Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

ccc.de

Post reply on HN
Print view View original

151–160 of 166 posts

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#151

Post by ender89 »

QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

at least a decent software update should be pretty easy to push out to fix the issue.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#152

Post by wapz »

dahauns wrote: post #22
Asdfbla wrote: post #16

Earlier quoted context omitted.

I suppose Samsung tuned the system to avoid false negatives, which might be difficult in all the lighting conditions that might come up in real world use. It's a device for the mass market and average user after all. Might be that they did a bad job with the Iris recognition, but why not give them the benefit of the doubt and consider that they were aware of the trade-offs involved?

Knowingly and willingly giving users a false sense of security? How is that not worse in every way? If they couldn't manage to get false negatives down to an sensible level without compromising security in such a blatant way, there's two courses of action: Live with it, or don't release it.

How is this any different than the swipe to unlock pattern? If you go to a starbucks and sit down for 20 minutes in a higher seat, you can get the passwords to probably 2-5 phones depending on everyone's security and how crowded it is (I inadvertently memorized 3+ coworkers' unlock patterns because they're so easy to see).

If someone has physical access to the user they can probably get into most people's phones (that's just saying people aren't careful enough though).

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#153

Post by continuational »

algesten wrote: post #20

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.

A fingerprint is harder to steal and use than your birthyear of your kid, so for most people it's more secure than a memorable 4-digit pin.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#154

Post by jdironman »

datenwolf wrote: post #139
jdironman wrote: post #105

Earlier quoted context omitted.

An encrypted NFC or Bluetooth bracelet, one sold with or separately to a phone would be nice. Pings it every so often. If it can't find it, automatically self locks. If it can't find for for X number of days and a password hasn't been entered in that time then it wipes || locks the phone.

> n encrypted NFC or Bluetooth bracelet Should be significantly more secure than Mifare though. Ideally something like a contactless OpenGPG card or similar. Recently I searched for passive NFC ICs that'd be suitable for implementing that, but came up empty. Usecase was exactly that: A NFC device located at about the wrist. My laptop has a NFC reader at just the right place of the handrest to read it. And I'd probabl…

Just had an idea, maybe not the wrist for mobile devices, maybe a ring that is always on the hand that is on the back of the phone. I don't know, but I can't help but think of how things can be more secure and that there is a market for those with security in mind.

Just found this also in my search while typing this comment.

http://nfcring.com/

Looks like it might be open source as well?

https://github.com/mclear/NFC_Ring_Control

Might be something to keep check on, it supposedly doesn't release until mid 2017.

EDIT: Just thought about if this is open source, anyone could possibly tie it in with automation apps such as Tasker and really do neat stuff.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#155

Post by datenwolf »

jdironman wrote: post #154
datenwolf wrote: post #139

Earlier quoted context omitted.

> n encrypted NFC or Bluetooth bracelet Should be significantly more secure than Mifare though. Ideally something like a contactless OpenGPG card or similar. Recently I searched for passive NFC ICs that'd be suitable for implementing that, but came up empty. Usecase was exactly that: A NFC device located at about the wrist. My laptop has a NFC reader at just the right place of the handrest to read it. And I'd probabl…

Just had an idea, maybe not the wrist for mobile devices, maybe a ring that is always on the hand that is on the back of the phone. I don't know, but I can't help but think of how things can be more secure and that there is a market for those with security in mind. Just found this also in my search while typing this comment. http://nfcring.com/ Looks like it might be open source as well? https://github.com/mclear/NFC…

I don't like rings (you put on your fingers). But that's just a personal preference. I'd be okay with wristbands though. Yes, the proximity to smartphone NFC readers would be a benefit of a ring.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#156

Post by Eridrus »

torrent-of-ions wrote: post #56
algesten wrote: post #20

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.

Just to make your point explicit, you can't change your identity/biometrics/fingerprint if it is compromised. You can change your keys.

The easiest attack vector is just mugging you on the street after you've unlocked your phone. The police are already doing this.

And unless you regularly leave you phone lying around, you'll realize this is pretty much a requirement for breaking into your phone anyway.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#157

Post by restalis »

lawl wrote: post #21
QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

> CCC were able to do this for about the cost of a S8. I think you misunderstood this. The cost was buying the S8. You only need a laser printer, a decent camera and a contact lens.

"You only need a laser printer, a decent camera and a contact lens."

No, considering that the picture doesn't have to be that good, you need only a rogue picture from somewhere on the Internet (Facebook, Instagram, or whatever), the means to get it printed cheaply (most likely using a public printing service), and the contact lens. Oh, and the contact lens don't have to be new/hygienic. The total cost boils down to pennies.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#158

Post by Geee »

algesten wrote: post #20

Biometric data is not a password, it's an identity. Fingerprints and iris scans are equivalent to a username or email. To secure a device you need a password. Basics: something you are (iris scan, fingerprint), something you have (2fa token, usb unlock key), something you know (password). One out of 3 is probably not very secure.

Something you are: iris or fingerprint

Something you have: phone

You can't log in remotely with an iris or fingerprint.

Re: Chaos Computer Clubs Breaks Iris Recognition System of the Samsung Galaxy S8

#159

Post by Geee »

QuarterReptile wrote: post #9

Based on the write-up, Samsung has lower quality Iris recognition than could be written by an undergrad in a few hours. I say that, having done so. Most obviously, the system should not tolerate a constant-size pupil, ever. The pupil has micro-dilations around twice per second, and your system is really terrible if you don't verify that changing diameter. Also, multi-spectral is a pretty good test, though I don't kno…

You could also flash a bright LED and measure the pupil response. It's possible that there's something unique in the response too.
Post reply on HN