Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

ccc.de

Post reply on HN
Print view View original

91–100 of 166 posts

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#91

Post by lucb1e »

QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

> It's that simple a programming exercise.

Then it's also fixable in software, no hardware update needed, right?

At least to make it better even if it isn't good yet.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#92

Post by QuarterReptile »

_nalply wrote: post #17
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

Do you have a source about these micro-dilations? I googled a little bit but couldn't find enlightening results in my superficial search.

Saccades is not what I was referring to. 'Micro-dilations' was my attempt to describe the phenomenon. After some searching, I believe it's called hippus (maybe specifically 'physiological' hippus, to distinguish from pathological) or ' pupillary athetosis'.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#93

Post by Jonnax »

draugadrotten wrote: post #88
dingo_bat wrote: post #31

Earlier quoted context omitted.

But do phones check for all those markers?

Well, maybe. Usually flagship phones gets the best (most expensive) chips. Budget phones gets knock-offs. It depends on which fingerprint hw/sw the phone is using. There are about 4 large players in the phone fingerprint chip space that have 90 percent of the market. Fingerprinting is heavily patented so all four vendors have their pros and cons. A few dozen small players competing about 10 percent of the market. The…

Do you know where I could read more about the ways fingerprint scanner detect that it's a human finger?

Sounds pretty fascinating.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#94

Post by QuarterReptile »

IshKebab wrote: post #61
matt4077 wrote: post #43

Earlier quoted context omitted.

A similar concept that I remember from university are saccades (minimal, involuntary eye movements).

Yes but those are well-known and visible to the naked eye. I've never heard of these 'micro-dilations' and Google didn't show anything.

'hippus', specifically 'physiological hippus', or ' pupillary athetosis', seem to be the correct terms for what I was describing as 'micro-dilations'. Saccades, as I understand it, is rotational shift of focus by 1-2 degrees, rather than repeated contraction/relaxation of the pupil.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#95

Post by lucb1e »

lnx01 wrote: post #63

Using a fingerprint for security is like writing your password on everything you touch. Using your iris is like walking around with your password written on your forehead.

> like writing your password on everything you touch.

> with your password written on your forehead.

... in invisible ink*, I'd say. But basically yeah.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#96

Post by QuarterReptile »

IshKebab wrote: post #62
_nalply wrote: post #17

Earlier quoted context omitted.

Do you have a source about these micro-dilations? I googled a little bit but couldn't find enlightening results in my superficial search.

The closest I could find was this: https://graphics.stanford.edu/papers/remote-pupillometry/ It seems that there are reasonably large changes due to thinking about something, but not due to just looking unless your camera can detect 0.01 mm changes in diameter, which maybe tbihl's could be that seems unreasonable for a smartphone camera. I would guess tbihl has never tried to get iris recognition working on a cost-co…

It's true that I've only tried iris recognition in dedicated setups. Sadly, I can't speak to whether this test is within the abilities of a standard smartphone camera without any macro lens.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#97

Post by morsch »

joncrocks wrote: post #72
jpalomaki wrote: post #45

Earlier quoted context omitted.

Phone must automatically lock quite quickly, otherwise somebody quick just grab it after you have unlocked it. This means the password needs to be typed in constantly if you are frequently picking up the phone. Also you often want to grab the phone with one hand, so you need to be able to type the password with one hand. Combine that with the frequent typing and you probably come to conclusion that you can't have a p…

I'd note this is already possible on Android, using 'Smart Lock' - https://support.google.com/nexus/answer/6093922

Not really.

Quoting GP: I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch.

When combined with a fingerprint sensor, smart lock keeps the device completely unlocked while "triggered" (by being on-body, or close to a trusted BT device, etc), and the fingerprint unlocks it while not triggered. It doesn't ever escalate to requiring the pin/password/pattern. Please correct me if I'm wrong, because I'd like to be.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#98

Post by tooltalk »

_h_o_d_ wrote: post #73
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

This is remarkable, even though it's obvious to any of their phone users (myself included) that Samsung's software development is shoddy at best, despite its excellent hardware. Which is a huge pity, but may well have something to do with the culture of corporate deference and rigid hierarchy. http://www.asianews.network/content/feature-samsung-debacle-...

why would that only affect their software, but not hardware?

While I agree that Samsung is at its core a hardware company and software engineers are still treated like second-class citizens, you can't just expect them to compete with Google or Microsoft overnight, IMO. I'm disinclined to believe that their military-like corporate hierarchy is to blame.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#99

Post by abritinthebay »

mae9tvw5 wrote: post #84
moogleii wrote: post #75

Earlier quoted context omitted.

>All needed was a photograph of the fingerprint on a glass surface. And wood glue! Looks like that method proved unreliable, so they expanded it: "To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capa…

Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...

People don't leave perfect moldae prints everywhere.

AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger.

That isn't to say it's not possible but it is a pretty major asterisk.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#100

Post by abritinthebay »

Klathmon wrote: post #68
matt4077 wrote: post #41

Earlier quoted context omitted.

Samsung always seems to me as if they race to match any iPhone feature–but never more than skin-deep. So when the iPhone gets a fingerprint sensor that saves only a hash of the actual data in a special enclave of a custom chip, Samsung responds with an iris scanner that saves an image of the iris as a world-readable jpeg in your home directory. Thus, their marketing material can claim feature-parity (or even exceed A…

And this is why it makes it so difficult to choose high end phones. I have been shouting about how my Pixel phone is magnitudes better of a device than any other phone I've ever used, including the S8. On paper it looks awful, but everything this phone does works 100% of the time quickly and without stuttering or failing.

I'd say the Pixel is the best Android phone for sure.

But that should be expected, as it's from Google

Post reply on HN