In this context I find it most interesting that many reviews of the Note7 disregard the iris scanner as not as easy to use as the fingerprint scanner so the reviewer will stay with the fingerprint sensor, and I always thing "Yes, well, but ..."
Sounds interesting, I thought the iris scanner needs to illuminate your iris to make it work and you can't do this from photos, I've head this from you for the first time.
Any source where I can read about fooling iris scanners with photos?
And this is the reason why fingerprints should not be used as a password. If the password that you are using (string, pin, fingerprint, iris) can not be change then this could be use as username not password. It is very convenient to use things like fingerprints to lock your devices but if your credentials will get compromised once then you can not ever secure it again. Plus we leave finger prints everywhere all the time, it's just a matter of time when databases with fingerprints matching fb profiles will show up on the internet. Think about it as rainbow tables for unlocking stolen devices.
Is the point of fingerprint scanners really to defeat advanced, targeted hacking efforts where someone has multiple high-resolution photos of you? Or is it (IMO more plausibly) just to keep somebody who picks your pocket or whatever from also getting access to your bank accounts and so on? For the latter scenario the fingerprint works fine.
Touch ID is a fun case in security where bad is better. Fingerprint authentication on a fingerprint magnet seems like a foolish idea until you realize the alternative (for the majority of users) is 4-digit PINs[1], not strong passwords.
Not really - with a pattern you drag from one loaction to another. With a PIN you tend not to drag your finger along but lift and press.
In addition with PINs you can have diagonally opposite numbers (e.g. 1-9 or 3-7) but with patterns you don't have that unless you use 5 on the way (e.g. 1-5-9 or 3-5-7). In fact most people will have the central dot in their pattern recognition somewhere in the middle just through human nature.
Apple uses fingerprints in addition to the PIN. To do anything security wise in iOS, you have to enter your PIN. You can use your fingerprint to unlock the phone but only if the phone has been unlocked by the PIN previously. I'm sure numerous improvements can be made for this system but it's more of a form of second factor authentication than a primary form of authentication in iOS.
Like in the USA, the social security numbers, our driver license numbers, etc. are all used as authentication, when originally were meant as identification for tracking purposes.
So far, the safest form seems to be what we keep in our heads.
> Like in the USA, the social security numbers, our driver license numbers, etc. are all used as authentication, when originally were meant as identification for tracking purposes.
The SSN certainly, but I don't think I've ever been asked for my DL number for authentication rather than identification. Maybe I've just forgotten. When did it happen to you?
Fingerprints are not something you are. Fingerprints are something you own.
Well, you actually own them as much as you own the ideas. Or passwords. Written in your forehead.
It is very foolish to use them for security purposes. And it is very dangerous to allow some entity to collect them, as this will eventually lead to very large privacy and freedom violations.
That's all very interesting stuff, but somehow I missed something: how was he able to verify the fake finger prints from the minister were usable and close enough to the real finger prints to fool a biometric device?
I read the article twice and haven't spotted how he verified the hack worked in the case of the minister.
There was this story (which I find an incredible achievement, if true) of a child abuser's fingerprints being taken just from a photo that he had posted online:
Perhaps, but even with acid burns, computers can still find enough commonality to link them. Fundamentally, a secret is something that needs to be changeable. Since you can't (currently) change your fingerprints on-demand, they can't be used as a good secret.
For most people, using fingerprints for authentication is fine. Any security measure has pros and cons. If they're too hard to use, people will circumvent them or the usefulness of the device or service will be degraded. It's just a matter of cost-benefit. I could use a 6-figure passcode on my phone, or a 4-figure one or my fingerprint. I choose to use the latter, with a 6-figure code as backstop, knowing that this is in some ways a less secure option. It's my choice and I'm glad I have it. Still, stunts like this serve a useful purpose in making sure we're all very much aware of the limitations of the security options available. That's valuable to know.
Seriously, fingerprints is the worst biometric password. Anything you touch leaves a piece of it, if not the whole thing. The fact that it's still being used is a testament to how easy it is to break into various "secure" accounts.
> The fact that it's still being used is a testament to how easy it is to break into various "secure" accounts.
I don't disagree with your premise (that fingerprints are very bad passwords), but I don't see the logic of this sentence. If I were in favour of the use of fingerprints as passwords, I would think their continued use pointed to how hard, not how easy, it is to break them (because otherwise, hypothetical me would think, surely they would no longer be used).
Fingerprints and cornea are bad ideas to use as passwords.
