Politician's fingerprint 'cloned from photos' by hacker

http://www.bbc.com/news/technology-30623611

by Libertatea • 12 years ago

96 41 12 years ago

mkal_tsr5• 12 years ago

I think Taylor Swift said it best,

Remember: Fingerprint locks are convenient, but they discard your ability to "forget" or refuse to unlock a device. They remove consent.

[ source - https://twitter.com/SwiftOnSecurity / https://imgur.com/a/1PDRJ / ]

Can anyone intent on downvoting explain what is factually wrong or misleading about the quote in the picture? Just because it's on a picture doesn't make it less valid.

Raphmedia• 12 years ago

Wait, what? I'm out of the loop there. Is that a meme, or is Taylor Swift really saying this?

mkal_tsr5• 12 years ago

It's a meme by that twitter account

frozenport2• 12 years ago

Its a time honored tradition, see Britney Spears' Guide to Semiconductor Physics [*]

http://britneyspears.ac/lasers.htm

calvin_c• 12 years ago

If the subject you'd like to bring to discussion is the quote, post the quote. If you want to bring up a humorous Twitter account dealing with security concerns, post the Twitter account. Reposting a meme posted by that account doesn't serve either purpose very well.

mkal_tsr5• 12 years ago

I posted the original source from the creator, the Twitter account which made the Imgur album. I have swapped the .jpg with the text quote ... I just find it odd HN is so primary-source averse.

patal• 12 years ago

If the subject you'd like to bring to discussion is no humour on HN, post no humour on HN. If you want to bring up your confusion about how Taylor Swift and security go together, just say so. Gruntling away in your post doesn't serve either purpose very well. You're being mean to parent.

dfxm12• 12 years ago

I didn't downvote, but your post is off topic.

If the article was about a case where a person was mandated to unlock their phone because it is only protected by a fingerprint scan, (and of course a person cannot "forget" their fingerprint like they can a password), then your quote would have been on topic.

Yeah, the quote is about fingerprints, but it's really orthogonal to the topic of the article, which is that fingerprints can be "cracked" just like passwords. That's not what the quote you posted is about. The quote is about the fifth amendment (of the US constitution): https://www.eff.org/issues/know-your-rights#17

mkal_tsr5• 12 years ago

You don't think the ability to use photographs of hands/fingers and used for fingerprint readers is relevant to a quote about using fingerprints as passwords has a security gap of consent? I'm sorry but what? We've seen many times that fingerprint readers can be fooled, and pointing out that pictures of hands/fingers could be used against you is highly relevant to a decision of securing something with fingerprints or not.

adityab• 12 years ago

Link to talk video: http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_...

digisth• 12 years ago

For systems using biometric auth, wouldn't the next step to make it multi-factor biometrics (i.e., obtaining a confidence value based on the combination of fingerprint, face, vein pattern, gait, voice, etc.) rather than the simple one-to-one matching systems we use for it now?

frozenport2• 12 years ago

As you add authentication mechanisms your sources of errors grows, making life frustrating. For example, voice can change over time.

Retric• 12 years ago

Your far better off simply supervising people while collecting biometrics. Think, guard at the door while you walk into a facility who compares your photo in their sytem with what you look like vs. fingerprint reader at a workstation.

Granted, there also useful limiting casual access. Think kid/roomate using someone elses work laptop vs. a dedicated hacking attempt.

jelder• 12 years ago

Krissler is providing a huge service here. It's a great illustration of the fact that fingerprints and other biometrics are analogous to usernames and are completely unlike passwords.

It's like Apple and other biometric device purveyors are telling us all to just log in with our username and a blank password. At the moment we're all scrawling our passwords on every surface of every room we enter.

objclxt• 12 years ago

Well, it's a little different, because as far as I can tell he has reconstructed a 2D image of the fingerprint, but not used that fingerprint successfully for any authentication system.

glesica3• 12 years ago

I'm not sure that is accurate...

