Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

231–240 of 333 posts

Re: Fingerprints can be hacked

#231

Post by trie »

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

> 1) Not revokable (unlike compromised credentials)

Isn't that what Cancelable Biometrics e.g. [0] is about [0] https://ieeexplore.ieee.org/document/7192838

Re: Fingerprints can be hacked

#232

Post by mfollert »

hartator wrote: post #63
jeroenhd wrote: post #60

Biometrics are great for authentication but terrible for authorization. Anything sensitive should require both. There's nothing wrong with a fingerprint and a password or a fingerprint and an RFID card as an authorization/authentication pair; you just have to keep these things in mind. I've fallen to the laziness of using fingerprints on my devices as well, but they still require a password to decrypt the contents of…

> Biometrics are great for authentication but terrible for authorization What does that mean? Unlocking your MacBook gives access to your RSA keys and all is lost.

How do you protect your private keys? I already have an yubikey but it still feels not great.

Re: Fingerprints can be hacked

#235

Post by IshKebab »

mdp2021 wrote: post #210
IshKebab wrote: post #197

Earlier quoted context omitted.

Fingerprints are not usernames. I wish that idea would die but people just love putting things in existing categories so much they keep thinking "fingerprints aren't the same as passwords... so they must be the same as usernames!".

It seems you are stating that fingerprints do not identify an account holder. You should justify the statement.

No, I'm stating that fingerprints to not have the same security and privacy properties as usernames. Therefore they are not equivalent to usernames.

* Usernames can be changed. Fingerprints can't.

* Usernames can be denied. Fingerprints can't.

* Usernames are zero effort to copy. Fingerprints require some skill and effort (if you have a decent fingerprint reader).

* People are happy to share usernames online. Fingerprints are considered much more private.

Re: Fingerprints can be hacked

#236

Post by abustamam »

tmm wrote: post #224
lelandbatey wrote: post #223

Earlier quoted context omitted.

There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is t…

Not since June 25, 2011 when they started randomizing assignment[1]. They still don't use 666 as an area number, though. [1] https://www.ssa.gov/employer/randomization.html

This is a good change, but since it's not retroactive anyone born before that date (which is 100% of adults and probably roughly 50% of minors, who are likely not good targets for identity theft) are still at risk.

Re: Fingerprints can be hacked

#237

Post by jiveturkey »

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

those aren’t a problem when the biometric is used correctly. eg not as single factor authentication

Re: Fingerprints can be hacked

#238

Post by lstodd »

Aengeuad wrote: post #174
y4mi wrote: post #43

Earlier quoted context omitted.

You can unlock most home doors within seconds even without having the key Nonetheless, we still lock our doors and thieves often break in, even though picking the lock is both safer and less likely to arouse suspicion. Your argument makes sense, but we humans aren't really rational

There's a good reason why criminals don't carry lockpicks around and that's because they're regulated, in much of the world mere possession of them outside of your residence is a criminal offence and even in places where you can carry them legally they not only show prior intent, their use in criminal activities carries a charge just like breaking and entering. I'd also argue that being stuck picking a stubborn lock…

Lockpicks for the common locks can be made on site in under 5 minutes and then after about half-minute the lock is broken, and picks are discarded.

That is why they aren't carried around any more.

And that is not taking into account that most locks can be defeated without lockpicks, a steel ruler will do.

It's just sad when people that don't know a bit about the trade boast about "regulations" and how they are relevant. They are not.

Re: Fingerprints can be hacked

#239

Post by xoa »

mrtranscendence wrote: post #216
xoa wrote: post #180

Earlier quoted context omitted.

I think you misread me, or I didn't communicate clearly. By "lengthy" I was referring to the policy , not password length. Indeed max password length itself is another common bit of foolishness, for sanity reasons arguably it shouldn't be infinite but ~150 characters should be fine so that if people want to have a long diceware passphrase that's fine. To the extent passwords are used at all it should be exclusively a…

Ah, gotcha, sorry. "Lengthy (password policies)", not "(lengthy password) policies". I wouldn't call the policies themselves particularly lengthy, though we do have multiple systems with different policies for which we're supposed to use the same password, so there's that -- it's possible to set a password in one place that can't be set in the other. (Would something bad happen if they weren't in sync? I can't see ho…

Sorry for not being clearer. Really though, the only "password policy" should be "no password reuse/dictionary" (check it against haveibeenpwned.com or the like, there is a nice API), and some minimum decent length. Preferably with a decent user friendly generator option for default suggestions too, and password manager friendly. It's probably not the weakest link at that point. "Multiple systems with different policies for which we're supposed to use the same password" seems like it should just be SSO?

But I recognize in reality when using archaic systems at businesses with no budget sometimes hacks are just the best that can be done, and that's how it is. I mean, obviously best of all is no shared password, use proper key via hardware token instead and the password/PIN or (gasp :)) biometrics is purely something the user uses to activate the token. Unfortunately it'll probably be awhile until we get there. But the general use of baroque password policies, particular when interfacing with the general public, is still an anti-feature for security which has finally started to fade away.

Re: Fingerprints can be hacked

#240

Post by imwillofficial »

Spivak wrote: post #148
fragmede wrote: post #128

Earlier quoted context omitted.

But similar to hash collisions, a total break (arbitrary hash values can be output) isn't required for it to be a problem. Where fingerprint scanners aren't magic (especially given the sloppiness of input data), that they're defeatable in corner cases should be enough to be worrisome.

Right but exactly like hashing you can set the difficulty of breaking it to your risk tolerance. Your phone should probably be a little loose but the retina scanner at the datacenter of the dod will be a lot stricter.

That’s not a thing (Re: dod)
Post reply on HN