Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

91–100 of 333 posts

Re: Fingerprints can be hacked

#91

Post by nanidin »

landemva wrote: post #81
PinguTS wrote: post #25

Earlier quoted context omitted.

And they distributed it with the Datenschleuder. Cannot remember the issue, but I have it still somewhere at home. It is like a highly distributed backup of that fingerprint.

State driver license in USA is a honey pot of thumb/finger scans. Anyone on HN think the NSA doesn't have access? NSA info sharing with trusted foreign countries makes a reliable distributed backup for use by foreign spooks.

> State driver license in USA

In which states? The only thing I have been fingerprinted for is in the US is The Global Entry program.

Re: Fingerprints can be hacked

#92

Post by nkrisc »

Cd00d wrote: post #64
newsbinator wrote: post #24

Earlier quoted context omitted.

> Spiegel also reported another security hole from the conference: reading a user's PIN code from reflections in their pupils while taking selfies. https://www.dw.com/en/german-defense-minister-von-der-leyens...

I don't understand this one - when are people taking a selfie at the same time they're typing in their pin? I have an android phone, and I don't even unlock to take pictures. I just don't follow the timeline and geometry. Seems theoretical only maybe.

I assume the intent is to capture it while surveilling someone while they enter their PIN, not necessarily from images harvested from social media or anything. Since many PIN entries show at most the most recently entered number, you'd need multiple images to capture the PIN. But if you can capture it from reflections in their eyes, then you can surveil them from a greater distance and more stealthily if you've got a good camera.

Re: Fingerprints can be hacked

#94

Post by GuB-42 »

CountDrewku wrote: post #67
GuB-42 wrote: post #49

No, the fingerprints are not hacked. The MacBook Pro scanner is. Fingerprints and biometrics in general are not a secret. Consider your fingerprint like your face. Anyone can reproduce your face, there are cameras everywhere, and it is probably already easy to find on the internet. "Hacking" your face by taking a picture is the most boring "hack" ever. Now, if I print your face on a piece of paper, wear it as a mask…

Eh... fingerprints are quite a bit simpler than faces. They're just patterns. I don't know how you could detect a fake fingerprint. You'd need something that could tell there wasn't real skin on the device. I would say warmth but obviously he has the fake skin over his actual thumb so it's probably still warm.

Yes, I really meant fake fingers, not just fake fingerprints. And there is plenty of research on that subject.

Possible ways of detecting a fake fingerprint (beside warmth):

- Blood (we could use one of these cheap SpO2 sensors)

- Capacitance

- Perspiration and related skin resistance

- Microscopic skin details

And the usual machine learning solution of feeding thousands of real and fake fingerprints to a neural network and letting it decide.

As all living things, fingers are far from simple, there are plenty of details beyond the obvious pattern. It is a bit like a banknote, you can photocopy a banknote and it is very east to identify the banknote you copied. But it is very hard to pass it off as a real one to someone who knows where to look.

Re: Fingerprints can be hacked

#95

Post by GTP »

criddell wrote: post #66
smeyer wrote: post #59

Earlier quoted context omitted.

Maybe at some point in the future, but we definitely aren't at the stage of being able to parse out a specific password from an FMRI reading right now.

No, but combined with torture it might be effective enough.

No, I think that adding torture to the mix will make the FMRI results even less readable

Re: Fingerprints can be hacked

#96

Post by tantalor »

webel0 wrote: post #86

[edit for clarity] As someone who doesn’t specialize in security, one claim that has stood out to me for not using fingerprints is that you can't run bcrypt (or some other salting algorithm) on fingerprints [1]. I don’t see any discussion of that here thus far. Is that still the case? I feel like I would have heard about developments in this area if something had changed. But perhaps I've always misunderstood the cri…

Says who?

Re: Fingerprints can be hacked

#97

Post by anonymfus »

scottLobster wrote: post #55

Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial. If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain p…

>If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway.

But the whole point is that it's easier than you describe as people make photos with fingerprints themself accidentally, and technical means to reproduce fingerprints are not highly technical.

Re: Fingerprints can be hacked

#98

Post by eatbitseveryday »

bitxbitxbitcoin wrote: post #19
EGreg wrote: post #5

Earlier quoted context omitted.

That's why this is a dumb idea, merchants can just use the replay attack: https://www.wsj.com/articles/in-china-paying-with-your-face-... . The only place where you should be using your biometrics is to unlock devices you carry with you, like the iPhone.

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

> Unfortunately for the FBI, Artan’s lifeless fingerprint didn’t unlock the device (an iPhone 5 model, though Moledor couldn’t recall which. Touch ID was introduced in the iPhone 5S). In the hours between his death and the attempt to unlock, when the feds had to go through legal processes regarding access to the smartphone, the iPhone had gone to sleep and when reopened required a passcode, Moledor said.

From your https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

Re: Fingerprints can be hacked

#99

Post by avianlyric »

amalcon wrote: post #35
braincoke wrote: post #11

Earlier quoted context omitted.

I believe it's - Something you have (key, device,...) - Something you know - Something you are (biometry) In Europe there is a regulation (PSD2) that defines a strong authentication as 2 of the 3 listed above.

I've always disliked this breakdown. My body is something I have -- it's just potentially (not always practically -- see the article) more difficult to clone or otherwise use without my consent than a key fob or something. Edit: To be clear, I don't think this is an argument for biometrics, but rather an argument against them. They can't complement something I have in a two factor scheme, because my biometrics are so…

Your body isn’t very easy to replace. Passwords and devices are.
Post reply on HN