6 ms·

German Defense Minister's Fingerprint Copied by Chaos Computer Club

66 points by sjreese 12y ago

jacquesm 12y ago
That's not the first time they've done this: http://www.wired.com/2008/03/hackers-publish/ http://www.wired.com/2008/03/hackers-publish/
- HackinOut 12y ago
  This was done from an "index finger [...] lifted from a water glass" while we are discussing a copy made from a "few photographs"
- huhtenberg 12y ago
  > Krissler pulled a similar stunt in 2008 with a fingerprint of then interior minister and current Finance Minister Wolfgang Schäuble. From the article.
runn1ng 12y ago
Zoom. Enhance.
SEJeff 12y ago
A fingerprint is a good username and ridiculous as a password. This excellent article captures my thoughts pretty well: http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
- TheLoneWolfling 12y ago
  It's not even a good username. You can change usernames as often as you wish. Kind of hard to do that with your fingerprint.
  - Tomte 12y ago
    Tell that to Valve. I wish I could change my Steam user name that I chose in my juvenile years.
    - TheLoneWolfling 12y ago
      You won't be able to carry over games purchased, true. But you can create a new account. You can't even do that much with fingerprints.
      - kybernetikos 12y ago
        I have a main account and a little finger account.
        TheLoneWolfling 12y ago
        Yep, you can do that 8 more times, total. And you can't reuse a fingerprint if an account that you use a fingerprint as the user account for has been compromised.
  - SEJeff 12y ago
    What do you think about doing it sort of like how RSA does their 2fa bits? Say it worked like this: You typed in your username, scanned your fingerprint for the rest of the username, and then typed a password / passcode? That makes it virtually impossible to have username collisions (good) and still uses a password. If you were ultra paranoid, you could use a key fob such as a Yubikey and enter a OTP in addition to the above.
    - TheLoneWolfling 12y ago
      That would work, iff there was not a way to show that a particular person owned a particular username. However, I cannot think of any way to prevent that. ...But given the ease of getting someone's fingerprint I'm not sure if this is actually much better than a standard username+password combination (potentially with 2fa) without a fingerprint at this point, and it's less convenient to boot.
- arrrg 12y ago
  And yet … and yet … See, this is exactly the problem. It’s not at all useless. It’s a pretty great password that defends excellently against a few common problem points (random strangers just picking up your phone and playing with it, random thieves easily getting access in a way that would be convenient and worth it for them) while being completely invisible to me when using it (and actually making unlocking the device easier). It’s rubbish against any kind of targeted attack, sure. Thing is, I personally don’t care about that at all. I couldn’t care less, really. So fingerprints are awesome for me and solve all the problems I want them to solve. I don’t care about perfect security. I don’t care about targeted attacks contingent on physical access to the device.
junto 12y ago
It didn't mention it specifically, but I presume you could then 3d print a replica?
- sp332 12y ago
  Fingerprint scanners use a 2D scanner, right? So you just need a 2D copy of the pattern, like they used last time. http://boingboing.net/2008/04/01/hackers-publish-thou.html http://boingboing.net/2008/04/01/hackers-publish-thou.html
  - SEJeff 12y ago
    The answer to that is more of "it depends". Some higher end fingerprint readers actually use small sound waves to verify the ridges on your fingers are indeed ridges instead of a piece of photo paper with a HD fingerprint. Others use your fingerprint in addition to the heat signature your finger gives off, I'm sure there are others I'm not aware of, but both of the above have been proven defeatable with a mold + gummybear like material and warming it up slightly.
- hengheng 12y ago
  Print on a transparent with a laser printer, then copy the resulting relief with wood glue.
  - striking 12y ago
    CCC did that and broke Touch ID, on which Ars Technica reported! http://arstechnica.com/apple/2013/09/chaos-computer-club-hackers-trick-apples-touchid-security-feature/ http://arstechnica.com/apple/2013/09/chaos-computer-club-hac...
spacefight 12y ago
In other words: biometric identification is still broken.
- JoeAltmaier 12y ago
  Its never been a good idea. Fingerprint as user identification is the worst kind of password you can come up with. You can't change it periodically; you have to use the same one for every purpose; you leave it lying around in public all the time. Forget biometrics, they're useless.
  - _asummers 12y ago
    It is better to think of it like a username than a password. None of my devices support biometrics, but if they did, I would want to have both fingerprint AND password, if that's possible. Does anyone know if any of Apple, Samsung, et al allow that?
    - JoeAltmaier 12y ago
