Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does airport fingerprinting compromise my biometric security?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 73 posts

Ask HN: Does airport fingerprinting compromise my biometric security?

#1

Post by sampling »

I recently went through airport security on an international flight where they recorded my fingerprints.

Like many others, my smartphone can be accessed via biometric fingerprint login to reveal sensitive data such as email.

This got me thinking about the security implications for my smartphone. I'm curious about the potential risks and how secure my data really is after such an interaction. Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#2

Post by patates »

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate.

Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone?

> Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?

I think not, if the third party is a government.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#3

Post by haarts »

patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#5

Post by pointlessone »

haarts wrote: post #3
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

In Russia they don’t use harvested fingerprints to unlock phones. They use wrenches and flat irons to get info and bad windows on higher floors and polonium tea to prevent anyone else getting info.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#6

Post by number6 »

Biometrics are a terrible choice for sensitive information:

* It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/)

* You will leave fingerprints and other biometric features everywhere.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#7

Post by heads »

patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

Fingerprints alone are simply a number that is generated by your finger on a reader, and then sent to some other system.

Think of a fingerprint reader as a USB keyboard that types out your fingerprint number for you when you touch it. While an attacker can steal the finger and put it on the reader they are more likely to steal the number and type it in with a regular keyboard.

Border controls are about building a (passport, face, fingerprint) tuple under human (or remote human) supervision on trusted hardware to control physical movement. It feels like one of the few cases where fingerprint readers do actually work as an application.

Now that the border police have your magic finger number they can indeed unlock your phone too. It’s an offline attack though — they need to get logic probes between the reader and the CPU — so if the phone locks with a PIN after reboot, magic key press, or a period of time then that’s the appropriate defence.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#8

Post by underdeserver »

pointlessone wrote: post #5
haarts wrote: post #3

Earlier quoted context omitted.

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

In Russia they don’t use harvested fingerprints to unlock phones. They use wrenches and flat irons to get info and bad windows on higher floors and polonium tea to prevent anyone else getting info.

Not only in Russia.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#9

Post by amenghra »

haarts wrote: post #3
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

Just because your government can break your opsec doesn’t imply it’s not worth doing your best. Maybe you’ll avoid being caught in a lower-cost/mass surveillance system and you might not do anything to attract a more dedicated attack.

Re fingerprint: there’s risks around having your fingerprint lifted from something you touch (eg a glass). It’s a movie trope but it’s not that far fetched from being doable. Eg from 20 years ago: https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#10

Post by anoopelias »

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1]

This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days.

[1] https://uidai.gov.in/en/

Post reply on HN