Fingerprints can be hacked • Hacker News Board

Re: Fingerprints can be hacked

#31

Post by FridayoLeary » Mon, Nov 22, 2021, 2:41 PM UTC

bitxbitxbitcoin wrote: post #19

EGreg wrote: post #5

Earlier quoted context omitted.

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-... . The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

The vast majority people will never encounter a circumstance where that will be an issue. To withhold a (n optional) feature from the masses based on the hypothetical actions of an agency who can abuse your fingerprints but will stop short of torture doesn't really make sense.

Re: Fingerprints can be hacked

#32

Post by jrootabega » Mon, Nov 22, 2021, 2:44 PM UTC

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

And, in some cases, not considered protected by law, which overlaps well with #2 and #3.

Re: Fingerprints can be hacked

#33

Post by joenathanone » Mon, Nov 22, 2021, 2:45 PM UTC

capitainenemo wrote: post #28

voidmain wrote: post #13

Biometrics are not secrets (it must be assumed that attackers always possess all biometric data), but they can nevertheless be a good form of authentication when combined with situational awareness . If you try to use one of these hot glued fingerprints in front of a security guard, it isn't going to go well for you. At the moment, humans are still necessary for situational awareness, but probably machines can get th…

You think the typical security guard would notice a print if it was glued on the finger? At workplaces I've worked at in the past they weren't watching the flow of traffic through the gate all that carefully...

Additionally a little social engineering would get right past an attentive guard, just strike up a little small talk to distract their attention.

Re: Fingerprints can be hacked

#34

Post by landemva » Mon, Nov 22, 2021, 2:46 PM UTC

yeetaccount2 wrote: post #10

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

'what if somebody ...' made SaaS service to upload pictures and overnight ship the fingertip.

Re: Fingerprints can be hacked

#35

Post by amalcon » Mon, Nov 22, 2021, 2:48 PM UTC

braincoke wrote: post #11

darkwater wrote: post #7

Earlier quoted context omitted.

I always thought that since the beginning, but unfortunately the world went into another direction. People always said "something you have and something you know", but now for most cases it's just "something you have - your body". Obviously if in the future remote mind-readers are invented, the "something you know" part will also get obsolete, but for now we should stick to it.

I believe it's - Something you have (key, device,...) - Something you know - Something you are (biometry) In Europe there is a regulation (PSD2) that defines a strong authentication as 2 of the 3 listed above.

I've always disliked this breakdown. My body is something I have -- it's just potentially (not always practically -- see the article) more difficult to clone or otherwise use without my consent than a key fob or something.

Edit: To be clear, I don't think this is an argument for biometrics, but rather an argument against them. They can't complement something I have in a two factor scheme, because my biometrics are something I have.

Re: Fingerprints can be hacked

#36

Post by rei_ayanami » Mon, Nov 22, 2021, 2:48 PM UTC

zeven7 wrote: post #15

Is modern facial recognition any better or is it also considered bad to use for anything sensitive?

That would also be username like one other user mentioned. Not passwords.

Re: Fingerprints can be hacked

#37

Post by criddell » Mon, Nov 22, 2021, 2:50 PM UTC

bitxbitxbitcoin wrote: post #19

EGreg wrote: post #5

Earlier quoted context omitted.

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-... . The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

> What they can’t do is make you remember a code/password which you have “forgotten.”

They might be able to with an FMRI machine.

Re: Fingerprints can be hacked

#38

Post by scott00 » Mon, Nov 22, 2021, 2:51 PM UTC

The method in the article required an hour of photoshop work. Anybody know how much expertise is required for that step?

Re: Fingerprints can be hacked

#39

Post by acdha » Mon, Nov 22, 2021, 2:52 PM UTC

capitainenemo wrote: post #28

voidmain wrote: post #13

Biometrics are not secrets (it must be assumed that attackers always possess all biometric data), but they can nevertheless be a good form of authentication when combined with situational awareness . If you try to use one of these hot glued fingerprints in front of a security guard, it isn't going to go well for you. At the moment, humans are still necessary for situational awareness, but probably machines can get th…

You think the typical security guard would notice a print if it was glued on the finger? At workplaces I've worked at in the past they weren't watching the flow of traffic through the gate all that carefully...

I think this depends on how well they do liveness tests: it's expensive to have guards checking everyone's hands (but certainly not prohibitively so if you have that level of threat) but it'd be a lot cheaper if your sensors are fairly good at raising an alarm to attract scrutiny.

Re: Fingerprints can be hacked

#40

Post by hannob » Mon, Nov 22, 2021, 2:52 PM UTC

sparkling wrote: post #14

This should not be news to anyone. Chaos Computer Club demonstrated almost the same technique in this 2006 video https://www.youtube.com/watch?v=OPtzRQNHzl0

Exactly, just wanted to link this as well.

There's of course nothing wrong with pointing out already known security flaws, but it's good practice to mention when this is a well known thing and reference prior work - which the post by kraken does not do.