      True. And in my opinion username is useless and should be abandoned. A good password is all you need - say 128-bit high-entropy. Its not going to be duplicated; its enough to identify you. What's the username hanging around for?
      - deleted 12y ago
        [deleted]
      - _asummers 12y ago
        Probability says that it won't be duplicated, but what if it is? You can't say "no, sorry, you can't choose this password" because that leaks information. This is even ignoring adversarial attacks to try and get this or any birthday attacks. In my thinking about this problem from the IoT space lately, I've been thinking about servers assigning credentials to devices, rather than devices telling you their creds. Assign a UUID and let the device generate their password/key, and the pair gives you a multiplicatively large space.
HackinOut 12y ago
Although I have no doubt it could work, I guess they didn't try the copy? Couldn't find the video of the conference. He probably demo'ed using a copy of his own fingerprint from a photo? It's great work, I hope the fact that you can make a copy from a simple HD photo will bury people's ideas about fingerprints security for good.
rfrey 12y ago
When I was working in biometrics 10 years ago, nobody thought fingerprints were a good userid OR a password. It was always presented as a part of multi-factor authentication, to be used in conjunction with passcards and/or passwords. "Something you have, something you know, something you are".
- HackinOut 12y ago
  "Something you have, something you know, something you are" Fingerprints are neither. As several people mentioned in this thread, the only thing I see a fingerprint suitable for is replacing a username.
  - gress 12y ago
    if your timeframe is eternity, this is valid, but for now, the cost of cloning a fingerprint is high enough that they are an excellent protection for a huge category of interactions.
    - HackinOut 12y ago
      Agreed, but I personally think it shouldn't be a general public feature, but rather reserved to the initiated. The cost lessen quickly with time (a point made by this article) and people have trouble understanding the limitations of a particular protection.
      - gress 12y ago
        I think people have even more trouble applying other forms of protection. A fingerprint that is actually used is better than a PIN that is disabled, or worse, written on a card.
        yourad_io 12y ago
        Unless you lose your device. The device that is literally covered with your fingerprints. In this case, you don't know your data is safe or not. "Probably". Hopefully you'll have remote wipe enabled.
georgespencer 12y ago
Biometric security on your cell phone is still a great tradeoff between security and convenience when compared to four-digit PINs.
- yourad_io 12y ago
  Hmm... You're probably right, but this article proves that a four-digit PIN (assuming 10 incorrect attempts would lock the phone) would actually be more secure than a fingerprint. A fingerprint can be cloned and verified (visually) without giving the device a chance to do "defend itself", whereas even the best-case PIN attack* wouldn't necessarily exhaust possibilities before 10 tries. I personally like the swipe gesture, as it is even somewhat resistant to a shoulder-surfing attack (assuming you're turned off horrendous default of drawing the pattern as you drag over it) and is much faster than typing a PIN. * Excluding shoulder-surfing attacks. You know the digits (smudges have built up over them), but not the order.
  - arrrg 12y ago
    Weigh the probability of someone producing a fingerprint replica vs. someone shoulder-surfing. The first seems exceedingly unlikely to me, while the second is at least plausible.
    - yourad_io 12y ago
      Fair enough. The only issue is that all (ok, most) your data is on your phone, as are your fingerprints - so if you lose it[1], in all likelihood they'll be happy they got a $1K device for free and wipe it, but if they were determined to get in to get (say) your SSH keys, or something... yeah. They'd need a few hours and some not-so-hard to get machinery. [1] Especially if it is stolen. "I wasn't targeted. Was I targeted? Nah, I wasn't targeted. Just a crime of opportunity. Yes. For sure.".
      - arrrg 12y ago
        There is nothing valuable (expect potentially embarrassing private information that is, however, completely worthless to some random thief) on my phone that is protected by my fingerprint. The valuable stuff (especially passwords) can’t be accessed with my fingerprint. So for me personally that is irrelevant.
lelf 12y ago
http://www.ccc.de/en/updates/2014/ursel http://www.ccc.de/en/updates/2014/ursel

66 points by sjreese 12y ago

That's not the first time they've done this: http://www.wired.com/2008/03/hackers-publish/ http://www.wired.com/2008/03/hackers-publish/

HackinOut 12y ago
This was done from an "index finger [...] lifted from a water glass" while we are discussing a copy made from a "few photographs"
huhtenberg 12y ago
> Krissler pulled a similar stunt in 2008 with a fingerprint of then interior minister and current Finance Minister Wolfgang Schäuble. From the article.

runn1ng 12y ago

Zoom. Enhance.

