41–50 of 73 posts
In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/
Two points to make:
First, I don't know about Android, but certainly on iPhone, the fingerprint data is stored in the Secure Enclave and the biometric reader on the phone establishes a secure communications channel (unique session key) with the Secure Enclave. So remote attacks are unfeasable unless you've managed to extract the underlying shared key from the Secure Enclave.[1]
Second, the definition of what is "stored". There are a number of different approaches to storing biometric data, and most if not all "modern" methods will store an algorithmic derivation of some sort rather than actual raw measurement data. Hence if the government is using algorithm A and your phone is using algorithm B, then in all likelyhood there is no viable way to transpose between the two.
Third, generally good OPSEC suggests to disable the biometric login to your phone anyway and rely on a password. That way, for example, someone can't just hit you on the head to render you unconcious and hold your finger to the sensor. (They would have to force the password out of you whilst you were concious, per XKCD[2] ;-)
[1]https://support.apple.com/en-gb/guide/security/sec067eb0c9e/... [2]https://xkcd.com/538/
as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway. if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and c…
Kyrgyzstan also has a similar database but with actual fingerprints, not hashes. It is illegal to not have a passport for anyone 16+ and your cannot have one without fingerprinting. The procedure was introduced by the ruling party to allegedly make elections secure and sponsored by the Japanese government (JAICA).
In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/
It's not just the fingerprints, they have the scan of the retina for the entire population. It's a disaster waiting to happen.
We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either.
In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that some heads are proverbially rolled and some specifications are updated.
Fingerprint is never safe. I can just get your phone and it will be all covered with your fingerprints. It's like sticking a note with a password on your computer :) Personal protip: I use fingerprint lock, but anything sensitive on my phone is blocked with extra pattern lock. With unlocked phone you can access my gallery but you cannot access bank apps. IIRC this will be the built in feature of next Android, I use X…
You are already putting copies of your fingerprints everywhere, by just touching stuff. Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the devic…
Like passkeys, which also cannot reach the secrecy of passwords.
I think the real issue would be physical access. With fairly high resolution 3d printers and a copy of your prints, I'm sure a replica of your prints could be created in a matter of minutes. Imagine you are at an airport and customs wants to look at your phone. You refuse to unlock it. Depending on the country, they can compel you to do so. If you refuse to comply, if they have a copy of your prints they could just h…
You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear! https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...
You are already putting copies of your fingerprints everywhere, by just touching stuff. Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the devic…
> Your fingerprint itself is already available to anyone who cares.
In that case your fingerprint can't prove you're here then
Fingerprint is never safe. I can just get your phone and it will be all covered with your fingerprints. It's like sticking a note with a password on your computer :) Personal protip: I use fingerprint lock, but anything sensitive on my phone is blocked with extra pattern lock. With unlocked phone you can access my gallery but you cannot access bank apps. IIRC this will be the built in feature of next Android, I use X…
What ROM are you using on your Xiaomi?
But actually you made me think.. So I'm not sure about current models sold in EU, they removed a lot of MIUI features and replaced them with shitty Google alternatives on EU roms. But would they remove such a "deep" feature? It's not "just an app", it's a system core feature to me.
If you have this "Security"/"Control panel" (idk how it's named in English right now) app (the one with green shield icon) this feature should be available to you
Earlier quoted context omitted.
> Biometrics are a terrible choice for sensitive information [..] It is easier to push your thumb on a screen than to pry a password out of your head It's way worse than that, you may only need photographs of someone's thumb: https://arstechnica.com/information-technology/2014/12/polit...
You can also just use a gummy bear https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...
The CCC improvement worked merely from photos of the victim's thumb...