Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

ccc.de

Post reply on HN
Print view View original

111–120 of 166 posts

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#111

Post by tboughen »

wlesieutre wrote: post #109
wlesieutre wrote: post #102

Earlier quoted context omitted.

If someone's wearing a colored contact lens I would expect iris recognition to not work. That's like trying to use a fingerprint reader with gloves on.

Glass eye I'm not sure about either. That seems along the lines of using a fingerprint reader on a prosthetic hand. Sure, you could mold a fingerprint onto one and scan it, but with a sophisticated fingerprint sensor it's going to look like a fake finger. Do we deliberately make everyone's fingerprint scanner weak to allow someone without fingers to use it? Maybe the answer is to introduce a "weak mode" option where…

If someone with a glass eye is using a smartphone then one would suspect they are seeing their other, real, eye. This can then be scanned as normal.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#112

Post by Jweb_Guru »

_h_o_d_ wrote: post #73
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

This is remarkable, even though it's obvious to any of their phone users (myself included) that Samsung's software development is shoddy at best, despite its excellent hardware. Which is a huge pity, but may well have something to do with the culture of corporate deference and rigid hierarchy. http://www.asianews.network/content/feature-samsung-debacle-...

Let's not pretend that people here in extremely permissive environments don't build hugely buggy things that wouldn't survive a similarly superficial test.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#113

Post by wlesieutre »

tboughen wrote: post #111
wlesieutre wrote: post #109

Earlier quoted context omitted.

Glass eye I'm not sure about either. That seems along the lines of using a fingerprint reader on a prosthetic hand. Sure, you could mold a fingerprint onto one and scan it, but with a sophisticated fingerprint sensor it's going to look like a fake finger. Do we deliberately make everyone's fingerprint scanner weak to allow someone without fingers to use it? Maybe the answer is to introduce a "weak mode" option where…

If someone with a glass eye is using a smartphone then one would suspect they are seeing their other, real, eye. This can then be scanned as normal.

You'd think so, but iPhones are incredibly useful to blind people.

https://finance.yahoo.com/news/david-pogue-on-iphone-voiceov...

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#114

Post by abritinthebay »

mae9tvw5 wrote: post #107
abritinthebay wrote: post #99

Earlier quoted context omitted.

People don't leave perfect moldae prints everywhere. AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger. That isn't to say it's not possible but it is a pretty major asterisk.

They have done it with a fingerprint left on the device screen later on, if i remember correctly.

If I remember rightly that was a print applied to scanner glass, much less successful, and required absolutely perfect print transfer.

Which, imo, isn't much different conditions tbh (i.e. not representative of the real world)

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#115

Post by dingo_bat »

QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

I think if they would track an event that's only 2Hz that's too much time to unlock. People would complain that it's slow.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#116

Post by sf_rob »

morsch wrote: post #97
joncrocks wrote: post #72

Earlier quoted context omitted.

I'd note this is already possible on Android, using 'Smart Lock' - https://support.google.com/nexus/answer/6093922

Not really. Quoting GP: I think a good balance between security and usability would be to allow fingerprint or iris scan when the phone has been constantly in my proximity but require a pin (password) if the phone is taken away. The proximity could be determined for example by pairing the phone with smart watch. When combined with a fingerprint sensor, smart lock keeps the device completely unlocked while "triggered"…

My solution is to use the "Screen off and Lock" app[1]. It acts as a local Device Administrator to be able to force a password unlock. I added the widget to my home-screen where I can actually lock my phone if needed (leaving it somewhere for a period), and I can use the fingerprint the rest of the time.

Definitely not a perfect system. I wish that I could set timeouts and map the power button to do an admin lock. Also, having to use a 3rd party app for this is quite likely its own threat vector.

[1] https://play.google.com/store/apps/details?id=com.katecca.sc...

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#117

Post by 7542468964 »

abritinthebay wrote: post #114
mae9tvw5 wrote: post #107

Earlier quoted context omitted.

They have done it with a fingerprint left on the device screen later on, if i remember correctly.

If I remember rightly that was a print applied to scanner glass, much less successful, and required absolutely perfect print transfer. Which, imo, isn't much different conditions tbh (i.e. not representative of the real world)

Read the original ccc article or watch the video! They got the print off the phone itself. Only restriction is a high resolution scanner OR camera to capture it.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#118

Post by komali2 »

mae9tvw5 wrote: post #84
moogleii wrote: post #75

Earlier quoted context omitted.

>All needed was a photograph of the fingerprint on a glass surface. And wood glue! Looks like that method proved unreliable, so they expanded it: "To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capa…

Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...

So what's better, then? Tongueprint? I'm down to lick my phone to turn it on.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#119

Post by mattkrause »

matt4077 wrote: post #43
_nalply wrote: post #17

Earlier quoted context omitted.

Do you have a source about these micro-dilations? I googled a little bit but couldn't find enlightening results in my superficial search.

A similar concept that I remember from university are saccades (minimal, involuntary eye movements).

I think you're thinking of microsaccades.

Saccades in general are just rapid, ballistic eye movements: they don't have to be small and they're often voluntary. You often make saccades without explicitly thinking about it, but you can countermand these and hold your eyes still when you want to.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#120

Post by biomcgary »

komali2 wrote: post #118
mae9tvw5 wrote: post #84

Earlier quoted context omitted.

Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...

So what's better, then? Tongueprint? I'm down to lick my phone to turn it on.

Tongue prints work fine on typical phone fingerprint readers, so it is an option.
Post reply on HN