Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

141–150 of 333 posts

Re: Fingerprints can be hacked

#141

Post by mrtranscendence »

xoa wrote: post #78
SEJeff wrote: post #3

Fingerprints are usernames, not passwords. Here is an excellent (and timeless) post on this fact: https://blog.dustinkirkland.com/2013/10/fingerprints-are-use...

> Fingerprints are usernames, not passwords. Here is an excellent (and timeless) post on this fact No, that is complete absolute shit post that isn't even self coherent. Like, it literally whines about needing something that can be "independently chosen, changed, and rotated", which obviously describes usernames so obviously biometrics can't possibly be usernames by that very post! Why is this dumb meme so fucking pe…

> lengthy [...] password policies

Bizarrely, my organization limits passwords to a length of 12 characters or shorter. I agree with you, I don't want a password the size of a paragraph, but c'mon... 12 characters?

Re: Fingerprints can be hacked

#143

Post by upofadown »

yeetaccount2 wrote: post #10
1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

Most of the evidence that shows up at a court case is forgeable. Simply showing that a particular piece of evidence could be forged in no way proves that it is forged. You would need some sort of argument to prove your contention.

Re: Fingerprints can be hacked

#144

Post by joecool1029 »

DangerousPie wrote: post #126
vletal wrote: post #29

Earlier quoted context omitted.

The title almost sounds like that they have a meaningful fingerprint ready to open her iPhone... Was that the case? Or do they have a somewhat accurate partial fingerprint? I failed to find recoding of the presentation.

AFAIK iOS actually uses the pattern of veins below the fingertip rather than an image of the fingerprint itself. So I can't imagine this would be enough to unlock an iPhone.

You're sort of not wrong, touchid uses a capacitive sensor vs. a visual/camera sensor which has become more common in other devices. What this means is in theory you're measuring the electrical behavior of the outer layers of skin, and Apple claims goes as far as measuring subdermis. (This is also is why their touchid scanners don't work on wet fingers as the behavior is thrown off).

However, they are showing their attack working on a Macbook Pro with touchid, which uses this sort of reader. So it's easier to fake in practice than it is in theory. Whatever material you lift the print off of should have to mimic the capacitive behavior of the finger and this looks like it busts Apple's claim that it can read the lower layers (or it tells us their default sensitivity is set too low for convenience)

Re: Fingerprints can be hacked

#145

Post by twobitshifter »

nanidin wrote: post #91
landemva wrote: post #81

Earlier quoted context omitted.

State driver license in USA is a honey pot of thumb/finger scans. Anyone on HN think the NSA doesn't have access? NSA info sharing with trusted foreign countries makes a reliable distributed backup for use by foreign spooks.

> State driver license in USA In which states? The only thing I have been fingerprinted for is in the US is The Global Entry program.

State law enforcement fingerprinted me as a child around 11 years old.

Re: Fingerprints can be hacked

#146

Post by Spivak »

fragmede wrote: post #131
Spivak wrote: post #120

Earlier quoted context omitted.

We're talking about a guard who physically takes your hand, inspects it, and puts your finger in ink, and then compares that to the prints they have on file. This is exactly the protocol that's used by the police and military when taking prints.

So wear fingerless gloves and social engineer a little bit (it's cold, it's winter, I have bad circulation, etc). If you think having a human guard makes a system infallible, I have some bad news for you.

Oh lord, this is firmly off that point. An alert motivated human looking for fakes can identify them with nigh perfect accuracy. This means that it should be possible to build an autonomous system that can do the same which is the goal of biometric auth systems. There is nothing that fundamentally breaks biometric auth until you can burn fingerprints on someone or replace eyes or gene therapy new DNA or whatever. And even then that’s pretty damn strong.

Re: Fingerprints can be hacked

#147

Post by webel0 »

tantalor wrote: post #96
webel0 wrote: post #86

[edit for clarity] As someone who doesn’t specialize in security, one claim that has stood out to me for not using fingerprints is that you can't run bcrypt (or some other salting algorithm) on fingerprints [1]. I don’t see any discussion of that here thus far. Is that still the case? I feel like I would have heard about developments in this area if something had changed. But perhaps I've always misunderstood the cri…

Says who?

Thanks for your comment. I have updated mine to include a reference. In short, I'm thinking about how fingerprints are stored.

Re: Fingerprints can be hacked

#148

Post by Spivak »

fragmede wrote: post #128
Spivak wrote: post #117

Earlier quoted context omitted.

Produce me a living breathing human with a chosen fingerprint -- biometrics are not "a picture of your fingerprint is the password."

But similar to hash collisions, a total break (arbitrary hash values can be output) isn't required for it to be a problem. Where fingerprint scanners aren't magic (especially given the sloppiness of input data), that they're defeatable in corner cases should be enough to be worrisome.

Right but exactly like hashing you can set the difficulty of breaking it to your risk tolerance.

Your phone should probably be a little loose but the retina scanner at the datacenter of the dod will be a lot stricter.

Re: Fingerprints can be hacked

#150

Post by lordnacho »

cool_scatter wrote: post #109
lordnacho wrote: post #79

Earlier quoted context omitted.

Sounds likely. When you train FaceID you are filmed. What's to stop someone from using film of you giving a speech? At best the biometric locks are like locks on your house. Stops most people but not someone really determined.

It uses an IR camera as a proximity sensor. A video isn't good enough. You would need AI to construct an accurate 3D model of the face based on it.

Yes that's what I meant, someone could construct the necessary biometrics from a video and some ML.
Post reply on HN