Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

ccc.de

Post reply on HN
Print view View original

101–110 of 166 posts

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#101

Post by binarycrusader »

QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter.

What if one of the subject's eyes is a glass eye? What if they're wearing colored contact lenses? Wouldn't both of those situations complicate that?

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#102

Post by wlesieutre »

binarycrusader wrote: post #101
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. What if one of the subject's eyes is a glass eye? What if they're wearing colored contact lenses? Wouldn't both of those situations complicate that?

If someone's wearing a colored contact lens I would expect iris recognition to not work. That's like trying to use a fingerprint reader with gloves on.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#103

Post by xnandor »

QuarterReptile wrote: post #89
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

Edit: 'micro-oscillation' was a term that I lazily invented to describe a phenomenon with which I am only passingly familiar. It is actually called 'hippus' or ' pupillary athetosis'.

Have you read George Orwell's "Politics and the English Language"? If not you should give it a read, it's short. This comment reminded me of his criticism related to Latin usage.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#104

Post by rayvd »

daveguy wrote: post #76
Klathmon wrote: post #68

Earlier quoted context omitted.

And this is why it makes it so difficult to choose high end phones. I have been shouting about how my Pixel phone is magnitudes better of a device than any other phone I've ever used, including the S8. On paper it looks awful, but everything this phone does works 100% of the time quickly and without stuttering or failing.

I'm on my second Samsung. First was a very annoying pre-capacitive touch that never worked well. This current one is an old Galaxy S5. It is better, but it likes to restart periodically (fortunately Android handles that well). Battery life is crap and it gets sluggish easily. Before I had a Motorola. It was much better. I will not buy another Samsung.

I like my Galaxy S6. Bike shed!

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#105

Post by jdironman »

jpalomaki wrote: post #45
algesten wrote: post #20

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.

Phone must automatically lock quite quickly, otherwise somebody quick just grab it after you have unlocked it. This means the password needs to be typed in constantly if you are frequently picking up the phone. Also you often want to grab the phone with one hand, so you need to be able to type the password with one hand. Combine that with the frequent typing and you probably come to conclusion that you can't have a p…

An encrypted NFC or Bluetooth bracelet, one sold with or separately to a phone would be nice. Pings it every so often. If it can't find it, automatically self locks. If it can't find for for X number of days and a password hasn't been entered in that time then it wipes || locks the phone.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#106

Post by Klathmon »

abritinthebay wrote: post #100
Klathmon wrote: post #68

Earlier quoted context omitted.

And this is why it makes it so difficult to choose high end phones. I have been shouting about how my Pixel phone is magnitudes better of a device than any other phone I've ever used, including the S8. On paper it looks awful, but everything this phone does works 100% of the time quickly and without stuttering or failing.

I'd say the Pixel is the best Android phone for sure. But that should be expected, as it's from Google

I wouldn't say expected, they have made some poor performing phones in the past (for various definitions of "made").

But my point was more that on paper it doesn't look like much. It doesn't have waterproofing, it's not "best in class" in anything except the camera, it runs software which has less "on paper" features than other brands, it doesn't have an SD card or removable battery, etc...

But when you actually go to use it, it's a night and day difference between it and other devices.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#107

Post by mae9tvw5 »

abritinthebay wrote: post #99
mae9tvw5 wrote: post #84

Earlier quoted context omitted.

Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...

People don't leave perfect moldae prints everywhere. AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger. That isn't to say it's not possible but it is a pretty major asterisk.

They have done it with a fingerprint left on the device screen later on, if i remember correctly.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#108

Post by tmsldd »

Sir. Daugman has left the job incomplete.. there still space for research. "Liveness" checking is of course a challenge in such cheap and simplistic setups.. Anyhow, for operator-attended application scenarios it is still ok. On the other, I see biometrics as a convenience feature in physical or logical access control scenarios (As long as the security level is at least equal or higher than conventional methods).

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#109

Post by wlesieutre »

wlesieutre wrote: post #102
binarycrusader wrote: post #101

Earlier quoted context omitted.

Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. What if one of the subject's eyes is a glass eye? What if they're wearing colored contact lenses? Wouldn't both of those situations complicate that?

If someone's wearing a colored contact lens I would expect iris recognition to not work. That's like trying to use a fingerprint reader with gloves on.

Glass eye I'm not sure about either. That seems along the lines of using a fingerprint reader on a prosthetic hand. Sure, you could mold a fingerprint onto one and scan it, but with a sophisticated fingerprint sensor it's going to look like a fake finger. Do we deliberately make everyone's fingerprint scanner weak to allow someone without fingers to use it?

Maybe the answer is to introduce a "weak mode" option where most users could have the scanner verify "yes, this is a real eyeball," and if someone with a glass eye still wanted to use iris scanning in a way that can be copied by a photo, they have the choice to disable the security measures.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#110

Post by jetpacktuxedo »

morsch wrote: post #97
joncrocks wrote: post #72

Earlier quoted context omitted.

I'd note this is already possible on Android, using 'Smart Lock' - https://support.google.com/nexus/answer/6093922

Not really. Quoting GP: I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch. When combined with a fingerprint sensor, smart lock keeps the device completely unlocked while "triggered"…

You're not wrong. I use smart lock and fingerprint on my 5x. I actually would prefer it to require fingerprint when near my watch with password fallback, and require fingerprint+password when away from my watch, but that isn't currently a possible configuration as far as I can tell.
Post reply on HN