Fingerprints can be hacked • Hacker News Board

Re: Fingerprints can be hacked

#251

Post by registeredcorn » Mon, Nov 22, 2021, 9:52 PM UTC

tmm wrote: post #224

lelandbatey wrote: post #223

Earlier quoted context omitted.

There's not quite an "algorithm"; SSN's are so short (it's just a 9-digit number, so max 1 billion unique SSNs) that they have a very simple procedure for assigning them. The Social Security Administration explains it here: https://www.ssa.gov/history/ssn/geocard.html - The first set of three digits is called the Area Number - The second set of two digits is called the Group Number - The final set of four digits is t…

Not since June 25, 2011 when they started randomizing assignment[1]. They still don't use 666 as an area number, though. [1] https://www.ssa.gov/employer/randomization.html

I have mixed emotions about this.

From a security professional perspective, this is at least somewhat of an improvement, even if the entire thing feels like it's held together with a wish and a prayer. I would really like if there were a means to just institute an entirely new system. Essentially having one's entire life ruined, on the chance a bad actor can guess a four digit number is...not great.

From a genealogist perspective though, this is horrible news. Being able to trackdown people based off of rough geographic assumptions can help narrow down if someone is "lucky" enough to have a common name in a specific region. Of course, this change to SSN isn't nearly as disastrous as the death of paper - especially newspapers - but I really do not envy anyone who is going to try and do historical family research in two to three hundred years. It makes me cringe just to think about how much valuable information, how many life changing moments, are going to be lost to encryption, bit rot, and the constantly changing standards of software and hardware.

Re: Fingerprints can be hacked

#252

Post by 14 » Mon, Nov 22, 2021, 10:02 PM UTC

ampdepolymerase wrote: post #179

yeetaccount2 wrote: post #10

Earlier quoted context omitted.

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

Why in the world would you need CRISPR or lab grown meat? Just sequence the DNA and send it off to a DNA assembly service. The price is a couple hundred bucks a pop. You don't have to replicate the entire DNA, just the segments used for forensic PCR. (On a side note, the state of biotechnology and life science knowledge on HN is utterly deplorable, repeating buzz words does not reality make.)

You make fun of people’s knowledge but at the same time suggest sending DNA to a lab to have it replicated. That would be not very smart since op was discussing how someone might get away with a crime and you suggest just contacting a professional service and probably just use a credit cart. Not smart at all. So we may not be biotechnology savvy but we have other areas of knowledge you obviously lack.

Re: Fingerprints can be hacked

#253

Post by Normal_gaussian » Mon, Nov 22, 2021, 10:19 PM UTC

ozim wrote: post #157

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

Pin/password can also be hacked and there is no need for fancy 3D printer. Someone can use their smartphone to film other person as they type stuff in, no need for printing fake print. They can steal phone/laptop as soon as they are done filming. This is the case that fingerprint sensors are preventing. Pointing out problems is useless - as people don't have alternative that would be "all-mighty secure without flaws"…

The fancy 3D printer in this case is a regular toner printer and some garden variety wood glue.

Re: Fingerprints can be hacked

#254

Post by ineedasername » Mon, Nov 22, 2021, 10:34 PM UTC

The problem with any lock is that, fundamentally, it is made to be opened when certain conditions are met. And that's putting aside any sort of brute force approach.

Good security design is as much about asking, from first principles, "what conditions need to be met to open this?" as about considering how it might be attacked.

For example, the condition to be met for a pad lock to open is not "when the proper key is inserted" or "the key pins are raised to the appropriate level". It's something more basic-- like "when the locking bar no longer blocks the shackle from rising."

From that perspective, attacking the key hole and pins is only one of multiple vectors.

Re: Fingerprints can be hacked

#255

Post by amelius » Mon, Nov 22, 2021, 10:40 PM UTC

ineedasername wrote: post #254

The problem with any lock is that, fundamentally, it is made to be opened when certain conditions are met. And that's putting aside any sort of brute force approach. Good security design is as much about asking, from first principles, "what conditions need to be met to open this?" as about considering how it might be attacked. For example, the condition to be met for a pad lock to open is not "when the proper key is…

Or you just open the lock with a bolt cutter.

Re: Fingerprints can be hacked

#256

Post by p2p_astroturf » Mon, Nov 22, 2021, 10:50 PM UTC

damn i need more sockpuppet accounts so i can list all my snarky comments:

- no shit, use public keys

- your 2FA can also be hacked

- your company forcing 2FA is insufferable like all modern web

- your KYC is literally pointless since i already gave those same ID photos to 100 different companies, few to none of which are competent enough to keep them secret

EDIT: huh, this is actually a good article. but it's still ironic since it's coming from a company that follows all the standard snake oil

Re: Fingerprints can be hacked

#257

Post by passivate » Mon, Nov 22, 2021, 10:59 PM UTC

1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I'm sure the military has better than average tech when it comes to security, but I wonder if they're agile enough to embrace the rapid technological change that is necessary to stay on the bleeding edge. These days when I hear military + security in the same sentence I think of aging warships running windows 2000, using oddball niche technology supplied by equally oddball government contractors/vendors.

Re: Fingerprints can be hacked

#258

Post by a-dub » Mon, Nov 22, 2021, 11:03 PM UTC

i find this whole in-screen fingerprint reader trend to be pretty funny. isn't glass excellent for capturing fingerprints?

i suspect biometrics like fingerprints may play a role in the future, but the role they would play is more convenience in cases where the device knows its in a trusted environment. (that is, there will be more attention on devices tracking whether they've been separated from their owner, or if their owner is not behaving like their owner, and if so, requiring additional challenge)

either that or we'll all be carrying keys. there are some cool wearables i've seen out there that i think talk nfc.

Re: Fingerprints can be hacked

#259

Post by alsetmusic » Mon, Nov 22, 2021, 11:07 PM UTC

omgwtfbyobbq wrote: post #184

hasmanean wrote: post #152

Earlier quoted context omitted.

All evidence is ultimately forgeable. At some point a modern day Godel could prove that “justice” in a free society is mathematically impossible. The law has to operate within a practical compromise and err heavily on the side of reducing false convictions.

Or err heavily on reducing the release of the guilty, depending on the region.

> Or err heavily on reducing the release of the guilty, depending on the region.

This is antithetical to the concept of serving one’s time. Guilty people deserve to go free once their debt to society has been fulfilled.

Re: Fingerprints can be hacked

#260

Post by ineedasername » Mon, Nov 22, 2021, 11:09 PM UTC

amelius wrote: post #255

ineedasername wrote: post #254

The problem with any lock is that, fundamentally, it is made to be opened when certain conditions are met. And that's putting aside any sort of brute force approach. Good security design is as much about asking, from first principles, "what conditions need to be met to open this?" as about considering how it might be attacked. For example, the condition to be met for a pad lock to open is not "when the proper key is…

Or you just open the lock with a bolt cutter.

Thumbprint locks on a laptop won't usefully respond to a bolt cutter. A padlock was just a convenient example. Even then, bolt cutters don't work in the strongest of them: angle grinders are a popular choice in that case, but are a lot more obvious. You can't hide a small angle grind up your coat sleeve and quickly snap the hasp on a bike lock.

In any case, the bolt cutters approach is also why I stipulated "putting aside brute force". Because in the context of computer security as with this article, something a bit more subtle seems to be effective more often, especially against higher end security.