Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones can be fooled by fake, digitally composed fingerprints

nytimes.com

Post reply on HN
Print view View original

31–40 of 114 posts

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#31

Post by majke »

out_of_protocol wrote: post #27
majke wrote: post #24

Earlier quoted context omitted.

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

Indeed it is, inside a sensor (that's why so much trouble replacing one on iphone), gladly raw data never leaves it (same goes for Android as well, except really really old versions, like 4-)

"data never leaves it" reference please?

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#33

Post by tdist »

NwmG wrote: post #26
majke wrote: post #24

Earlier quoted context omitted.

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

Yeah, pretty much. It compares the minutiae[1] from the new scan against that from one, or multiple saved scans from registration. [1] https://www.wikiwand.com/en/Minutiae

I addressed this when this study was discussed last week, but it's worth reminding that minutiae comparing is not the only technique used for fingerprint matching. [1]

(possible corporate bias) [1] https://corporate.fingerprints.com/en/newsroom/faq-regarding...

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#34

Post by Animats »

That is really clever. The Ur-fingerprint, developed using simple machine learning. Well, that's the end of using "minutiae" for recognition. Recognition has to use something that requires the features have the proper positional relationship to each other, such as a whole fingerprint.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#35

Post by kefka »

artursapek wrote: post #32

"Your fingerprint is your username, not your password"

No. Not even that. A fingerprint just directly implies presence. And it doesn't even have to be intentional presence either.

A handscan I could see being a login. Because your not going to easily lift that as a fingerprint partial.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#36

Post by NwmG »

tdist wrote: post #33
NwmG wrote: post #26

Earlier quoted context omitted.

Yeah, pretty much. It compares the minutiae[1] from the new scan against that from one, or multiple saved scans from registration. [1] https://www.wikiwand.com/en/Minutiae

I addressed this when this study was discussed last week, but it's worth reminding that minutiae comparing is not the only technique used for fingerprint matching. [1] (possible corporate bias) [1] https://corporate.fingerprints.com/en/newsroom/faq-regarding...

Thanks for the link! Yes there are many ways, I always thought minutiae was most common/simplest. There are some interesting advancements also occuring in the optical tomography. [1]

http://ieeexplore.ieee.org/document/7110228/?reload=true

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#38

Post by H4CK3RM4N »

majke wrote: post #31
out_of_protocol wrote: post #27

Earlier quoted context omitted.

Indeed it is, inside a sensor (that's why so much trouble replacing one on iphone), gladly raw data never leaves it (same goes for Android as well, except really really old versions, like 4-)

"data never leaves it" reference please?

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

You're looking for the bit on the "Secure Enclave".

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#39

Post by delinka »

majke wrote: post #31
out_of_protocol wrote: post #27

Earlier quoted context omitted.

Indeed it is, inside a sensor (that's why so much trouble replacing one on iphone), gladly raw data never leaves it (same goes for Android as well, except really really old versions, like 4-)

"data never leaves it" reference please?

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Find the section titled "Secure Enclave." When the SE needs to store data on the filesystem, it's encrypted with a key that never leaves the SE. Effectively, assuming the encryption is implemented correctly, data 'owned' by the SE is never available to any other part of the system.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#40

Post by et-al »

gwbas1c wrote: post #7

Honestly, I've never cared about the fingerprint reader for security. I just see it as a better way to prevent my phone from turning on in my pocket and butt-dialing someone. I never put a password on my phone before the fingerprint reader. The apps that I care about protecting have password functionality built-in.

> The apps that I care about protecting have password functionality built-in.

1Password on iOS has this issue. You can either unlock by Touch ID or master password. I wish there was fingerprint + PIN option.

Post reply on HN