> "Dr. Memon said their findings indicated that if you could somehow create a magic glove with a MasterPrint on each finger, you could get into 40 to 50 percent of iPhones within the five tries allowed before the phone demands the numeric password, known as a personal identification number." I don't understand how this is possible at all. I've always assumed that each fingerprint is essentially turned into a hash, an…
> identfied
Are you saying you didn't add any other identification to match the print to your identity? ie. the system really identified, not merely verified?
. . . because the gym still uses the system? If it didn't accurately distinguish between their customers, why would they still use it? This is 100% not the same type of reasoning. We have reason to believe that the fingerprint accurately distinguishes between 1000 different options. False positive and false negative aren't meaningful terms here, because we're no longer dealing with yes/no results.
> why would they still use it? "If this authentication system didn't work nobody would use it" is literally the reasoning I mentioned above. > we're no longer dealing with yes/no results That's exactly what we're dealing with. Iterate through the list of fingerprints in the database, does provided == stored. You might be interested in reading about CER (crossover error rate). It's the term used for discussing the tra…
You really think the gym would use a system where a large portion of fingerprints match as OP? No, we're not dealing with yes/no. We're dealing with "which fingerprint matches the given data best", not "does the given data match a given fingerprint well enough". The scanner doesn't return "is this person OP", it returns "which person is this".
> why would they still use it? "If this authentication system didn't work nobody would use it" is literally the reasoning I mentioned above. > we're no longer dealing with yes/no results That's exactly what we're dealing with. Iterate through the list of fingerprints in the database, does provided == stored. You might be interested in reading about CER (crossover error rate). It's the term used for discussing the tra…
You really think the gym would use a system where a large portion of fingerprints match as OP? No, we're not dealing with yes/no. We're dealing with "which fingerprint matches the given data best", not "does the given data match a given fingerprint well enough". The scanner doesn't return "is this person OP", it returns "which person is this".
As someone who has done red teaming of systems like this and found exactly that type of bug? Yes. Yes I do.
I'm sorry, but you are simply fundamentally misunderstanding how this works.
There are all sorts of reasons fingerprints are not a highly secure authentication mechanism. Just as there are all sorts of reasons passwords and other techniques are imperfect. Password entry can be observed. Chosen passwords are frequently insecure, particularly on smartphones where brevity is so important. Fingerprints are an excellent mechanism for almost all threat vectors for your average consumer smartphone.…
Considering there is no 'active' part (e.g. no known secret) it cannot be used for authorization, only for identification. The 'kids unlock phone with sleeping parent and buy stuff' techniques are a clear proof of this. Fine for identification, do not use for authorization (e.g. using secrets like when you buy stuff).
I'm still fine with this threat vector. The idea is to prevent casual intrusion, not premeditated intrusion. If I put my phone on the dinner table, no one is going to send text messages.