Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones can be fooled by fake, digitally composed fingerprints

nytimes.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#21

Post by djrogers »

I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations - for example:

"Experiments on a capacitive fingerprint dataset, similar to the one used by Apple TouchID, showed that it is possible to break 6.88% of users’ account in 5 attempts if the FMR setting of the matching algorithm (Verifinger 6.1 SDK) was set to 0.01% and each subject was enrolled with one finger and 12 partial impressions per finger."

It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID.

The way you believe TouchID works may be significantly better or worse than it actually does, so don't you need to test iPhones if you're going to be giving scary quotes to reporters about them being insecure?

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#22

Post by djrogers »

mediocrejoker wrote: post #4
mmastrac wrote: post #2

This is the IEEE paper referenced in the article: http://ieeexplore.ieee.org/document/7893784/?reload=true PDF version: http://www.cse.msu.edu/~rossarun/pubs/RoyMemonRossMasterPrin... Abstract: This paper investigates the security of partial fingerprint-based authentication systems, especially when mul- tiple fingerprints of a user are enrolled. A number of con- sumer electronic devices, such as smartphones, are begi…

I skimmed the paper but I don't see which iPhone they were able to unlock with this method. Do you know if the resolution of the fingerprint scanner differs between iPhone models?

> I don't see which iPhone they were able to unlock with this method

They either didn't try, or were unable to and didn't document the results.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#24

Post by majke »

crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob!

My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unhashed_ template of your fingerprint.

But this is not my area of expertise. Perhaps a subject matter expert can comment.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#25

Post by nyolfen »

hollander wrote: post #8
2bitencryption wrote: post #5

Totally not relevant, but holy cow Google Translate is getting good. I swear I've read articles in plain English that were less comprehensible than this translated on, by a mile.

Does this have to do with German being such a structured language? Just a guess here, but it may explain things a bit.

basically, there's just a larger body of translated work to develop from for western european languages because the EU has to translate all official documents between the major languages

> One explanation could have to do with the text the algorithm uses to generate its translations. Google Translate works by drawing from vast banks of text, searching for patterns in language use to match future translation requests. Some of those texts include documents from the United Nations and the European Union that have to be translated into multiple languages.

(from first result i found for this bit of trivia but probably not the best: https://www.theatlantic.com/technology/archive/2014/08/a-sec... )

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#26

Post by NwmG »

majke wrote: post #24
crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

Yeah, pretty much. It compares the minutiae[1] from the new scan against that from one, or multiple saved scans from registration.

[1]https://www.wikiwand.com/en/Minutiae

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#27

Post by out_of_protocol »

majke wrote: post #24
crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

Indeed it is, inside a sensor (that's why so much trouble replacing one on iphone), gladly raw data never leaves it (same goes for Android as well, except really really old versions, like 4-)

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#28

Post by artpar »

crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

They covered it in the article.

> Full human fingerprints are difficult to falsify, but the finger scanners on phones are so small that they read only partial fingerprints. When a user sets up fingerprint security on an Apple iPhone or a phone that runs Google’s Android software, the phone typically takes eight to 10 images of a finger to make it easier to make a match. And many users record more than one finger — say, the thumb and forefinger of each hand.

> Since a finger swipe has to match only one stored image to unlock the phone, the system is vulnerable to false matches.

> “It’s as if you have 30 passwords and the attacker only has to match one,” said Nasir Memon

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#29

Post by ars »

The phone is covered with fingerprints from the owner anyway.

If you have the phone, you already have the "password". The fingerprint scan is just to make it a little bit annoying for attacker, so they'll factory reset instead of bothering to crack it.

It's not intended for any kind of real security.

Like many others here I never used to lock my phone at all until the fingerprint scan, and I don't consider the scan as a form of security, but rather as a quick way to turn on the phone.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#30

Post by theoh »

majke wrote: post #24
crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

I'm not an expert, but I remember getting an impression of a very principled approach to biometrics from John Daugman. This article is about iris recognition and I'm pretty sure it is worth posting in this context: https://www.cl.cam.ac.uk/~jgd1000/csvt.pdf
Post reply on HN