Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fingerprints can be hacked

blog.kraken.com

Post reply on HN
Print view View original

111–120 of 333 posts

Re: Fingerprints can be hacked

#111

Post by [deleted] »

yeetaccount2 wrote: post #10
1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

[deleted]

Re: Fingerprints can be hacked

#112

Post by ipspam »

yeetaccount2 wrote: post #10
1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

I’m waiting on a court case with a fingerprint as key evidence for conviction, in which the defendant brings this up. Might not pass reasonable doubt muster, but what if somebody sold fingerprint forgery kits online that made it push-button simple? Just supply an image or two, run it through some ML to reconstruct the print, laser etch a latex glove or similar… I wonder if you could use CRISPR or “lab-grown meat” tec…

Could work for a digital intrusion, but for crime scenes there is dna

Re: Fingerprints can be hacked

#113

Post by dylan604 »

qw wrote: post #58
landemva wrote: post #34

Earlier quoted context omitted.

'what if somebody ...' made SaaS service to upload pictures and overnight ship the fingertip.

It would probably cause a huge media storm. Then the politicians would "fix it" by replacing it with face recognition... (suddenly Face/Off is no longer science fiction)

As long as you can weather the storm, a storm is not the death of shady businesses. The shady facial recognition software that scraped social media for images got some bad press, and then just stayed calm and carried on.

For all of those outraged by the media storm, it is free advertising to those actually interested in the service. All of the pearl clutchers feigning shock and outrage over shady service mean nothing to the company providing the service, as these were never going to be their customers in the first place.

Re: Fingerprints can be hacked

#114

Post by trulyme »

The biggest problem imho is that we only have two states on our phones - locked and unlocked.

Ideally, I should be able to unlock the phone and take photos using just my fingerprint. In my case I would also like to be able to call, message, play games and similar. But to access the 2fa app, cryptoasset app or similar, I must further authenticate in a way that I only reveal parts of my secret ("Enter 3rd, 8th and 11th character of your password:"). The assumption here is that I will mostly authenticate in a private setting, but sometimes I might not have that luxury.

Re: Fingerprints can be hacked

#115

Post by runnerup »

Spivak wrote: post #107
1cvmask wrote: post #2

My favorite photograph of a fingerprint is when the Chaos Computer Club reproduced the German Foreign ministers fingerprint from a photo. So much for military grade security. https://www.dw.com/en/german-defense-minister-von-der-leyens... - The core problems with biometrics are that: 1) Not revokable (unlike compromised credentials) 2) Not a secret 3) Usually trivial to reproduce and spoof (even "liveliness" tests)

This meme really really has to die. It's so annoying that it's spread so far. Biometric security (i.e something you are) does not need to be secret nor revoked. That's the entire point . It's a piece of information that even when it's known by everyone still can't be reproduced. The strength of a security system based on biometrics is exactly how well that system can detect that it's reading from an living breathing…

> Perfect: A human guard manually taking a fingerprint reading. Can't be beat because the guard can obviously see that it's not really your hand.

Well, the argument some people are making is that this might be no better than a human checking your ID. Yes, there the guard can verify that there is some real human there, but both the ID and the fingerprint could be faked (e.g. a fake fingertip mold which matches the victim's "known" fingerprint).

Re: Fingerprints can be hacked

#116

Post by Spivak »

albert_e wrote: post #104

How about .... Fingerprint sensors + inbuilt IR sensors that verify that there is a "live" finger with blood and pulse behind that print. Would that help make FP authentication more robust?

Yes, if you're interested in this kind of stuff you basically have to work for the military because they're the only ones with the funding and motivation for this kind of stuff.

Re: Fingerprints can be hacked

#117

Post by Spivak »

philovivero wrote: post #110
Spivak wrote: post #107

Earlier quoted context omitted.

This meme really really has to die. It's so annoying that it's spread so far. Biometric security (i.e something you are) does not need to be secret nor revoked. That's the entire point . It's a piece of information that even when it's known by everyone still can't be reproduced. The strength of a security system based on biometrics is exactly how well that system can detect that it's reading from an living breathing…

> That's the entire point. It's a piece of information that even when it's known by everyone still can't be reproduced. And yet, it can be reproduced. So it seems like the entire point is... invalid.

Produce me a living breathing human with a chosen fingerprint -- biometrics are not "a picture of your fingerprint is the password."

Re: Fingerprints can be hacked

#119

Post by dylan604 »

nanidin wrote: post #91
landemva wrote: post #81

Earlier quoted context omitted.

State driver license in USA is a honey pot of thumb/finger scans. Anyone on HN think the NSA doesn't have access? NSA info sharing with trusted foreign countries makes a reliable distributed backup for use by foreign spooks.

> State driver license in USA In which states? The only thing I have been fingerprinted for is in the US is The Global Entry program.

I've only had a state issued driver's license in CA and TX, and both require thumb prints. But I'm sure if you were truly interested, you could search the web for that information fairly quickly, actually probably faster than it took to post the question to HN:

https://duckduckgo.com/?q=which+states+require+thumb+print+f...

Re: Fingerprints can be hacked

#120

Post by Spivak »

runnerup wrote: post #115
Spivak wrote: post #107

Earlier quoted context omitted.

This meme really really has to die. It's so annoying that it's spread so far. Biometric security (i.e something you are) does not need to be secret nor revoked. That's the entire point . It's a piece of information that even when it's known by everyone still can't be reproduced. The strength of a security system based on biometrics is exactly how well that system can detect that it's reading from an living breathing…

> Perfect: A human guard manually taking a fingerprint reading. Can't be beat because the guard can obviously see that it's not really your hand. Well, the argument some people are making is that this might be no better than a human checking your ID. Yes, there the guard can verify that there is some real human there, but both the ID and the fingerprint could be faked (e.g. a fake fingertip mold which matches the vic…

We're talking about a guard who physically takes your hand, inspects it, and puts your finger in ink, and then compares that to the prints they have on file. This is exactly the protocol that's used by the police and military when taking prints.
Post reply on HN