6 ms·

Politician's fingerprint 'cloned from photos' by hacker

96 points by Libertatea 12y ago

mkal_tsr 12y ago
I think Taylor Swift said it best, Remember: Fingerprint locks are convenient, but they discard your ability to "forget" or refuse to unlock a device. They remove consent. [ source - https://twitter.com/SwiftOnSecurity https://twitter.com/SwiftOnSecurity / https://imgur.com/a/1PDRJ https://imgur.com/a/1PDRJ / ] Can anyone intent on downvoting explain what is factually wrong or misleading about the quote in the picture? Just because it's on a picture doesn't make it less valid.
- Raphmedia 12y ago
  Wait, what? I'm out of the loop there. Is that a meme, or is Taylor Swift really saying this?
  - mkal_tsr 12y ago
    It's a meme by that twitter account
    - Houshalter 12y ago
      Is it a meme if it's just text on an image? It has to at least be multiple people doing it to be a meme.
      - mkal_tsr 12y ago
        I just chose the not 100%-false option of the two ;-)
  - frozenport 12y ago
    Its a time honored tradition, see Britney Spears' Guide to Semiconductor Physics [*] http://britneyspears.ac/lasers.htm http://britneyspears.ac/lasers.htm
- calvin_c 12y ago
  If the subject you'd like to bring to discussion is the quote, post the quote. If you want to bring up a humorous Twitter account dealing with security concerns, post the Twitter account. Reposting a meme posted by that account doesn't serve either purpose very well.
  - mkal_tsr 12y ago
    I posted the original source from the creator, the Twitter account which made the Imgur album. I have swapped the .jpg with the text quote ... I just find it odd HN is so primary-source averse.
  - patal 12y ago
    If the subject you'd like to bring to discussion is no humour on HN, post no humour on HN. If you want to bring up your confusion about how Taylor Swift and security go together, just say so. Gruntling away in your post doesn't serve either purpose very well. You're being mean to parent.
- dfxm12 12y ago
  I didn't downvote, but your post is off topic. If the article was about a case where a person was mandated to unlock their phone because it is only protected by a fingerprint scan, (and of course a person cannot "forget" their fingerprint like they can a password), then your quote would have been on topic. Yeah, the quote is about fingerprints, but it's really orthogonal to the topic of the article, which is that fingerprints can be "cracked" just like passwords. That's not what the quote you posted is about. The quote is about the fifth amendment (of the US constitution): https://www.eff.org/issues/know-your-rights#17 https://www.eff.org/issues/know-your-rights#17
  - mkal_tsr 12y ago
    You don't think the ability to use photographs of hands/fingers and used for fingerprint readers is relevant to a quote about using fingerprints as passwords has a security gap of consent? I'm sorry but what? We've seen many times that fingerprint readers can be fooled, and pointing out that pictures of hands/fingers could be used against you is highly relevant to a decision of securing something with fingerprints or not.
adityab 12y ago
Link to talk video: http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug.html#video http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_...
digisth 12y ago
For systems using biometric auth, wouldn't the next step to make it multi-factor biometrics (i.e., obtaining a confidence value based on the combination of fingerprint, face, vein pattern, gait, voice, etc.) rather than the simple one-to-one matching systems we use for it now?
- frozenport 12y ago
  As you add authentication mechanisms your sources of errors grows, making life frustrating. For example, voice can change over time.
- Retric 12y ago
  Your far better off simply supervising people while collecting biometrics. Think, guard at the door while you walk into a facility who compares your photo in their sytem with what you look like vs. fingerprint reader at a workstation. Granted, there also useful limiting casual access. Think kid/roomate using someone elses work laptop vs. a dedicated hacking attempt.
jelder 12y ago
Krissler is providing a huge service here. It's a great illustration of the fact that fingerprints and other biometrics are analogous to usernames and are completely unlike passwords. It's like Apple and other biometric device purveyors are telling us all to just log in with our username and a blank password. At the moment we're all scrawling our passwords on every surface of every room we enter.
- objclxt 12y ago
  Well, it's a little different, because as far as I can tell he has reconstructed a 2D image of the fingerprint, but not used that fingerprint successfully for any authentication system.
  - glesica 12y ago
    I'm not sure that is accurate... "As an example, he demonstrated how he could use his fake fingerprint to unlock his iPhone — that features a ‘Touch ID’ fingerprint sensor integrated into its home button." http://www.iphonehacks.com/2014/12/hackers-reproduce-fingerprints-german-defense-minister-public-photos.html http://www.iphonehacks.com/2014/12/hackers-reproduce-fingerp... It isn't entirely clear which fake fingerprint was used. I guess we should probably watch the CCC talk.
    - carlosrg 12y ago
      > It isn't entirely clear which fake fingerprint was used. Obviously his own fingerprint. He doesn't have access to the German Defense Minister iPhone to test the real one (assuming the Defense Minister uses an iPhone and has Touch ID configured).
      - glesica 12y ago
        Hehe well obviously not hers. What I meant was that it wasn't clear how he built the fake fingerprint he tested, whether he used the exact same method he used to construct the defense minister's fingerprint, or whether he "cheated" to make it easier on himself.
HackinOut 12y ago
Yesterdays's HN discussion about this: https://news.ycombinator.com/item?id=8806394 https://news.ycombinator.com/item?id=8806394
xexers 12y ago
I wonder how well this technique would work with the keys to your house... based on say 50 photos of you with your keys dangling, could you reconstruct the key and then 3d print it?
- lt 12y ago
  This is well available today. For example, there's an app for that: https://keysduplicated.com/ https://keysduplicated.com/
- matthewmacleod 12y ago
  You don't even need 50 photos – this was done some time ago using a single photo. See http://vision.ucsd.edu/~blaxton/sneakey.html http://vision.ucsd.edu/~blaxton/sneakey.html for an overview.
- masklinn 12y ago
  That's been done for quite some time now. A single picture is sufficient for single-sided or double-sided cut keys.
- cheese0r 12y ago
  One photo could be enough. There was a talk about this two years ago at 29c3. It's only available in German unfortunately (https://www.youtube.com/watch?v=3JK3TO_crc8 https://www.youtube.com/watch?v=3JK3TO_crc8) Lockpicking has always been a big topic at the conference.
- vermontdevil 12y ago
  I remember some years back Diebold posted a photo of their key that unlocks voting machines (or ATM?) as part of their marketing material. Hackers were able to copy the key and open up these machines.
learnstats2 12y ago
Are Samsung and Apple really the most important aspect of this issue? People are convicted of crimes on the strength of their fingerprint.
- HackinOut 12y ago
  Testimonies can by themselves end up into a conviction. I am not sure this is comparable. When a crime is committed any evidence is welcome to try and solve it. Investigators are not "choosing" their type of evidences like you can choose a type of digital protection.
  - learnstats2 12y ago
    I made you a comparison: Apple is using fingerprint evidence to allow or deny access to a phone. Judiciary around the world is using fingerprint evidence to lock people up, deny them basic rights, and sometimes to kill them.
  - anigbrowl 12y ago
    I think his point is that you could frame someone using this method. Juries tend to give lots of weight to forensic evidence, often more than is scientifically justified. If you hear 'his fingerprints were found on the murder weapon' then for most people that is more than enough.