One of my friends likes to go hiking in this area a few miles away from million+ dollar neighborhoods. They get approached by someone pretending to be a union member and they get to chatting. The union member has to show them some video on his phone, and so my friend takes a look. There's a slight glitch in the guy's phone and my friend sees their own face for a brief second with what looked like highlighters around their eyes, kind of like those eye tracking things.
They didn't think much of it until they read about cornea copying and hacking. They realized they were being "bio-hacked" but there is nothing they work on that needs bio clearance so they figure the union members were hired by some people to collect bio prints of likely targets in the area.
Plus I heard it is common to use union and organized crime groups, police, etc.. to stake out and collect intelligence on possible targets for corporate espionage, and other related crimes. It seems to be an unspoken problem in the area.
46 comments
[ 3.4 ms ] story [ 111 ms ] threadBackground material: https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
Primary source: https://www.ccc.de/en/updates/2014/ursel and video (in German) https://media.ccc.de/v/31c3_-_6450_-_de_-_saal_1_-_201412272...
Instructions (in German): https://www.ccc.de/de/campaigns/aktivitaeten_biometrie/finge...
[0] https://www.wired.com/2008/03/hackers-publish/
Any source where I can read about fooling iris scanners with photos?
Identity cannot be changed if compromised.
As a second form of authentication it is fine, but as a single form alone it is a bad idea.
Ideally you would always have two of these:
* Something you know (i.e. password)
* Something you have (i.e. yubikey or a token generator on your phone)
* Something you are (i.e. fingerprint)
But if you must have only one of these then the weakest one is something you are as, if compromised, it can never be changed.
Yes.
> Identity cannot be changed if compromised.
I'm not up to date at what's possible with plastic surgery, but in this specific case I think it's doable (new fingerprints).
> As a second form of authentication it is fine, but as a single form alone it is a bad idea.
I don't consider it authentication. More like a record locator.
> But if you must have only one of these then the weakest one is something you are as, if compromised, it can never be changed.
I think a lot of this "fingerprints as authentication" stuff will go away once situations like this become commonplace: https://news.ycombinator.com/item?id=11726108
Maybe you don't, but a lot of others do. Like, Apple.
[1] http://www.datagenetics.com/blog/september32012/
In addition with PINs you can have diagonally opposite numbers (e.g. 1-9 or 3-7) but with patterns you don't have that unless you use 5 on the way (e.g. 1-5-9 or 3-5-7). In fact most people will have the central dot in their pattern recognition somewhere in the middle just through human nature.
Yep. Either that or just the classic double circle.
Like in the USA, the social security numbers, our driver license numbers, etc. are all used as authentication, when originally were meant as identification for tracking purposes.
So far, the safest form seems to be what we keep in our heads.
The SSN certainly, but I don't think I've ever been asked for my DL number for authentication rather than identification. Maybe I've just forgotten. When did it happen to you?
well, we should change the Minister
Fingerprints are not something you are. Fingerprints are something you own.
Well, you actually own them as much as you own the ideas. Or passwords. Written in your forehead.
It is very foolish to use them for security purposes. And it is very dangerous to allow some entity to collect them, as this will eventually lead to very large privacy and freedom violations.
http://edition.cnn.com/2016/04/21/us/project-vic-child-abuse...
http://blog.dustinkirkland.com/2013/10/fingerprints-are-user...
So "enhance, enhance, enhance" is real now?
I don't disagree with your premise (that fingerprints are very bad passwords), but I don't see the logic of this sentence. If I were in favour of the use of fingerprints as passwords, I would think their continued use pointed to how hard, not how easy, it is to break them (because otherwise, hypothetical me would think, surely they would no longer be used).
One of my friends likes to go hiking in this area a few miles away from million+ dollar neighborhoods. They get approached by someone pretending to be a union member and they get to chatting. The union member has to show them some video on his phone, and so my friend takes a look. There's a slight glitch in the guy's phone and my friend sees their own face for a brief second with what looked like highlighters around their eyes, kind of like those eye tracking things.
They didn't think much of it until they read about cornea copying and hacking. They realized they were being "bio-hacked" but there is nothing they work on that needs bio clearance so they figure the union members were hired by some people to collect bio prints of likely targets in the area.
Plus I heard it is common to use union and organized crime groups, police, etc.. to stake out and collect intelligence on possible targets for corporate espionage, and other related crimes. It seems to be an unspoken problem in the area.
https://en.wikipedia.org/wiki/The_London_Studios#Audiences
When I saw them a few years ago, they definitely had distinct fingerprint ridges.