OPM now says more than five million fingerprints compromised in breaches | Hacker News Reader

OPM now says more than five million fingerprints compromised in breaches

washingtonpost.com

106 pointse15ctr0n42 comments

Oh boy, this is going to kneecap CIA HUMINT ops overseas for many years to come.

Consider: you can't repudiate your fingerprints. So all the Chinese or Russian authorities need to do is to look for these fingerprints on folks entering the country and they can identify anyone with a US security clearance -- and in particular look for the other characteristics indicative of a CIA or other human intelligence operative. Such as, oh, a set of prints matching someone with a US security clearance attached to an authentic but definitely-not-in-the-same-name passport.

Spies are going to be so much a thing of the past ...

This is bad but not so bad for CIA HUMINT. Most* human source handlers, at least from what I've read, work under Official Cover. That is, they work at the embassy under their real name. This way if they get caught they have diplomatic immunity and can't be charged as spies.

Foreign governments know that people that work at the embassy are often spies and generally the know which ones are spies (used to be the case that the passport officer was almost always a spy).

Not that this won't hurt, but it won't be a death blow. The real danger comes from the fact that handlers, and more importantly their superiors, are vulnerable to blackmail because OPM stored VERY personal information (affairs, drug addictions, etc...).

* CIA does have Non-Official Cover personel (NOC), this will hurt them more. Then again fingerprint readers are not impossible to fool and even before the OPM hack NOCs were facing increasing exposure risk due to biometrics.

    > Foreign governments know that people that work at the
    > embassy are often spies

That's not true. Perhaps you meant: "there are often people working at the embassy who are spies".

OPs usage is conversationally common and understandable. No need to break out the ruler, professor.

http://www.washingtonpost.com/blogs/federal-eye/wp/2015/07/0...

The CIA, largely appears to have been shielded from damage, especially for employees who have never worked at any other agency, officials said.

Evidently, CIA has its own, separate OPM-like entity.

At least one part of the us government seems to have had at least some common sense.

I bet some unsung officers had to fight tooth and nail to keep the CIA out of OPM - one would hope that the DCI is properly grateful.

In this case I suspect that smugness and a large dollop of being able to say "I told you so" is its own reward

Supposedly, biometrics at points of entry have already decreased the ability for an individual operative to claim more than a single identity in a lifetime [1]. I imagine having to deal with the change from being able to use agents many times to only getting a single use out of all that recruitment and training was a much bigger deal than this set (CIA+OPM background checks) of single-usage agents going to zero-usage.

[1] http://www.wired.com/2012/04/cia-spies-biometric-tech/

This isn't the case for a lot of reasons. The first is, as epoxyhockey noted, the CIA has their own system.

But even beyond that, the Russians and the Chinese already know who works for the CIA officially, just as we know who works for the FSB and the Chinese analog. The people who can hurt you, i.e. actual undercover spies, are not going to be in these databases.

How much of spying is actually done that way? All the recent examples I can think of are people under their real names, working in areas where they often might have some conceivable security clearance (the level, if it's exposed, might be telling though), and are in place through legitimate means, which allows them to capitalize on the circumstances. For example, a relative of a diplomat (Valerie Plame), or higher level business representative or visiting company officer (you might have clearance due to some government contracts). I think the point is to be in country with access to local people who might be persuaded in some manner to deliver information.

Plot twist: we leaked some irrelevant data to see who picks up on it.

"Spies are going to be so much a thing of the past ..."

Why do you think we've got spy kids?

http://www.imdb.com/title/tt0227538/

Surely they can just enter the target country illegally?

If you're going to use something that is permanent and unchangeable for authentication (which is itself dumb), wouldn't it make sense to store one way hashes rather than the fingerprints themselves? There are multiple layers of idiocy at work here.

Does that really help? Unless the hashing algorithm is also a secret, an attacker with the full database of fingerprint hashes would still be able to take a random fingerprint, hash it, and then see if they have any OPM records -- isn't that the main threat scenario here?

I guess it would make it harder for an attacker to manufacture and plant false fingerprints?

That's where salt idea comes in. Even if you know the hashing algorithm and the key, you still need to rehash it for every single entry in your database to check if you have a match.

That assumes you can get a consistent description of a fingerprint though, or have some scheme for fuzzy match with hashing. Now I want to find a paper on this...

Last government technical document I read (not federal level) mandated passwords be stored using encryption. Not hashing, encryption. Security by bureaucracy is one of the few things worse than security by obscurity.

Yeah, protecting the "template" is a pretty basic thing in biometrics.

For example, here's a paper from 2005 about a scheme for secure storage of fingerprint templates. http://www.cse.lehigh.edu/prr/Biometrics/Archive/Papers/Tuyl...

I don't know much about this scheme in particular; it was just the first search result for "biometric authentication template". But this shows how people have been working on this topic for a long time now.

