Live data from Hacker News

Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

motherboard.vice.com

41–50 of 69 posts

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#41

Earlier quoted context omitted.

Sounds like you should maybe retrain it. My iPhone 6, which has the older sensor tech is fine: unless my hands are wet

This is the problem I have. If there’s just a little sweat on my finger, it stops working.

Just for another piece of anecdata: mine used not to work if my finger was too dry... I resorted to everything up to and including licking the finger and retrying. Which, oddly, usually worked.

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#42
As a scientist I hate to find such mistakes in publications: "The test set is used for scoring the candidate DeepMasterPrints during optimization. The attack should be successful against these fingerprints as it is directly optimized for them." Even if that's a typo..

Disclaimer. My team at Neurotechnology develops fingerprint recognition algorithm VeriFinger which was used in this publication to look for vulnerabilities of small area fingerprint sensors.

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#43

Really interesting work. Snippet from the paper's summary for the lazy: > The proposed method [...] is based on training a Generative Adversarial Network on a set of real fingerprint images. Stochastic search [...] is then used to search for latent input variables to the generator network that can maximize the number of impostor matches as assessed by a fingerprint recognizer. So I hadn't heard about "MasterPrints";…

Presumably an eigen-face acts as a master-face of sorts?

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#44

Earlier quoted context omitted.

How could DNA be non-unique, except for identical twins or clones?

There's a 1 in 2^46 chance that siblings born separately will have mostly identical DNA, minus a few random mutations.

Does that qualify as significant in any practical implementation for identity?

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#45

I'm fine with "casual" security like my fingerprints for my phone and laptop as primary authentication. It annoys me I have to enter a password first from a user experience perspective. There's definitely need for very hardened phones from physical attack (journalists, canaries, whistleblowers, etc). I'm just not that important so I wish I could choose my security level.

It's still very important to know that these owls aren't necessarily what they seem. People will hear the phrase "fingerprint recognition" and think "Oh that's clever because I'm the only one with these fingerprints!" and assume that that makes it secure. But of course the reality is more complicated than that, and personally I prefer a passphrase because I understand much better how that works and what the potential points of failure are.

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#46

Really interesting work. Snippet from the paper's summary for the lazy: > The proposed method [...] is based on training a Generative Adversarial Network on a set of real fingerprint images. Stochastic search [...] is then used to search for latent input variables to the generator network that can maximize the number of impostor matches as assessed by a fingerprint recognizer. So I hadn't heard about "MasterPrints";…

Presumably an eigen-face acts as a master-face of sorts?

Why would it? Eigen-faces tend to not even look like faces (which makes sense, given that the goal is to represent a collection of real faces as linear combinations of the orthogonal eigen-faces). One possibility would be to generate random faces as random linear combinations of the eigen-face basis, but this type of attack could be thwarted by rate limiting.

A real "master face" would be a face that looks like many people, and it seems like you could try to obtain faces like that by playing a two-player game between a recognizer and a face generator (as is done when training GANs).

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#48

Really interesting work. Snippet from the paper's summary for the lazy: > The proposed method [...] is based on training a Generative Adversarial Network on a set of real fingerprint images. Stochastic search [...] is then used to search for latent input variables to the generator network that can maximize the number of impostor matches as assessed by a fingerprint recognizer. So I hadn't heard about "MasterPrints";…

Presumably an eigen-face acts as a master-face of sorts?

Yes, but you need more than one face. An average face doesn't much look like any particular person. You'd need maybe a few hundred faces.

Facial matching usually reduces search space by assuming something about the input. I.e. you don't match a face against the whole world, just the friends of a person uploading a photo. Otherwise you'd run into matching a similar face to some stranger on the other side of the world.

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#49

Earlier quoted context omitted.

There's a 1 in 2^46 chance that siblings born separately will have mostly identical DNA, minus a few random mutations.

Does that qualify as significant in any practical implementation for identity?

If ID was based on a full sequence, probably not, but it rarely is. But if you ask how can it be not unique, that's an answer.

Re: Researchers Created Fake 'Master' Fingerprints to Unlock Smartphones

#50

Not enough detail in the article. There is no discussion of what sensors were used to "fool". Now everyone will assume it works on all actual devices using fingerprints, yet there is no information to support that conclusion. If this technique were applied to actual devices (with fingerprints not included in the study) and it worked reliably, then this would be a meaningful study.

it’s a casual article and as such, it has enough detail. if you want more, follow the link to the study provided in the article.

even if there are mitigations in products that you buy, the study is quite meaningful. it proves (eg) the need for such mitigations.

Post reply on HN