Smartphones can be fooled by fake, digitally composed fingerprints

Post by ythn » Fri, May 12, 2017, 2:02 AM UTC

DINKDINK wrote: post #53

djrogers wrote: post #21

I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations - for example: "Experiments on a capacitive fingerprint dataset, similar to the one used by Apple TouchID, showed that it is possible to break 6.88% of users’ account in 5 attempts if the FMR…

>It seems that using commercial fingerprint software and captive systems 'similar to the one used by Apple TouchID' is very different from actually testing your theories against, you know, Apple TouchID. In theory, there's no difference between theory in practice; In practice, there is. ;] OTOH, Here is a supposed example of an attacker circumventing TouchID iPhone-access controls: "The video shows in detail how CCC…

Post by bigiain » Fri, May 12, 2017, 2:32 AM UTC

Mtinie wrote: post #82

derefr wrote: post #79

Earlier quoted context omitted.

I was presuming the sort of high-profile target where kidnapping them would quickly get some snipers emplaced and/or a MOAB dropped on you. If you want to, say, steal a nuclear submarine, you can't just kidnap an admiral and force them to hand over the keys. :P

No, that's the inelegant solution. Blackmail works far better with far less blowback.

Post by pbhjpbhj » Fri, May 12, 2017, 2:58 AM UTC

djrogers wrote: post #64

fauigerzigerk wrote: post #52

Earlier quoted context omitted.

>I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations That is exactly what the article says. Specifically: The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower…

The article currently linked here is not the same one originally linked. It was changed after I made my post. That said, the headline still explicitly calls out smartphones.

Post by kalleboo » Fri, May 12, 2017, 4:04 AM UTC

derefr wrote: post #70

r00fus wrote: post #55

Earlier quoted context omitted.

That hack uses lab conditions. They have a clear wine glass with a high resolution scanner. More real-life conditions (smeared print, non-glass surface) would be interesting to reproduce. My guess is that it ups the ante significantly for cost of hacking.

In "real life"—unless there was some absolute urgency to the problem—you wouldn't try to reconstruct a smudged partial print; you'd just use social engineering/espionage tactics to get a good print. (Remember that iOS locks and/or wipes devices after 10 failed attempts. You want to go to however much effort is required to be perfect the first time.) I can think of a number of situations one could create where a perso…

Post by kalleboo » Fri, May 12, 2017, 4:18 AM UTC

gpawl wrote: post #47

ars wrote: post #29

The phone is covered with fingerprints from the owner anyway. If you have the phone, you already have the "password". The fingerprint scan is just to make it a little bit annoying for attacker, so they'll factory reset instead of bothering to crack it. It's not intended for any kind of real security. Like many others here I never used to lock my phone at all until the fingerprint scan, and I don't consider the scan a…

How do you know that the finger data the scanner uses is present in oil prints? If this true, someone would have created a working demonstration in the past 5 years.