I hope the banks will be cautious on the possibilities of identity thief on loaning on somebody's account.
Understanding the ginormous Philippines data breach
31–40 of 93 posts
Re: Understanding the ginormous Philippines data breach
#32> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…
If someone's going to use biometrics, please just use a face picture. People understand that their face is mechanically recognizable, and don't have the same false confidence in pictures that they have in fingerprints.
Re: Understanding the ginormous Philippines data breach
#33> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…
The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
Re: Understanding the ginormous Philippines data breach
#34Earlier quoted context omitted.
Your username is even appropriate... I am very worried with Brazil's push to require biometric fingerprits to vote, AND voting being mandatory...
Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – V…
> Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now?
If they already have fingerprints, and now fingerprints are suddenly required for voting, that makes election fraud easier for the government.
Re: Understanding the ginormous Philippines data breach
#35Earlier quoted context omitted.
The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
Though nothings perfect. Has anyone in practice managed to steal anything at all by hacking Touch ID?
It's not really about hacking Touch ID. Apple has published a really thorough whitepaper[0] on the security of Touch ID and the secure enclave. I don't really think that hacking the Secure Enclave to extract fingerprints is even possible.
The problem I see is using fingerprints which are unique to your person, unchangeable, and spread around us in a very liberal fashion as passwords.
Imagine for a second that the San Bernardino iPhone had used Touch ID, don't you find it highly plausible that the US government would be able to find a good fingerprint that could be used to unlock the phone? I guess they even had his body at hand so it would have been dead simple.
0: https://www.apple.com/business/docs/iOS_Security_Guide.pdf
Re: Understanding the ginormous Philippines data breach
#36> As serious as the info above is, it’s only scratching the surface. Per the reports linked to earlier, there’s also biometric data relating to fingerprints in the system. This contains columns names such as these: > PRINT_FLAG, FINGER_INFO, FINGER_TOPO_COORD, QUALITY, MATCHING_FINGER > The values within there can be quite detailed and I’ve no reason to think that this isn’t indeed legitimate print data uniquely and…
The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
Touch ID is like a bike lock. It won't stop a sophisticated attacker, but it's enough to stop your coworkers from reading your messages, and it makes the phone worthless for thieves.
The biggest advantage of Touch ID is that people who never had a passcode on their phone now use it.
Re: Understanding the ginormous Philippines data breach
#37Earlier quoted context omitted.
Considering you need to provide fingerprints to request all sorts of documents, what would the government be able to do that they aren't already able now? Here's a list of documents you need to provide fingerprints, off the top of my head: – National identity card (RG), mandatory for all citizens over 18 years of age; – Military conscription certificate (CAM), mandatory for all male citizens over 18 years of age; – V…
In my state these were all just printed on the document (at least last time I had to make documents). You cannot "hack" a piece of paper easily... But with mandatory vote + mandatory fingerprint to vote, you just turn that database in a giant juicy target, an attacker can be sure that all voters will have fingerprints there.
Do you have any assurances your paper documents were not immediately scanned? Do you know what kind of access controls are enforced on the file cabinet they're stored in? Are they susceptible to a janitor who gets approached by a shady dude with a briefcase of money? The larger point I'm trying to make is that this is no longer something you have control over and have no guarantees about who else has a copy of it, and therefore should not be relying on it being kept secret, and moreover should assume it has been compromised.
Re: Understanding the ginormous Philippines data breach
#38Earlier quoted context omitted.
The whole notion of using fingerprints for authentication is weird. Essentially something that's akin to a username is being used as a password. I've wrote about this practice the other day[0]. It's interesting to observe that when Apple announced Touch ID for example it was presented as something with improved security. 0: https://hugotunius.se/2016/04/11/why-i-disabled-touch-id-and...
Touch ID is like a bike lock. It won't stop a sophisticated attacker, but it's enough to stop your coworkers from reading your messages, and it makes the phone worthless for thieves. The biggest advantage of Touch ID is that people who never had a passcode on their phone now use it.
That's a good point. For people who never had a passcode it's big step up in security. It definitely depends on what the threat model is. If you are protecting yourself from coworkers it might be enough(depending on who your coworkers are). If you are protecting yourself against state level actors such as the FBI it's probably pretty worthless.
Re: Understanding the ginormous Philippines data breach
#39Earlier quoted context omitted.
You can require biometrics and still not record them. Just use them as a hash lookup into a keystore. The biometric itself would only exist on the server for a few cycles while the key was being looked up. (Very similar to the way credit cards are done)
However, Fingerprints cannot be practically hashed.
Images can be hashed(and hashed in such a way that minor changes can still lead to the same hash), so images of fingerprints should be hashable.
Re: Understanding the ginormous Philippines data breach
#40Increasely wonder why average person trust any party to secure data that literally belongs to them.
Are there any startups that are building tech allow end-to-end identity management systems? Seems like a huge market.