I'm not sure how a likeness comparison would work with a hashed fingerprint. Perhaps it would if a specific subset of the finger scan is always used to compare with the hashed subset.

My understanding is that some companies like Google have special image comparison algorithms that allow them to store a hash of an image but still perform a likeness comparison of the image. This is useful when filtering out (and alerting authorities about) images where storing the original is illegal, but also catching images in different formats, different resolutions, or even with some extent of color changes to them.

While I would not consider it a simple problem, I would think that given enough resources something similar can be made for fingerprints. The problem is that, to my knowledge, nothing like this currently exists and you are not likely to get the needed budget approved for building it, especially in the land of government contracts.

You're probably thinking of PhotoDNA from Microsoft: https://en.wikipedia.org/wiki/PhotoDNA

Apparently many of the biggest online services, including MS and Facebook, are using it to scan images uploaded by their users.

It's not for authentication, it's for background checks. These fingerprints are used to check for criminal connections in the past and future.

I doubt that there is an algorithm that can consistently turn any good image of the same fingerprint into the same stream of bytes.

There certainly are such algorithms.

The Henry Classification System is one such algorithm and it's been used for more than century[1].

Even in the 1940s and 50s, before digital computers, you could fingerprint a suspect and through a manual application of the algorithm obtain a unique ID ("the same stream of bytes" as you say). You could then do a look-up to see if he had a criminal record.

[1] To be precise, the Henry system uses all ten prints, but single finger classifications also exist. https://en.wikipedia.org/wiki/Henry_Classification_System

The Henry classification system seems to be useful only as an index to reduce the number of fingerprints a human investigator needs to compare against. It looks like it is expected to frequently have collisions.

Something you are, something you have, something you know.

Part of non-repudiation is that you've established authenticity absolutely, or as near to absolutely as makes identification reliable.

So, does FIPS-201 now need to ban fingerprints for government facilities?

http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf

Somewhat related: I've heard that devices with fingerprint access control are designed such that software can't get the fingerprints out; the fingerprint reader is a self-contained black box. If I wanted to verify this, how would I?

You don't.

I worked at a place with biometric hand geometry scanners, same deal pretty much. Technically it was two black boxes, the dumb reader couldn't open doors directly and supposedly stored no data locally in case someone smashed and stole it, or smashed and shorted the control wires (I believe it was RS-485 line level protocol WRT wiring) and a black box inside the secured area that contained our biometric hash data, logs, and a normally closed relay that could toggle and unlock the door when it felt like it.

Anyway if the protocol and connection between the two black boxes could be monitored without breaking the DMCA, then you could verify the box outside does hashing and only 24 bits of data or whatever transport to the other black box that unlocks, rather than entire hand pix. Assuming there's no ATM-skimmer grade camera taped on the scanner recording the geometry of every hand for later abuse.

The nature of security theater or snake oil is apparently unfixable failure modes don't indicate lack of effort or knowledge, they indicate the product sucks.

Some devices yes. Other devices? Not so much:

"HTC stored user fingerprints as image file in unencrypted folder"

http://www.theguardian.com/technology/2015/aug/10/htc-finger...

I have some kind of time tracking terminal here that allows users to identify themselves either through facial recognition, fingerprint or NFC.

The terminal listens on telnet or ssh, is easily compromisable, and stores the last fingerprint image (the full picture, not just a hash) as well as last face picture as bmp in /tmp.

You just can't rely on devices being designed such that they are secure.

In related news, the FBI has just merged the civil and criminal fingerprint databases, just so they can have a "one-stop shop" to search for everyone's fingerprints - just like the hackers will when they will inevitably steal this one as well. Aren't fingerprint databases great?!

https://www.eff.org/deeplinks/2015/09/little-fanfare-fbi-ram...

I think a clever observation of the article is the timing of the news: "it's like a PR problem not a real security threat and it doesn't deserve front page, it can go after Pope visiting Washington"

The US Government's backwards policy of emphasizing offensive capability over defensive strikes again -- the NSA may have a treasure trove of vulnerabilities and the capacity to extend its reach into the nether regions of other nation-state's networks, but it leaves its belly wide open for other's to feast on.

Is this such a backward policy? It's how nuclear strategy worked, have an offense so scary you don't need a defense.

Yeah, we should totally make our fingerprints our password, because it is so safe and we don't leave our prints on anything we touch.

I leave my fingerprints everywhere I go, so it's one of the least worrying things to have stolen.

3-D printers will now be able to create a duplicate finger and your fingerprints might end up in places you don't go, as well!

as cstross already pointed out [0]: the reverse lookup can be a mighty tool.

[0] https://news.ycombinator.com/reply?id=10267079

hmm, that's a very good point. but my point is still valid, since i'm not a spy... or am i? ;)

Question, why would identity theft protection be issued to the victims of this colossal hack if it was indeed conducted by the Chinese?

Eh, they just need to invent that fingerprint refresher from Men in Black.

Reply on news.ycombinator.com