"As an example, he demonstrated how he could use his fake fingerprint to unlock his iPhone — that features a ‘Touch ID’ fingerprint sensor integrated into its home button."

http://www.iphonehacks.com/2014/12/hackers-reproduce-fingerp...

It isn't entirely clear which fake fingerprint was used. I guess we should probably watch the CCC talk.

emeraldd2• 12 years ago

The only fun thing here is that he pulled them off a photo. The Myth Busters guys did this a long while back with dusted prints ....

https://www.youtube.com/watch?v=3Hji3kp_i9k

Of course, things may have gotten better or worse since then.

k__2• 12 years ago

I think it's easier to get a PIN or unlock-gesture for a phone, than to get the owners fingerprint.

So the idea of Apple isn't THAT bad.

emeraldd2• 12 years ago

The thing about finger prints is that they are really really really hard to change ... you can change your pin/gesture n times a day and not care.

erroneousfunk• 12 years ago

However, you can disable the thumbprint login option, just like you can disable the pin login option. Or you can add a more complicated login. Apple gives you more flexibility to make your own choice about unlocking your iPhone, they're not saying that you're thumbprint is your password.

r00fus• 12 years ago

Given that a) Apple doesn't/can't store your entire 3D fingerprint and b) registering your finger into multiple TouchID "slots" on your phone increases the iPhone's accept rate, to me means that

While I applaud the research, Krissler needs to prove that he can unlock a device reliably using a system like TouchID (as a reference platform) using this intensive photograph-only modeling approach before I become worried - his previous efforts last year don't count as "previous proof" - if it were reliable, there would be a comprehensive breakdown/proof.

Fingerprint technology has improved greatly - e.g. TouchID requires something warm like flesh behind the scan, and does image the 3D contours as applied to the press - which deform the scan from it's natural state.

HackinOut2• 12 years ago

Yesterdays's HN discussion about this: https://news.ycombinator.com/item?id=8806394

xexers• 12 years ago

I wonder how well this technique would work with the keys to your house... based on say 50 photos of you with your keys dangling, could you reconstruct the key and then 3d print it?

lt• 12 years ago

This is well available today. For example, there's an app for that:

https://keysduplicated.com/

matthewmacleod• 12 years ago

You don't even need 50 photos – this was done some time ago using a single photo. See http://vision.ucsd.edu/~blaxton/sneakey.html for an overview.

masklinn• 12 years ago

That's been done for quite some time now. A single picture is sufficient for single-sided or double-sided cut keys.

cheese0r• 12 years ago

One photo could be enough. There was a talk about this two years ago at 29c3. It's only available in German unfortunately (https://www.youtube.com/watch?v=3JK3TO_crc8) Lockpicking has always been a big topic at the conference.

vermontdevil• 12 years ago

I remember some years back Diebold posted a photo of their key that unlocks voting machines (or ATM?) as part of their marketing material. Hackers were able to copy the key and open up these machines.

learnstats22• 12 years ago

Are Samsung and Apple really the most important aspect of this issue?

People are convicted of crimes on the strength of their fingerprint.

HackinOut2• 12 years ago

Testimonies can by themselves end up into a conviction. I am not sure this is comparable. When a crime is committed any evidence is welcome to try and solve it. Investigators are not "choosing" their type of evidences like you can choose a type of digital protection.

learnstats22• 12 years ago

I made you a comparison:

Apple is using fingerprint evidence to allow or deny access to a phone.

Judiciary around the world is using fingerprint evidence to lock people up, deny them basic rights, and sometimes to kill them.

anigbrowl• 12 years ago

I think his point is that you could frame someone using this method. Juries tend to give lots of weight to forensic evidence, often more than is scientifically justified. If you hear 'his fingerprints were found on the murder weapon' then for most people that is more than enough.

Politician's fingerprint 'cloned from photos' by hacker

Related Stories