4 ms·

Actually, my gym (24 Hr Fitness) uses fingerprint scanners to sign people in. I hadn't really given it much thought before, but indeed, it would be possible for

Actually, my gym (24 Hr Fitness) uses fingerprint scanners to sign people in. I hadn't really given it much thought before, but indeed, it would be possible for their system to be compromised and for my fingerprint data to be released into the wild...

mikeash 13y ago
Yes, hackers could compromise your gym's systems, steal your fingerprint data, and then use it to... mooch off your gym membership?
- dragonwriter 13y ago
  Or to generate an artificial fingerprint that can fool scanners, and then use that to access an other service or data you have/use that is "secured" with fingerprint as the single authentication factor. Since fingerprints can't be changed, he more widely they are used for authentication, the more likely that they will be compromised and the less useful they are for authentication.
  - mikeash 13y ago
    That's a good argument against using fingerprint scanners as the only choice for authentication. They're not very secure, because they can potentially be stolen and faked. However, it's not at all an argument against using fingerprint scanners as an optional choice for authentication, just because the scanner could be used to steal your fingerprint. Fingerprint theft is a problem regardless. You can't really target systems that enable that theft, because it's an ever-present risk. Instead, worry about systems which fail due to such theft. Fingerprints are fine for a gym, because who cares if somebody fakes yours. They're fine for a smartphone for many people, because it's intended to stop casual theft, not be an impenetrable barrier. Fingerprints should definitely not be used (at least on their own) for, say, nuclear launch authorizations or other things of similar import, because they can be stolen and faked.
  - JoeAltmaier 13y ago
    Cheap biometric scanners also yield only a few bits - your fingerprint becomes a small int. About the same security as your garage door opener.
- Dylan16807 13y ago
  It's terrible security practice, but the average person reuses fingerprints. Sorry to be the bearer of bad news.
subsystem 13y ago
Unless you have to also swipe a card in which case the fingerprint might be stored on the card. That how it's done where I live since you can't store peoples fingerprints without a good reason.

mikeash 13y ago

Yes, hackers could compromise your gym's systems, steal your fingerprint data, and then use it to... mooch off your gym membership?

dragonwriter 13y ago
Or to generate an artificial fingerprint that can fool scanners, and then use that to access an other service or data you have/use that is "secured" with fingerprint as the single authentication factor. Since fingerprints can't be changed, he more widely they are used for authentication, the more likely that they will be compromised and the less useful they are for authentication.
- mikeash 13y ago
  That's a good argument against using fingerprint scanners as the only choice for authentication. They're not very secure, because they can potentially be stolen and faked. However, it's not at all an argument against using fingerprint scanners as an optional choice for authentication, just because the scanner could be used to steal your fingerprint. Fingerprint theft is a problem regardless. You can't really target systems that enable that theft, because it's an ever-present risk. Instead, worry about systems which fail due to such theft. Fingerprints are fine for a gym, because who cares if somebody fakes yours. They're fine for a smartphone for many people, because it's intended to stop casual theft, not be an impenetrable barrier. Fingerprints should definitely not be used (at least on their own) for, say, nuclear launch authorizations or other things of similar import, because they can be stolen and faked.
- JoeAltmaier 13y ago
  Cheap biometric scanners also yield only a few bits - your fingerprint becomes a small int. About the same security as your garage door opener.
Dylan16807 13y ago
It's terrible security practice, but the average person reuses fingerprints. Sorry to be the bearer of bad news.

subsystem 13y ago

Unless you have to also swipe a card in which case the fingerprint might be stored on the card. That how it's done where I live since you can't store peoples fingerprints without a good reason.