Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

151–160 of 333 posts

Re: Fingerprints can be hacked

#151

Post by twobitshifter »

criddell wrote: post #37
bitxbitxbitcoin wrote: post #19

Earlier quoted context omitted.

I would argue that the devices you carry with you are exactly the ones you shouldn’t use biometrics for. Law enforcement can force you to use biometrics to unlock a phone. They have used dead bodies to unlock phones.[0] What they can’t do is make you remember a code/password which you have “forgotten.” [0] https://www.forbes.com/sites/thomasbrewster/2018/03/22/yes-c...

> What they can’t do is make you remember a code/password which you have “forgotten.” They might be able to with an FMRI machine.

In the US at least FMRI should fall under fifth amendment, right? Otherwise the fifth amendment would be useless. A right to remain silent wouldn’t exist if you can’t silence your brain. If one day there are stargate replicators that can reach into your mind, would that be legal?

Re: Fingerprints can be hacked

#152

Post by hasmanean »

upofadown wrote: post #143
yeetaccount2 wrote: post #10

Earlier quoted context omitted.

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

Most of the evidence that shows up at a court case is forgeable. Simply showing that a particular piece of evidence could be forged in no way proves that it is forged. You would need some sort of argument to prove your contention.

All evidence is ultimately forgeable. At some point a modern day Godel could prove that “justice” in a free society is mathematically impossible.

The law has to operate within a practical compromise and err heavily on the side of reducing false convictions.

Re: Fingerprints can be hacked

#153

Post by twobitshifter »

immmmmm wrote: post #18

in biometrics this is called a Presentation Attack (PA), here the fake fingerprint is the analog of presenting a photograph, video or 3dp mask to a face recognition system. this is usually mitigated by the use of Presentation Attack Detection (PAD) systems, either hardware, software or hybrid. in this particular case it can easily be mitigated by some hardware that measures the amount of water in the biometric sample…

It’s relatively easy to produce “phantom” that mimics tissue/skin from household ingredients. This is used in medical labs.

https://deepblue.lib.umich.edu/bitstream/handle/2027.42/3819...

Re: Fingerprints can be hacked

#156

Post by folkrav »

amalcon wrote: post #35
braincoke wrote: post #11

Earlier quoted context omitted.

I believe it's - Something you have (key, device,...) - Something you know - Something you are (biometry) In Europe there is a regulation (PSD2) that defines a strong authentication as 2 of the 3 listed above.

I've always disliked this breakdown. My body is something I have -- it's just potentially (not always practically -- see the article) more difficult to clone or otherwise use without my consent than a key fob or something. Edit: To be clear, I don't think this is an argument for biometrics, but rather an argument against them. They can't complement something I have in a two factor scheme, because my biometrics are so…

I'd tend to describe one's body as a state more than a possession. You are your body, it's not something you can get rid of.

Re: Fingerprints can be hacked

#157

Post by ozim »

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

Pin/password can also be hacked and there is no need for fancy 3D printer.

Someone can use their smartphone to film other person as they type stuff in, no need for printing fake print. They can steal phone/laptop as soon as they are done filming.

This is the case that fingerprint sensors are preventing.

Pointing out problems is useless - as people don't have alternative that would be "all-mighty secure without flaws".

It should be defense in depth not - and that is already there for example banking apps - you need fingerprint to unlock the phone and banking app requires its own specific PIN. Getting those 2 things makes it much harder for bad guys to do something like money transfer. Yeah they might get your photos and other stuff - but probably there are secure store apps that would encrypt your photos if you have ones that you really want to protect.

Re: Fingerprints can be hacked

#158

Post by nanidin »

fragmede wrote: post #125
nanidin wrote: post #91

Earlier quoted context omitted.

> State driver license in USA In which states? The only thing I have been fingerprinted for is in the US is The Global Entry program.

If your argument is that the NSA doesn't have your fingerprint because only the Global Entry Program has your fingerprint, I find that highly suspect. Of all the databases to be shared with the CIA and the NSA, Global Entry seems entirely reasonable that they be given access. Unlike state's driver license database where it's objectionable that the NSA be allowed to access it, Global Entry has to do with people coming…

My response did not intend to address the NSA, it was intended to address the "state driver license in USA is a honey pot" since in my experience states do not collect fingerprints for driver licenses. Based on some cursory research there are only a small handful of states that require fingerprints, and fingerprints are not required for implementation of Real ID.

Re: Fingerprints can be hacked

#160

Post by throw0101a »

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

> The core problems with biometrics are that:

… is that they're treated as passwords instead of usernames. The three problems you list all have the biometric=password assumption in them.

See also using the American SSN usage: it's treated like a (secret) token, and so when it leaks it can be used to access sensitive information. Using it as 'just' a username would probably reduce a lot of problems as well.

Post reply on HN