SEJeff 12y ago

A fingerprint is a good username and ridiculous as a password. This excellent article captures my thoughts pretty well: http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

TheLoneWolfling 12y ago
It's not even a good username. You can change usernames as often as you wish. Kind of hard to do that with your fingerprint.
- Tomte 12y ago
  Tell that to Valve. I wish I could change my Steam user name that I chose in my juvenile years.
  - TheLoneWolfling 12y ago
    You won't be able to carry over games purchased, true. But you can create a new account. You can't even do that much with fingerprints.
    - kybernetikos 12y ago
      I have a main account and a little finger account.
      - TheLoneWolfling 12y ago
        Yep, you can do that 8 more times, total. And you can't reuse a fingerprint if an account that you use a fingerprint as the user account for has been compromised.
- SEJeff 12y ago
  What do you think about doing it sort of like how RSA does their 2fa bits? Say it worked like this: You typed in your username, scanned your fingerprint for the rest of the username, and then typed a password / passcode? That makes it virtually impossible to have username collisions (good) and still uses a password. If you were ultra paranoid, you could use a key fob such as a Yubikey and enter a OTP in addition to the above.
  - TheLoneWolfling 12y ago
    That would work, iff there was not a way to show that a particular person owned a particular username. However, I cannot think of any way to prevent that. ...But given the ease of getting someone's fingerprint I'm not sure if this is actually much better than a standard username+password combination (potentially with 2fa) without a fingerprint at this point, and it's less convenient to boot.
arrrg 12y ago
And yet … and yet … See, this is exactly the problem. It’s not at all useless. It’s a pretty great password that defends excellently against a few common problem points (random strangers just picking up your phone and playing with it, random thieves easily getting access in a way that would be convenient and worth it for them) while being completely invisible to me when using it (and actually making unlocking the device easier). It’s rubbish against any kind of targeted attack, sure. Thing is, I personally don’t care about that at all. I couldn’t care less, really. So fingerprints are awesome for me and solve all the problems I want them to solve. I don’t care about perfect security. I don’t care about targeted attacks contingent on physical access to the device.

junto 12y ago

It didn't mention it specifically, but I presume you could then 3d print a replica?

sp332 12y ago
Fingerprint scanners use a 2D scanner, right? So you just need a 2D copy of the pattern, like they used last time. http://boingboing.net/2008/04/01/hackers-publish-thou.html http://boingboing.net/2008/04/01/hackers-publish-thou.html
- SEJeff 12y ago
  The answer to that is more of "it depends". Some higher end fingerprint readers actually use small sound waves to verify the ridges on your fingers are indeed ridges instead of a piece of photo paper with a HD fingerprint. Others use your fingerprint in addition to the heat signature your finger gives off, I'm sure there are others I'm not aware of, but both of the above have been proven defeatable with a mold + gummybear like material and warming it up slightly.
hengheng 12y ago
Print on a transparent with a laser printer, then copy the resulting relief with wood glue.
- striking 12y ago
  CCC did that and broke Touch ID, on which Ars Technica reported! http://arstechnica.com/apple/2013/09/chaos-computer-club-hackers-trick-apples-touchid-security-feature/ http://arstechnica.com/apple/2013/09/chaos-computer-club-hac...

spacefight 12y ago

In other words: biometric identification is still broken.

