Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Does airport fingerprinting compromise my biometric security?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 73 posts

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#61

Post by eesmith »

gorbypark wrote: post #54
eesmith wrote: post #47

Earlier quoted context omitted.

That was nearly 22 years ago. Does the same attack still work against most modern biometric scanners?

We don't know what kind of sensors was used to test this in the article, but there are two main types of fingerprint sensors, optical and capacitive. Optical is just a camera, basically. Capacitive actually measures the variation in electric conductivity caused by the ridges of the fingerprint and can build a unique ID from that. I think the "make a cast of the finger in an electrically conductive material that is mo…

The list of devices is on page 21 (of 33) in the presentation at https://web.archive.org/web/20030315060403/https://www.itu.i... . Seven were optical, four capacitive.

I understand a sufficiently capable attacker may be able to bypass fingerprints.

My question is does the gummy bear method (or really, the gelatin method), still work against most modern fingerprint readers?

Even the 2003 research pointed out, at https://totseans.com/totse/en/bad_ideas/locks_and_security/1... , "If "live and well" detectors can clearly distinguish their moisture, electric resistance, transparency or bubble content (i.e., bubble rich material or not) between live fingers and gummy fingers, fingerprint systems can reject gummy fingers. Also, detection of compliance would be helpful for preventing gummy fingers. Furthermore, some of measures which have been proposed in patent literature may be useful in preventing gummy fingers."

Have those methods been widely integrated to make that 20+ year old method no longer viable?

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#63

Post by cassianoleal »

GuB-42 wrote: post #36

You are already putting copies of your fingerprints everywhere, by just touching stuff. Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the devic…

I don't buy this.

Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.

With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.

If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.

Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#64

Post by throwaway167 »

If you're concerned about security, don't have all your sensitive information packed into a phone.

30 years ago much of the population was concerned about typing a credit card number into 'the internet'. Now we have a small, hackable, stealable, insecure by design device with bank, personal communications, business communications, social security, family photos and numerous more data depending on your choice of app. It's a great win of drip-drip very convenient life is faster now (it isn't, there's just more gap for not planning).

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#65

Post by camillomiller »

whacko_quacko wrote: post #32
camillomiller wrote: post #29

Earlier quoted context omitted.

Ok, granpa!

This is the insightful commentary that I came to expect of HN /s

Look, check my history. You guys need to chill the hell out a bit. The comment I replied to was the most boomer comment ever, and a snarky reply didn’t hurt anyone nor the vibe. This attention to this presumed constructive etiquette in this monocultural community really is a self-ironic joke sometimes.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#68

Post by tiberious726 »

cassianoleal wrote: post #63
GuB-42 wrote: post #36

You are already putting copies of your fingerprints everywhere, by just touching stuff. Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the devic…

I don't buy this. Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology. With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms. If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my ret…

This is simply untrue, and anyone who follows this advice will fail a NIST audit: https://csrc.nist.gov/glossary/term/multi_factor_authenticat....

All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#69

Post by tiberious726 »

asenna wrote: post #25
anoopelias wrote: post #10

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1] This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days. [1] https://uidai.gov.in/en/

It's not just the fingerprints, they have the scan of the retina for the entire population. It's a disaster waiting to happen.

What retina scanners do they use? I've been trying to get some to do 3FA on high security areas for years and can't find any that seem decent. (Note that iris scanning is completely different than retina scanning, and is just about as useless as face scanning.)

Re: Ask HN: Does airport fingerprinting compromise my biometric security?

#70

Post by odyssey7 »

somerandomqaguy wrote: post #40
odyssey7 wrote: post #26

Earlier quoted context omitted.

Though the traveler may not be particularly interesting, their employer’s trade secrets or database access might be up there.

Perhaps. I would hope that anyone accessing confidential information on a phone with such flimsy security would understand the risks they're taking. If not then I'd question what their IT department was doing not forcing a least PIN unlock on the phone.

So it is a legitimate concern after all?
Post reply on HN