Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

51–60 of 333 posts

Re: Fingerprints can be hacked

#51

Post by madeofpalk »

yeetaccount2 wrote: post #10
1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

Fingerprint recognition has been mainstream in consumer tech/iPhones for 8 years. Surely it would have already happened?

Re: Fingerprints can be hacked

#53

Post by madeofpalk »

RHSeeger wrote: post #26
GoblinSlayer wrote: post #12

Earlier quoted context omitted.

Secrecy is only an approximation of difficulty. Given the difficulty, I would estimate it as a two character password. It should be fine for people who have nothing to hide.

> It should be fine for people who have nothing to hide. There are no people that have nothing to hide. There are only people that don't know what they should be hiding.

Just a clumsy way of saying "not within my threat matrix"

Re: Fingerprints can be hacked

#54

Post by the_snooze »

GoblinSlayer wrote: post #12
SEJeff wrote: post #3

Fingerprints are usernames, not passwords. Here is an excellent (and timeless) post on this fact: https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

Secrecy is only an approximation of difficulty. Given the difficulty, I would estimate it as a two character password. It should be fine for people who have nothing to hide.

>It should be fine for people who have nothing to hide.

If I'm a company, would I want my employees to give up proprietary data they hold just because they personally "have nothing to hide?" Anyone who thinks that's acceptable is someone who isn't worthy of trust.

Re: Fingerprints can be hacked

#55

Post by scottLobster »

Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial.

If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway.

For your average everyday person fingerprint security is fine. The thief who snatches your phone when you step away from your table in the mall food court isn't going to be able to crack it via this method.

Re: Fingerprints can be hacked

#56

Post by zeven7 »

rei_ayanami wrote: post #36
zeven7 wrote: post #15

Is modern facial recognition any better or is it also considered bad to use for anything sensitive?

That would also be username like one other user mentioned. Not passwords.

I know that's something people say, but that doesn't actually give me the information I need to be informed about how secure or insecure it is and how hard it is to bypass.

Re: Fingerprints can be hacked

#58

Post by qw »

landemva wrote: post #34
yeetaccount2 wrote: post #10

Earlier quoted context omitted.

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

'what if somebody ...' made SaaS service to upload pictures and overnight ship the fingertip.

It would probably cause a huge media storm. Then the politicians would "fix it" by replacing it with face recognition... (suddenly Face/Off is no longer science fiction)

Re: Fingerprints can be hacked

#59

Post by smeyer »

criddell wrote: post #37
bitxbitxbitcoin wrote: post #19

Earlier quoted context omitted.

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

> What they can’t do is make you remember a code/password which you have “forgotten.” They might be able to with an FMRI machine.

Maybe at some point in the future, but we definitely aren't at the stage of being able to parse out a specific password from an FMRI reading right now.

Re: Fingerprints can be hacked

#60

Post by jeroenhd »

Biometrics are great for authentication but terrible for authorization. Anything sensitive should require both. There's nothing wrong with a fingerprint and a password or a fingerprint and an RFID card as an authorization/authentication pair; you just have to keep these things in mind.

I've fallen to the laziness of using fingerprints on my devices as well, but they still require a password to decrypt the contents of the storage device on boot. For many, if not most, threat models, this is perfectly fine.

I lock my phone to prevent people with messing with my contacts and scrolling through my messages. It's an inconvenience to bypass that requires preparation. A motivated attacker would just as easily spy over my shoulder if I were to use a password, either on my phone or on my laptop.

I look at these mechanisms like the lock on a teenager's bedroom door. Those things aren't impenetrable and anyone with just a little lockpicking experience or access to some automated tools can open them in a minute. Unlike the locks on our front doors, built to keep intruders that don't want to risk physical damage to our windows out, they're a message: please don't violate my privacy. Violating that privacy is made moderately difficult by the mechanism itself, but it's hardly impossible.

Unless you carry a password-protected authentication and key management token with you at all times, you're at risk of having your system broken into. Most of us don't need to worry about those kinds of things.

Post reply on HN