JoeAltmaier 12y ago
Its never been a good idea. Fingerprint as user identification is the worst kind of password you can come up with. You can't change it periodically; you have to use the same one for every purpose; you leave it lying around in public all the time. Forget biometrics, they're useless.
- _asummers 12y ago
  It is better to think of it like a username than a password. None of my devices support biometrics, but if they did, I would want to have both fingerprint AND password, if that's possible. Does anyone know if any of Apple, Samsung, et al allow that?
  - JoeAltmaier 12y ago
    True. And in my opinion username is useless and should be abandoned. A good password is all you need - say 128-bit high-entropy. Its not going to be duplicated; its enough to identify you. What's the username hanging around for?
    - deleted 12y ago
      [deleted]
    - _asummers 12y ago
      Probability says that it won't be duplicated, but what if it is? You can't say "no, sorry, you can't choose this password" because that leaks information. This is even ignoring adversarial attacks to try and get this or any birthday attacks. In my thinking about this problem from the IoT space lately, I've been thinking about servers assigning credentials to devices, rather than devices telling you their creds. Assign a UUID and let the device generate their password/key, and the pair gives you a multiplicatively large space.

HackinOut 12y ago

Although I have no doubt it could work, I guess they didn't try the copy? Couldn't find the video of the conference. He probably demo'ed using a copy of his own fingerprint from a photo? It's great work, I hope the fact that you can make a copy from a simple HD photo will bury people's ideas about fingerprints security for good.

rfrey 12y ago

When I was working in biometrics 10 years ago, nobody thought fingerprints were a good userid OR a password. It was always presented as a part of multi-factor authentication, to be used in conjunction with passcards and/or passwords. "Something you have, something you know, something you are".

HackinOut 12y ago
"Something you have, something you know, something you are" Fingerprints are neither. As several people mentioned in this thread, the only thing I see a fingerprint suitable for is replacing a username.
- gress 12y ago
  if your timeframe is eternity, this is valid, but for now, the cost of cloning a fingerprint is high enough that they are an excellent protection for a huge category of interactions.
  - HackinOut 12y ago
    Agreed, but I personally think it shouldn't be a general public feature, but rather reserved to the initiated. The cost lessen quickly with time (a point made by this article) and people have trouble understanding the limitations of a particular protection.
    - gress 12y ago
      I think people have even more trouble applying other forms of protection. A fingerprint that is actually used is better than a PIN that is disabled, or worse, written on a card.
      - yourad_io 12y ago
        Unless you lose your device. The device that is literally covered with your fingerprints. In this case, you don't know your data is safe or not. "Probably". Hopefully you'll have remote wipe enabled.

georgespencer 12y ago

Biometric security on your cell phone is still a great tradeoff between security and convenience when compared to four-digit PINs.

yourad_io 12y ago
Hmm... You're probably right, but this article proves that a four-digit PIN (assuming 10 incorrect attempts would lock the phone) would actually be more secure than a fingerprint. A fingerprint can be cloned and verified (visually) without giving the device a chance to do "defend itself", whereas even the best-case PIN attack* wouldn't necessarily exhaust possibilities before 10 tries. I personally like the swipe gesture, as it is even somewhat resistant to a shoulder-surfing attack (assuming you're turned off horrendous default of drawing the pattern as you drag over it) and is much faster than typing a PIN. * Excluding shoulder-surfing attacks. You know the digits (smudges have built up over them), but not the order.
- arrrg 12y ago
  Weigh the probability of someone producing a fingerprint replica vs. someone shoulder-surfing. The first seems exceedingly unlikely to me, while the second is at least plausible.
  - yourad_io 12y ago
    Fair enough. The only issue is that all (ok, most) your data is on your phone, as are your fingerprints - so if you lose it[1], in all likelihood they'll be happy they got a $1K device for free and wipe it, but if they were determined to get in to get (say) your SSH keys, or something... yeah. They'd need a few hours and some not-so-hard to get machinery. [1] Especially if it is stolen. "I wasn't targeted. Was I targeted? Nah, I wasn't targeted. Just a crime of opportunity. Yes. For sure.".
    - arrrg 12y ago
      There is nothing valuable (expect potentially embarrassing private information that is, however, completely worthless to some random thief) on my phone that is protected by my fingerprint. The valuable stuff (especially passwords) can’t be accessed with my fingerprint. So for me personally that is irrelevant.

lelf 12y ago

http://www.ccc.de/en/updates/2014/ursel http://www.ccc.de/en/updates/2014/ursel