Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does airport fingerprinting compromise my biometric security?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 73 posts

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#11

Post by amenghra »

number6 wrote: post #6

Biometrics are a terrible choice for sensitive information: * It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/ ) * You will leave fingerprints and other biometric features everywhere.

Depending on jurisdiction, there might be cases where law enforcement can force you to use your biometric to unlock your phone but they can’t force you to reveal your pin. Reality vs what’s technically legal makes this comparison hard (ie consult with a local legal expert).

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#12

Post by logifail »

number6 wrote: post #6

Biometrics are a terrible choice for sensitive information: * It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/ ) * You will leave fingerprints and other biometric features everywhere.

> Biometrics are a terrible choice for sensitive information [..] It is easier to push your thumb on a screen than to pry a password out of your head

It's way worse than that, you may only need photographs of someone's thumb:

https://arstechnica.com/information-technology/2014/12/polit...

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#13

Post by gorbypark »

I think the real issue would be physical access. With fairly high resolution 3d printers and a copy of your prints, I'm sure a replica of your prints could be created in a matter of minutes. Imagine you are at an airport and customs wants to look at your phone. You refuse to unlock it. Depending on the country, they can compel you to do so. If you refuse to comply, if they have a copy of your prints they could just have a replica printed out. This is why there is usually a way to set your phone into a state where it requires a passcode, which in theory is more legally protected than biometrics (on an iPhone, hold the power button + volume up/down for a second until you get the screen to turn off / make an emergency call. Even if you now hit cancel the phone requires a passcode to unlock).

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#14

Post by RamblingCTO »

haarts wrote: post #3
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

Yes. You might just accidentally fall out of the window, no problem.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#15

Post by phh »

heads wrote: post #7
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

Fingerprints alone are simply a number that is generated by your finger on a reader, and then sent to some other system. Think of a fingerprint reader as a USB keyboard that types out your fingerprint number for you when you touch it. While an attacker can steal the finger and put it on the reader they are more likely to steal the number and type it in with a regular keyboard. Border controls are about building a (pa…

> It’s an offline attack though — they need to get logic probes between the reader and the CPU — so if the phone locks with a PIN after reboot, magic key press, or a period of time then that’s the appropriate defence.

I'm expecting that if you want to do it at scale (like once a day per airport), you can 3d print them within an hour

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#16

Post by fragmede »

heads wrote: post #7
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

Fingerprints alone are simply a number that is generated by your finger on a reader, and then sent to some other system. Think of a fingerprint reader as a USB keyboard that types out your fingerprint number for you when you touch it. While an attacker can steal the finger and put it on the reader they are more likely to steal the number and type it in with a regular keyboard. Border controls are about building a (pa…

the magic finger number has a challenge response, so they can't do that (to an iphone)

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#17

Post by alkonaut »

The only time I have used fingerprints for flights is for bag drop. That is, the fingerprint verifies that the same person dropping the bag is the one that later boards the flight. In that scenario the fingerprint is not needed after that, and I'm sure there is no regulatory permission to store biometric data for any longer period of time than necessary, which is only until the plane leaves. I haven't seen these systems in a while though so its possible that newer regulation like the GDPR even made them too cumbersome to maintain. Of course there is a risk of compromise in such a system, but if someone wanted your fingerprints specifically it would probably be easier to get them from your car door than hacking an airport system.

Fingerprints for unlocking is not very secure it's just a convenience. Consider it to be equivalent to face unlocking. Anyone who is determined enough will bypass it. Whether it's secure enough depends on your threat model. I trust face unlock to prevent my kids unlocking my phone but that's a whole different kind of threat model from a state actor.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#18

Post by stovestone »

anoopelias wrote: post #10

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/

[dead]

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#19

Post by zahllos »

haarts wrote: post #3
patates wrote: post #2

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate. Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone? > Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint…

If the third party is a government (any random three letter agency) none of your opsec matters. Move to Russia as Snowden did.

Just want to point out that foreign nationals are apparently sometimes fingerprinted and their DNA swabbed too on entry (according to the travel advice of several governments) - and electronic devices are sometimes searched at the border too. Biometrics are routinely taken for longer stays according to: https://www.themoscowtimes.com/2021/07/01/russia-imposes-bio...
Post reply on HN