Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does airport fingerprinting compromise my biometric security?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 73 posts

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#51

Post by gorbypark »

CableNinja wrote: post #37
gorbypark wrote: post #13

I think the real issue would be physical access. With fairly high resolution 3d printers and a copy of your prints, I'm sure a replica of your prints could be created in a matter of minutes. Imagine you are at an airport and customs wants to look at your phone. You refuse to unlock it. Depending on the country, they can compel you to do so. If you refuse to comply, if they have a copy of your prints they could just h…

You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear! https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

Well to be fair, the article is about a guy etching fingerprints into a photosensitive PCB to essentially create a mould, then using gelatine to cast a fingerprint....seems way more advanced than directly printing out replica finger or at least printing out a mould and casting it more or less like the article mentions with gelatine.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#52

Post by eesmith »

alkonaut wrote: post #17

The only time I have used fingerprints for flights is for bag drop. That is, the fingerprint verifies that the same person dropping the bag is the one that later boards the flight. In that scenario the fingerprint is not needed after that, and I'm sure there is no regulatory permission to store biometric data for any longer period of time than necessary, which is only until the plane leaves. I haven't seen these syst…

> I trust face unlock to prevent my kids unlocking my phone but that's a whole different kind of threat model from a state actor.

As long as you keep the default of requiring attention, face lock is likely safer than a fingerprint from the kid threat vector.

"Fox News reports that six-year-old Ashlynd Howell from Arkansas spotted her mother Bethany taking a nap on the couch. The girl then took her sleeping mother’s thumb and placed it on her iPhone’s fingerprint reader to unlock the device, all so she could order $250 worth of Pokémon merchandise on Amazon." - https://wsvn.com/news/us-world/6-year-old-uses-sleeping-moms...

"Cryptographic expert Matthew Green has found his son Harrison bypassing the security measures, CNN Money reports, by swiping the phone with his thumb while he slept" - https://www.dailydot.com/debug/touch-id-child-iphone-unlock/

Though depending on how deeply you sleep:

"Man opens eyelids of sleeping girlfriend to unlock her phone, steals over Rs 18 lakh from her bank app" - https://www.indiatoday.in/technology/news/story/man-opens-ey...

and from five years ago: "Heavy sleepers, beware: Researchers bypass Apple FaceID using glasses with tape" - https://www.digitaltrends.com/mobile/apple-faceid-tricked-by...

Bonus: "Face ID shown unlocking for family members who aren’t alike" - https://bgr.com/tech/iphone-x-face-id-hack-family-members/ with the suggestion that Face ID continuously updates the facial features, and by sharing the phone the recognition algorithm may have ended up trained on both faces.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#53

Post by Daviey »

rakoo wrote: post #48
GuB-42 wrote: post #36

You are already putting copies of your fingerprints everywhere, by just touching stuff. Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the devic…

> The fingerprint is a second factor ("something you are"), a way to make sure the device is in your hands and not someone else's hand. > Your fingerprint itself is already available to anyone who cares. In that case your fingerprint can't prove you're here then

And this is why multiple factors are essential. It does indicate that you've had proximity to the credentials.

Ie, if I replicated your fingerprints from a drink glass in a bar, I'd likely not know your name (username) or password, which would be the first factor.

Equally if I got your credentials from a dark web leak, I'd not know your biometrics, which would be your second factor.

It isn't foolproof, but it is certainly significantly more secure than just making your password more complex.

That said, I do prefer fingerprints being an identifier (or username) rather than a credential, but as part of an MFA process I feel it adds value.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#54

Post by gorbypark »

eesmith wrote: post #47
CableNinja wrote: post #37

Earlier quoted context omitted.

You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear! https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

That was nearly 22 years ago. Does the same attack still work against most modern biometric scanners?

We don't know what kind of sensors was used to test this in the article, but there are two main types of fingerprint sensors, optical and capacitive. Optical is just a camera, basically. Capacitive actually measures the variation in electric conductivity caused by the ridges of the fingerprint and can build a unique ID from that. I think the "make a cast of the finger in an electrically conductive material that is more or less within the variation of resistance of an average human finger" method would work with these, too. There are more advanced sensors that are based on capacitive touch, but have anti-cheating measures, such as making sure you have a heart beat and whatnot (think of how pulse ox meters that clip onto your finger work). I am not sure if any phone's use the more advanced types, though. I think all of them would be defeatable by a motivated attacker, even "at scale". I imagine you could create a "skeleton" of a thumb that would defeat a heart rate based verification method, and then a 3d printed fingerprint cast in a conductive material could be slipped over it, etc.

I think FaceID would be more secure based on the fact that it would be hard to fake an entire face at scale (faceID does a bunch of verification type stuff too to make sure you are not just pointing the sensor at a dummy that looks like a person). At the end of the day though, if an attacker has a sufficiently high res scan of your finger or face, and enough time/money/will, any type of biometrics could be bypassed.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#55

Post by euazOn »

dzek69 wrote: post #49
euazOn wrote: post #45

Earlier quoted context omitted.

What ROM are you using on your Xiaomi?

It should not matter that I'm using Xiaomi.eu ROM, this was available on stock rom too. But actually you made me think.. So I'm not sure about current models sold in EU, they removed a lot of MIUI features and replaced them with shitty Google alternatives on EU roms. But would they remove such a "deep" feature? It's not "just an app", it's a system core feature to me. If you have this "Security"/"Control panel" (idk…

Thanks. My question was aimed more towards both caring about security and using a stock MIUI ROM, which seem to contradict each other.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#56

Post by asenna »

bayindirh wrote: post #44
asenna wrote: post #25

Earlier quoted context omitted.

It's not just the fingerprints, they have the scan of the retina for the entire population. It's a disaster waiting to happen.

I'm not sure retina is included in every passport. We're not a member of the EU, but our IDs and passports are compatible. We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either. In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that…

Na, the one that me and the parent are referring to does not apply for visitors. It's for all citizens of India that have opted for the Adhaar card (which is pretty much the entire population).

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#57

Post by bayindirh »

asenna wrote: post #56
bayindirh wrote: post #44

Earlier quoted context omitted.

I'm not sure retina is included in every passport. We're not a member of the EU, but our IDs and passports are compatible. We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either. In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that…

Na, the one that me and the parent are referring to does not apply for visitors. It's for all citizens of India that have opted for the Adhaar card (which is pretty much the entire population).

I know India does this, but I'm not aware that EU countries are doing this, for their population.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#59

Post by superasn »

eesmith wrote: post #47
CableNinja wrote: post #37

Earlier quoted context omitted.

You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear! https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

That was nearly 22 years ago. Does the same attack still work against most modern biometric scanners?

Well if you have a Google pixel you have nothing to worry as it won't recognise legit fingerprint 9 out of 10 times.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#60

Post by JakubDotPy »

asenna wrote: post #25
anoopelias wrote: post #10

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/

It's not just the fingerprints, they have the scan of the retina for the entire population. It's a disaster waiting to happen.

India is a disaster already happening.
Post reply on HN