Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones can be fooled by fake, digitally composed fingerprints

nytimes.com

Post reply on HN
Print view View original

41–50 of 114 posts

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#41

Post by DINKDINK »

crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

>> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number."

>I don't understand how this is possible at all.

You're confusing Sensitivity (also called the true positive rate), Specificity (also called the true negative rate), and conditional probabilities.

>I used to belong to a gym that used a fingerprint reader for entry, and it correctly identified me (flashing my name) from the other 1,000+ members each time.

This is the finger-print reader's sensitivity, P ( Access granted or positive identification | Correct key is supplied [your thumb] ). It is not Probability ( Access granted or positive identification | Incorrect key is supplied)

It's because of Bayes theorem. https://en.wikipedia.org/wiki/Bayes%27_theorem#Drug_testing

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#42

Post by dragonwriter »

artursapek wrote: post #32

"Your fingerprint is your username, not your password"

A fingerprint is not suitable as a username (as it can be physically damaged unrecoverably) or as a password (because it cannot be freely changed if potentially compromised.)

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#43

Post by hawski »

I use fingerprint screen unlock, because it's the most convenient screen unlock mechanism. The phone will not be unlocked by a mistake and it is very fast when you really want it.

I like especially the placement of the sensor on the back cover. When the phone is in front of my face it is already unlocked if I want it.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#44

Post by krrrh »

devrandomguy wrote: post #17
2bitencryption wrote: post #5

Totally not relevant, but holy cow Google Translate is getting good. I swear I've read articles in plain English that were less comprehensible than this translated on, by a mile.

It's pretty good at European languages, but still terrible at Arabic and Japanese. The system still has a very shallow understanding of the content. One of my primarily Arabic-speaking colleagues was actually offended by Google Translate butchering their language so badly; their culture places a relatively high value on poetry, calligraphy, etc. As an exercise, try translating your search queries into Arabic before s…

I wonder how much Arabic translation suffers from a lack of available data to feed the ML. [1]

> Nor are foreign books much translated: in the 1,000 years since the reign of the Caliph Mamoun, say the authors, the Arabs have translated as many books as Spain translates in one year.

[1] http://www.economist.com/node/1213392

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#45

Post by wlesieutre »

majke wrote: post #24
crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

Not cryptographic hashing functions, definitely. What about locality-sensitive hashing?

https://en.wikipedia.org/wiki/Locality-sensitive_hashing

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#46

Post by snarf21 »

dustinkirkland wrote: post #37

Fingerprints are usernames, not passwords. http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...

Exactly this. I've made the same comment other places on here. Fingerprint for username, 8 character alphanumeric for password and mandatory hardware 2FA fobs/keys.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#47

Post by gpawl »

ars wrote: post #29

The phone is covered with fingerprints from the owner anyway. If you have the phone, you already have the "password". The fingerprint scan is just to make it a little bit annoying for attacker, so they'll factory reset instead of bothering to crack it. It's not intended for any kind of real security. Like many others here I never used to lock my phone at all until the fingerprint scan, and I don't consider the scan a…

How do you know that the finger data the scanner uses is present in oil prints?

If this true, someone would have created a working demonstration in the past 5 years.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#48

Post by [deleted] »

majke wrote: post #24
crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob! My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unh…

[deleted]

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#49

Post by mistercow »

crazygringo wrote: post #20

> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…

> it correctly identified me (flashing my name) from the other 1,000+ members each time

That tells you very little. Figuring out which print you're closest too is different from figuring if you match any of the prints on file. How well it does one doesn't really tell you how well it does the other.

Also 1,000 isn't very many. That only requires the same entropy as a 3-digit PIN.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#50

Post by eridius »

djrogers wrote: post #22
mediocrejoker wrote: post #4

Earlier quoted context omitted.

I skimmed the paper but I don't see which iPhone they were able to unlock with this method. Do you know if the resolution of the fingerprint scanner differs between iPhone models?

> I don't see which iPhone they were able to unlock with this method They either didn't try, or were unable to and didn't document the results.

According to the article itself, they never actually tried unlocking a real phone.
Post reply on HN