Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does airport fingerprinting compromise my biometric security?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#31

Post by dzek69 »

Fingerprint is never safe. I can just get your phone and it will be all covered with your fingerprints.

It's like sticking a note with a password on your computer :)

Personal protip: I use fingerprint lock, but anything sensitive on my phone is blocked with extra pattern lock. With unlocked phone you can access my gallery but you cannot access bank apps. IIRC this will be the built in feature of next Android, I use Xiaomi smartphone which has many extra security features like this one since basically always. Maybe there is an app for this too, I don't know.

Of course this isn't 100% secure, I probably have USB Debugging unlocked, but at least saves me from a random person just grabbing my phone while I'm on a bus and running away with unlocked phone.

Before anyone asks "But aren't bank apps already locked with their own PIN codes?" - yes, they are. But some forces me to have 4 digits PIN only, some even suggests using fingerprint to unlock them (and for some I do). But I'm also blocking Google Play, a browser where I do the most private stuff, I could block a messenger app. Basic apps does not have extra security features.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#33

Post by 6R1M0R4CL3 »

as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway.

if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and creating a fingerprint impression from this will be VERY easy. it takes simple glue and it is very low-cost. you use cyanolate and a gummy bear. the gummy bear will hold the fingerprint while you apply it to the sensor :)

here are a few links : https://blog.kraken.com/product/security/your-fingerprint-ca... https://blog.talosintelligence.com/fingerprint-research/ https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

fingerprints are a conveniance. they will work at home where you want that phone to be protected from your kid you don't want to be accessing internet too easily.

as a security measure, it's stupid because it is very easy to grab fingerprints : you leave those all around. it is also very easy to just create an impression from a picture with a good quality camera. and once it's compromised, you CANNOT change your fingerprint for another one.

do. not. use. fingerprints. for. security.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#35

Post by 6R1M0R4CL3 »

anoopelias wrote: post #10

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/

sooner or later, this is gonna hit you so hard in the butt you will feel it in your mouth.

your gvt will deeply regret this move someday. it's beyond stupid.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#36

Post by GuB-42 »

You are already putting copies of your fingerprints everywhere, by just touching stuff.

Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the device is in your hands and not someone else's hand.

Security depends on the sensor device. That is, how good it is a making a difference between your actual, live finger and something else.

If you are worried about the security of your phone fingerprint sensor, use a password. Your fingerprint itself is already available to anyone who cares.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#37

Post by CableNinja »

gorbypark wrote: post #13

I think the real issue would be physical access. With fairly high resolution 3d printers and a copy of your prints, I'm sure a replica of your prints could be created in a matter of minutes. Imagine you are at an airport and customs wants to look at your phone. You refuse to unlock it. Depending on the country, they can compel you to do so. If you refuse to comply, if they have a copy of your prints they could just h…

You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear!

https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#38

Post by CableNinja »

logifail wrote: post #12
number6 wrote: post #6

Biometrics are a terrible choice for sensitive information: * It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/ ) * You will leave fingerprints and other biometric features everywhere.

> Biometrics are a terrible choice for sensitive information [..] It is easier to push your thumb on a screen than to pry a password out of your head It's way worse than that, you may only need photographs of someone's thumb: https://arstechnica.com/information-technology/2014/12/polit...

You can also just use a gummy bear https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#39

Post by mr_mitm »

6R1M0R4CL3 wrote: post #33

as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway. if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and c…

> as far as i know, we do not store fingerprints but i kind of hash of the fingerprint

Who is "we" in this context?

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#40

Post by somerandomqaguy »

odyssey7 wrote: post #26
somerandomqaguy wrote: post #23

Probably not worth worrying strictly about the info gathered by airport security unless you're a person of interest, either to that nation or it's allies. If you're that interesting to whoever, all bets are off. Plenty of other ways to get info off phone. FWIW I really don't recommend just fingerprint for phone access. You can change a PIN if someone else gets a hold of it, there's not much you can do to change your…

Though the traveler may not be particularly interesting, their employer’s trade secrets or database access might be up there.

Perhaps. I would hope that anyone accessing confidential information on a phone with such flimsy security would understand the risks they're taking.

If not then I'd question what their IT department was doing not forcing a least PIN unlock on the phone.

Post reply on HN