Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphones can be fooled by fake, digitally composed fingerprints

nytimes.com

Post reply on HN
Print view View original

101–110 of 114 posts

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#101

Post by cantrevealname »

umurkontaci wrote: post #23

I have the feeling that the researched tried to unlock real phones and failed. It sounds weird when you say you have made a research about security of fingerprint scanners on phones without actually trying the attacks on those phones.

> I have the feeling that the researched tried to unlock real phones and failed.

That sounds plausible.

Think about how much more impressive their results would be if they demonstrated the attack on real phones. But they have a paper to publish, so why detract from the paper by mentioning that tests on real phones didn't pan out.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#102

Post by enig_matic7 »

"The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower in real-life conditions. Still, the findings raise troubling questions about the effectiveness of fingerprint security on smartphones."

Wat.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#103

Post by fauigerzigerk »

djrogers wrote: post #64
fauigerzigerk wrote: post #52

Earlier quoted context omitted.

>I shouldn't be surprised, but the reporting on this makes it sound way different than the actual research. Specifically, none of the research appears to have been performed on, or tested against ACTUAL SMARTPHONE implementations That is exactly what the article says. Specifically: The researchers did not test their approach with real phones, and other security experts said the match rate would be significantly lower…

The article currently linked here is not the same one originally linked. It was changed after I made my post. That said, the headline still explicitly calls out smartphones.

Oh, I see! Now that is weird. Apologies.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#106

Post by r00fus »

nezza-_- wrote: post #71
r00fus wrote: post #55

Earlier quoted context omitted.

That hack uses lab conditions. They have a clear wine glass with a high resolution scanner. More real-life conditions (smeared print, non-glass surface) would be interesting to reproduce. My guess is that it ups the ante significantly for cost of hacking.

This is absolutely not a lab condition. You can very easily extract a fingerprint from a glass or so, as was done e.g. with Wolfgang Schaeuble, a German politician

Did they then hack into his iPhone? What was the quality of that fingerprint?

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#107

Post by Mz »

1maginary wrote: post #58
Mz wrote: post #15

Earlier quoted context omitted.

In context, I think it (that specific bit) is fairly easy to follow: The technique has improved since then, the methods to crack it but also turn. The eternal cat and mouse game between team blue and team red. So, apparently the first sentence means that the technique has improved since then, but so have the methods trying to crack it. Though, to be fair, I have no clue what rumgeilt means and that was apparently jus…

>Die Technik hat sich seitdem zwar verbessert, die Methoden sie zu knacken aber wiederum auch. Is what it was trying to translate, not sure where you/it got 'rumgeilt' from. A more natural sounding translation would be: The technology has improved since then, but, on the other hand, so have the methods to crack it You could also translate 'wiederum' as 'in turn' which might exlain the 'turn' in Google's translation.

Rumgeilt was later in the English translation of the article.

I know a little German, a little French and took Classical Greek in college, as well as Intro to Linguistics (where, iirc, we covered a bit of Swahili grammar for some damn reason). I am pretty comfortable with both weird idioms not translating directly and with finding close, if uncommon, matches between some other language and words or phrases in English. So, the "in turn" part doesn't disturb me. I mean, you could translate it as something like "They are taking it in turns" or "but the methods to crack it also got their turn to improve."

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#108

Post by Godel_unicode »

eriknstr wrote: post #94
Godel_unicode wrote: post #93

Earlier quoted context omitted.

You're assuming an equivalent amount of entropy between the 1000 real fingerprints and constructed fake ones which are attempting to be as close as possible to the real one. That seems unreasonable to me. You're still also only considering false negatives (user is erroneously rejected). You have no data points about false positives (user is erroneously allowed). If the sensor always detects and admits Bob, even when…

>You're still also only considering false negatives (user is erroneously rejected). You have no data points about false positives (user is erroneously allowed). As far as I understood, the system is distinguishing between its members so we have some data about false positives because OP was always identified as themselves and never as another member.

From that data point, how can you be sure that every single finger pressed to the reader doesn't identify as OP? You are assuming OPs low false negative rate has implications about false positives.

Edit: this type of reasoning is probably what lead to the recent authentication bypass flaw in Intel's AMT code. It just accepts anything passed to it as a valid password hash. That test is probably still passing in their CI system...

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#109

Post by hexane360 »

Godel_unicode wrote: post #108
eriknstr wrote: post #94

Earlier quoted context omitted.

>You're still also only considering false negatives (user is erroneously rejected). You have no data points about false positives (user is erroneously allowed). As far as I understood, the system is distinguishing between its members so we have some data about false positives because OP was always identified as themselves and never as another member.

From that data point, how can you be sure that every single finger pressed to the reader doesn't identify as OP? You are assuming OPs low false negative rate has implications about false positives. Edit: this type of reasoning is probably what lead to the recent authentication bypass flaw in Intel's AMT code. It just accepts anything passed to it as a valid password hash. That test is probably still passing in their…

. . . because the gym still uses the system? If it didn't accurately distinguish between their customers, why would they still use it?

This is 100% not the same type of reasoning. We have reason to believe that the fingerprint accurately distinguishes between 1000 different options. False positive and false negative aren't meaningful terms here, because we're no longer dealing with yes/no results.

Re: Smartphones can be fooled by fake, digitally composed fingerprints

#110

Post by Godel_unicode »

hexane360 wrote: post #109
Godel_unicode wrote: post #108

Earlier quoted context omitted.

From that data point, how can you be sure that every single finger pressed to the reader doesn't identify as OP? You are assuming OPs low false negative rate has implications about false positives. Edit: this type of reasoning is probably what lead to the recent authentication bypass flaw in Intel's AMT code. It just accepts anything passed to it as a valid password hash. That test is probably still passing in their…

. . . because the gym still uses the system? If it didn't accurately distinguish between their customers, why would they still use it? This is 100% not the same type of reasoning. We have reason to believe that the fingerprint accurately distinguishes between 1000 different options. False positive and false negative aren't meaningful terms here, because we're no longer dealing with yes/no results.

> why would they still use it?

"If this authentication system didn't work nobody would use it" is literally the reasoning I mentioned above.

> we're no longer dealing with yes/no results

That's exactly what we're dealing with. Iterate through the list of fingerprints in the database, does provided == stored.

You might be interested in reading about CER (crossover error rate). It's the term used for discussing the trade-off between type 1(false positive) and type 2 (false negative) in biometric systems especially.

https://security.stackexchange.com/questions/57589/determini...

Post reply on HN