96 points by Libertatea 12y ago

I think Taylor Swift said it best, Remember: Fingerprint locks are convenient, but they discard your ability to "forget" or refuse to unlock a device. They remove consent. [ source - https://twitter.com/SwiftOnSecurity https://twitter.com/SwiftOnSecurity / https://imgur.com/a/1PDRJ https://imgur.com/a/1PDRJ / ] Can anyone intent on downvoting explain what is factually wrong or misleading about the quote in the picture? Just because it's on a picture doesn't make it less valid.

Raphmedia 12y ago
Wait, what? I'm out of the loop there. Is that a meme, or is Taylor Swift really saying this?
- mkal_tsr 12y ago
  It's a meme by that twitter account
  - Houshalter 12y ago
    Is it a meme if it's just text on an image? It has to at least be multiple people doing it to be a meme.
    - mkal_tsr 12y ago
      I just chose the not 100%-false option of the two ;-)
- frozenport 12y ago
  Its a time honored tradition, see Britney Spears' Guide to Semiconductor Physics [*] http://britneyspears.ac/lasers.htm http://britneyspears.ac/lasers.htm
calvin_c 12y ago
If the subject you'd like to bring to discussion is the quote, post the quote. If you want to bring up a humorous Twitter account dealing with security concerns, post the Twitter account. Reposting a meme posted by that account doesn't serve either purpose very well.
- mkal_tsr 12y ago
  I posted the original source from the creator, the Twitter account which made the Imgur album. I have swapped the .jpg with the text quote ... I just find it odd HN is so primary-source averse.
- patal 12y ago
  If the subject you'd like to bring to discussion is no humour on HN, post no humour on HN. If you want to bring up your confusion about how Taylor Swift and security go together, just say so. Gruntling away in your post doesn't serve either purpose very well. You're being mean to parent.
dfxm12 12y ago
I didn't downvote, but your post is off topic. If the article was about a case where a person was mandated to unlock their phone because it is only protected by a fingerprint scan, (and of course a person cannot "forget" their fingerprint like they can a password), then your quote would have been on topic. Yeah, the quote is about fingerprints, but it's really orthogonal to the topic of the article, which is that fingerprints can be "cracked" just like passwords. That's not what the quote you posted is about. The quote is about the fifth amendment (of the US constitution): https://www.eff.org/issues/know-your-rights#17 https://www.eff.org/issues/know-your-rights#17
- mkal_tsr 12y ago
  You don't think the ability to use photographs of hands/fingers and used for fingerprint readers is relevant to a quote about using fingerprints as passwords has a security gap of consent? I'm sorry but what? We've seen many times that fingerprint readers can be fooled, and pointing out that pictures of hands/fingers could be used against you is highly relevant to a decision of securing something with fingerprints or not.

