it more costly and skill intensive. It's not impenetrable, but still quite efficient.
        • minor_nitwit 13y ago
  • oleganza 13y ago
    Simply publish your fingerprint somewhere - then if anyone uses it to impersonate you, it won't matter. It's not quite the same with private keys because you can always generate some new keys and publicly revoke your key if it could have been compromised. Since you cannot regenerate your fingerprints and could have already lost them, simply revoke them up front. Edit: expanded on this in my blog: http://blog.oleganza.com/post/60865284958/key-revocation-and-fingerprints http://blog.oleganza.com/post/60865284958/key-revocation-and...
• AsymetricCom 13y ago
  This is just another iteration of the "I have nothing to hide" argument, but now you're making it with f-ing fingerprints? Get a clue, nobody needs to have this argument again.
  • gfodor 13y ago
    It is most certainly not a "I have nothing to hide" argument. It is a "what exactly is the value of a fingerprint in terms of identity theft?" It's a question of how dangerous, really, would access to the world's fingerprints be for a nefarious hacker. I'm not asking to be facetious, I honestly don't know the real answer relative to more standard security measures like passwords.
    • AsymetricCom 13y ago
      The same argument can be had for any individual piece of information. It's the amalgamation of all your personal data into the digital system of the internet that's dangerous, so it doesn't really tell us anything significant if your fingerprint by itself is valuable.
• deleted 13y ago
  [deleted]
• deleted 13y ago
  [deleted]
• yapcguy 13y ago
  What if you have the legal right to not give up your password to your phone? Now, instead of waiting around for lawyers, your finger will be physically forced onto the home button.
• cmiles74 13y ago
  It's not uncommon for the police or fire department to fingerprint children as "a fun activity" or "a way to learn more about police and their work". http://www.gastongazette.com/news/local/police-want-to-fingerprint-your-child-1.180610 http://www.gastongazette.com/news/local/police-want-to-finge...
• bluedino 13y ago
  In my state, you're required to have the State Police add a digital scan of your fingerprints to the FBI database when you apply for a handgun license.
• vinceguidry 13y ago
  My question: Is digitized fingerprint information gathered from a given device useful? As in, could you run the prints gathered from an iPhone against, say, a DMV database? My intuition tells me that you couldn't. And that would gravely limit their utility value to the government.
  • gnaffle 13y ago
    My guess is that if the sensor works as well as they claim, including 360 degree orientation, it has to store a pretty complete profile of the fingerprint.
• kisielk 13y ago
  Exactly. I've already had to give my fingerprint numerous times at the airport just to enter the United States. I figure the US government must already have it in numerous databases, so it's not a concern if they've backdoored Apple's devices to copy them again.
  • scholia 13y ago
    Same here...
  • glitchdout 13y ago
    What if I've never been to the US? I'm sorry, I don't follow your "logic".
• cpher 13y ago
  The Feds have had my fingerprints for 8 years, because of a foreign adoption. In fact, they have two versions because my first fingerprints "expired" because it took so long for the adoption to happen. So they have an extra $800 from us-- Thanks USA! (tm). Plus, as others have mentioned below, most conceal carry firearm permits will require it, at least here in Illinois. So, the govt. already knows that I'm a registered Republican, they have my fingerprints (twice), they know I have a FOID (Firearm ID in Illinois), they know my travel patterns (via airlines, gas stations, etc). I think the last of my worries is some fingerprint scanner on a smartphone. At least I won't have to type in my PIN to unlock it while driving...
• robotresearcher 13y ago
  Fingerprints are commonly used to place you at the scene of a crime.