Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

Post by kuschku » Tue, May 23, 2017, 5:27 PM UTC

abritinthebay wrote: post #99

mae9tvw5 wrote: post #84

Earlier quoted context omitted.

Yes. They explained all the innovative magic of Apple's fingerprint sensor was better image resolution. So all they had to do was improving that on their end too. I imagine the body changes everywhere over time, so this resolution game has a hard limit. A fingerprint is the worst choice of biometric data, as people leave them everywhere...

People don't leave perfect moldae prints everywhere. AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger. That isn't to say it's not possible but it is a pretty major asterisk.

Post by jlg23 » Tue, May 23, 2017, 5:45 PM UTC

freeflight wrote: post #25

Asdfbla wrote: post #14

>Iris recognition may be barely sufficient to protect a phone against complete strangers unlocking it I suppose that's the attack scenario those systems (at least in phones) are supposed to protect against, to be fair. Suppose the alternative might be that some users use a predictable pin or none at all. Fingerprints or the iris sensor is an improvement for them because they are quick and easy to use. Of course it's…

>Fingerprints or the iris sensor is an improvement for them because they are quick and easy to use. I'm not sure about it being an improvement, human laziness always finds a way to make something less secure. Like buying "fingerprint stickers" because too lazy to pull off a glove when wanting to unlock the phone [0]. The CCC always does interesting stuff like this, a couple of years they reproduced a politicians fing…

Post by digi_owl » Tue, May 23, 2017, 5:51 PM UTC

mae9tvw5 wrote: post #60

matt4077 wrote: post #41

Earlier quoted context omitted.

Samsung always seems to me as if they race to match any iPhone feature–but never more than skin-deep. So when the iPhone gets a fingerprint sensor that saves only a hash of the actual data in a special enclave of a custom chip, Samsung responds with an iris scanner that saves an image of the iris as a world-readable jpeg in your home directory. Thus, their marketing material can claim feature-parity (or even exceed A…

>It's not like Apple doesn't run into similar problems (not sure if the fingerprint sensor has been defeated–it's a bad idea for 5th amendment reasons in any case). But at least they do the minimum in trying. In 2013 a CCC member broke TouchID access within a few hours after release of the IPhone. All needed was a photograph of the fingerprint on a glass surface. https://www.ccc.de/en/updates/2013/ccc-breaks-apple-to…

Post by lorenzhs » Tue, May 23, 2017, 6:42 PM UTC

nobodyorother wrote: post #124

abritinthebay wrote: post #99

Earlier quoted context omitted.

People don't leave perfect moldae prints everywhere. AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger. That isn't to say it's not possible but it is a pretty major asterisk.

Didn't some group pull a politician's finger print off his dinner glass and then include it as an insert with all the issues of some magazine? Can't find the reference right now, but somebody's gotta remember this, it was when the UK was considering using biometric data as IDs.

Post by rennir » Tue, May 23, 2017, 6:46 PM UTC

draugadrotten wrote: post #18

dingo_bat wrote: post #13

The important thing is how much more/less difficult is this than spoofing a fingerprint. If it is significantly harder, I still see it as a win for samsung's security.

Spoofing this eye is significantly easier than spoofing a fingerprint, because modern fingerprint technology detect if a fingerprint is "alive" by looking at sweat pores, pulse, veins under the skin and other features of a living finger.