adityab 12y ago

Link to talk video: http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug.html#video http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_...

digisth 12y ago

For systems using biometric auth, wouldn't the next step to make it multi-factor biometrics (i.e., obtaining a confidence value based on the combination of fingerprint, face, vein pattern, gait, voice, etc.) rather than the simple one-to-one matching systems we use for it now?

frozenport 12y ago
As you add authentication mechanisms your sources of errors grows, making life frustrating. For example, voice can change over time.
Retric 12y ago
Your far better off simply supervising people while collecting biometrics. Think, guard at the door while you walk into a facility who compares your photo in their sytem with what you look like vs. fingerprint reader at a workstation. Granted, there also useful limiting casual access. Think kid/roomate using someone elses work laptop vs. a dedicated hacking attempt.

jelder 12y ago

Krissler is providing a huge service here. It's a great illustration of the fact that fingerprints and other biometrics are analogous to usernames and are completely unlike passwords. It's like Apple and other biometric device purveyors are telling us all to just log in with our username and a blank password. At the moment we're all scrawling our passwords on every surface of every room we enter.

objclxt 12y ago
Well, it's a little different, because as far as I can tell he has reconstructed a 2D image of the fingerprint, but not used that fingerprint successfully for any authentication system.
- glesica 12y ago
  I'm not sure that is accurate... "As an example, he demonstrated how he could use his fake fingerprint to unlock his iPhone — that features a ‘Touch ID’ fingerprint sensor integrated into its home button." http://www.iphonehacks.com/2014/12/hackers-reproduce-fingerprints-german-defense-minister-public-photos.html http://www.iphonehacks.com/2014/12/hackers-reproduce-fingerp... It isn't entirely clear which fake fingerprint was used. I guess we should probably watch the CCC talk.
  - carlosrg 12y ago
    > It isn't entirely clear which fake fingerprint was used. Obviously his own fingerprint. He doesn't have access to the German Defense Minister iPhone to test the real one (assuming the Defense Minister uses an iPhone and has Touch ID configured).
    - glesica 12y ago
      Hehe well obviously not hers. What I meant was that it wasn't clear how he built the fake fingerprint he tested, whether he used the exact same method he used to construct the defense minister's fingerprint, or whether he "cheated" to make it easier on himself.

HackinOut 12y ago

Yesterdays's HN discussion about this: https://news.ycombinator.com/item?id=8806394 https://news.ycombinator.com/item?id=8806394

xexers 12y ago

I wonder how well this technique would work with the keys to your house... based on say 50 photos of you with your keys dangling, could you reconstruct the key and then 3d print it?

lt 12y ago
This is well available today. For example, there's an app for that: https://keysduplicated.com/ https://keysduplicated.com/
matthewmacleod 12y ago
You don't even need 50 photos – this was done some time ago using a single photo. See http://vision.ucsd.edu/~blaxton/sneakey.html http://vision.ucsd.edu/~blaxton/sneakey.html for an overview.
masklinn 12y ago
That's been done for quite some time now. A single picture is sufficient for single-sided or double-sided cut keys.
cheese0r 12y ago
One photo could be enough. There was a talk about this two years ago at 29c3. It's only available in German unfortunately (https://www.youtube.com/watch?v=3JK3TO_crc8 https://www.youtube.com/watch?v=3JK3TO_crc8) Lockpicking has always been a big topic at the conference.
vermontdevil 12y ago
I remember some years back Diebold posted a photo of their key that unlocks voting machines (or ATM?) as part of their marketing material. Hackers were able to copy the key and open up these machines.

learnstats2 12y ago

Are Samsung and Apple really the most important aspect of this issue? People are convicted of crimes on the strength of their fingerprint.

HackinOut 12y ago
Testimonies can by themselves end up into a conviction. I am not sure this is comparable. When a crime is committed any evidence is welcome to try and solve it. Investigators are not "choosing" their type of evidences like you can choose a type of digital protection.
- learnstats2 12y ago
  I made you a comparison: Apple is using fingerprint evidence to allow or deny access to a phone. Judiciary around the world is using fingerprint evidence to lock people up, deny them basic rights, and sometimes to kill them.
- anigbrowl 12y ago
  I think his point is that you could frame someone using this method. Juries tend to give lots of weight to forensic evidence, often more than is scientifically justified. If you hear 'his fingerprints were found on the murder weapon' then for most people that is more than enough.