Hacker News Reader

Comment by zitterbewegung | Hacker News Reader

When you unlock your MacBook you are opting in to unlock the MacBook and you don't need to use it. Also, it is protected by a Secure Enclave and the actual fingerprint isn't stored.

Reading the bill it even points this out.

Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.

View on HN

Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks. I don't know of any general-purpose fingerprint readers for authentication that store the original image.

Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways.

That is a huge presumption and, as GP pointed out, the problem is if your fingerprint gets leaked, it's rather difficult to change it. Apple did a great job with TouchID but security experts went all over it trying to poke holes. Most other fingerprint systems don't get anywhere near the same amount of scrutiny. So in an unfortunate turn of fate, Apple's awesome implementation of fingerprint authentication on the iPhone resulted inthe general public being comfortable with fingerprint auth in other places, when they really shouldn't be.

You leak your fingerprints everywhere you go on every surface you touch. Fingerprints are highly convenient but they have never been an especially secure mechanism for locking devices.

But, and here is the important part, those 'leaked fingerprints' in the wild are not digitally preserved. It would actually take some effort to preserve on a scene. The comparison is not apt.

What form must a malicious fingerprint scanner take by law?

When it comes to fingerprints you must assume that the attacker has the ability to control the scene and the ability to retry until successful.

Is it not an argument against using fingerprints as a basis for id verification to begin with?

Yeah it just seems like a bad idea. It's like we never got over how cool it is that fingerprints can be a unique identifier, and we jut assume it must be a good one.

Just like it actually takes some effort to hack a fingerprint reader.

You are missing the point.

The point is that reader has those preserved and stored somewhere, while fingerprints that a person just leaves about by going about their day are not. Just the fact that they are stored is an issue. Note, this is a response to the original question of 'pfft, a person leaves fingerprints all the time anyway'.

Again, the comparison is just not apt.

A fingerprint reader doesn't need to store your fingerprint, it needs to store a hash sufficient to distinguish it from other people who are likely to try to unlock it.

nb iPhone Face ID has additional protections, like each scanner using a different random physical pattern so hashes can't even be transferred across devices.

Distinction without a difference. My argument is that fingerprint is digitally preserved; not that it is an exact replica of a fingerprint. If it only compares a hash, it is still a biometric record and that hash has to be somewhere to be compared against ( which itself opens an interesting can of worms depending on the implementation although I do have some level expectation from Apple engineers that it was not botched ). You seem to be too focused on technical implementation and relative security of a given solution.

In other words, I am willing to buy an argument that Apple's implementation is better than some other implementations out there, but it does not apply to this case, because it was not Apple's Face ID that we are discussing.

Anyone else is free to implement the same thing. Even extracting the hash doesn't matter if it can't be compared across individual devices.

I'm not sure that this is true with 15+ MP cameras shipping even on burner phones. I've been amazed what can be extracted from a photo of a dinner table at 20MP.

Lots of assumptions and "shoulds," but the reality is that the tech industry makes mistakes with security all the time.

Every month or so there's another horror story on HN about some company storing passwords as plain text.

Just because something can be done right does not mean it is done right.

If the fingerprint worked across multiple computers, they did store the fingerprint. Maybe it wasn't an image, but it would need to be informative enough to distinguish between multiple employees. Embedded fingerprint readers only provide a matches user/doesn't match user result.

There’s no technical reason why they couldn’t share hashes across devices. It might be specific to a particular model of scanner but presumably they’re buying a lot of a standard model.

Unless you have first-hand knowledge of the devices they used, you can’t assume sensible developers. For example, HTC shipped this mess:

https://www.theverge.com/2015/8/10/9126027/htc-fingerprint-s...

Similarly, a vendor of facility access control systems left fingerprint scans in an exposed ElasticSearch instance:

https://www.vpnmentor.com/blog/report-biostar2-leak/

> Also I don't see how compromising that hash is a problem in practice, if that ever happened. If it's salted it's worthless, but even if not, I don't know how you'd reasonably physically use it to hack into another fingerprint reader anyways.

If an attacker had a fingerprint and wanted to figure out who it belonged to, they could hash it and compare the hash against a database of leaked names and hashes. Salting doesn't prevent this, unless the hash is intentionally slow, in which case the attacker would merely be slowed down.

Also, how much entropy is in a fingerprint anyways? If it's low, an attacker could generate every possible fingerprint and hash it to build a mapping from hash to actual fingerprint.

Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise.

>Since humans only get one set of fingerprints for life, fingerprints should only be stored and compared on secure enclaves on your own devices (like iPhones). It's way too risky otherwise.

This exactly!! QFT!

No biometrics should ever be used for shared or public devices! Biometrics are fine for personal devices that are always with us, and not shared by others, especially anyone outside our family/household.

I've made my peace with biometrics as far as unlocking my phone via fingerprint. My threat model is such that a fingerprint lock is often safer than pecking in a long password. (Because I'm often surrounded by shoulder surfers.)

So yeah, if a restaurant is forcing employees to scan fingerprints (or retinas or DNA or saliva or what have you) on public or shared devices for purposes of clocking in, or payroll, or whatever, then that is wrong and a perversion of biometric authentication. The company would be much better served by a correct application of security techniques.

And yes, if this means going back to passwords for awhile, then so be it. Passwords are a good first-line auth measure for shared devices that are not open to the public (let's assume that this restaurant's devices were only physically accessible by employees in the back office or something.)

Another idea is to let the employees authenticate using their smartphone. My bank has something set up with this. You install a smartphone app, it authenticates you, and it vouches when you set foot in the bank so that the teller already has your account pulled up. Then, in terms of biometric locking for the smartphone, knock yourself out; the company has no need to collect the data, just interface to an app.

You’re assuming a lot here. Most IOT security is on shaky ground. They probably went with the cheapest vendor too. There isn’t a compromise reported but I’m willing to bet that whatever was implemented was very insecure.

How can you store a hash of a fingerprint for this use case? A fingerprint reader needs to recognize close matches in the input data as valid.

https://en.wikipedia.org/wiki/Locality-sensitive_hashing

You essentially have N different hashes and require at least N - M (M < N) matches.

Even if that were the case, the still did not get consent and that is the problem. “Secure” fingerprint access does not excuse the lack of consent.

> Presumably whatever fingerprint reader White Castle used for logins also stored a hash, similar to MacBooks.

Presumably they would have checked if their policy was legal before implementing it too. The problem is that they haven't really earned the presumption of diligence in this matter.

I may have missed this. Were they storing hashes of images or points of images- or were they storing the original image? Any platform worth its salt would hash and salt the fingerprint data and it'd be worthless elsewhere as other systems would have different hashes.

>is at heightened risk for identity theft

This feels like pearl clutching to me. While it's probably technically true that having your fingerprint leaked increases your risk of identity theft by some non-zero amount, in the overwhelming majority of the cases it's effectively zero, because for the overwhelming majority of people the only place they have their fingerprints enrolled is on their phones. In the event you somehow acquire stolen fingerprint image data, it will be very difficult to use those to perform identity theft at mass scale, because you need physical access to phones.

>and is likely to withdraw from biometric-facilitated transactions.

What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.

I mean, you could leave someone's fingerprints at the scene of a crime.

You could also write a confession in their name and leave it at the crime scene.

I don’t think this happens a lot.

If you're out to frame someone for a crime, I have a feeling that you're not going to stop just because you can't buy the victim's fingerprint on darknet markets. You can follow the person around and lift fingerprints off objects that he touched, for instance.

Post a hi-res scan of your fingerprints with your name and address, and see what happens - it might be a learning experience for you...

Note: I don't actually recommend you do this - it opens you up to the very real dangers which you're claiming don't exist.

Do you realize how easy it is to get a person’s fingerprints?

"Do you realize how easy it is to get a person’s fingerprints?"

Very easy. Though, it's more difficult to get a specific person's fingerprints. Frankly, this is a terrible argument. Fingerprints require an escalation from the digital world to the physical.

Physical security keys are great for exactly this reason. If you want my account, you must break into my home. That fundamentally changes an attacker's calculus.

I disagree with you in principle, just because the phone is the only avenue that has so far made use of fingerprint biometric data doesn’t mean it won’t be used more in the future. (It seems to be used here for paystubs, so it is possibly getting more reach currently). Looking at it from a tightening of cybersecurity perspective it would make sense if people thought to add it as a second factor.

“The building isn’t on fire currently so there’s no need to move the gas can away from the fireplace.” Isn’t a compelling argument.

> What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.

Phones have become people's defacto computing device, that they link to all kinds of personal, private, and governmental accounts. Medicare, councils, state accounts, bank details, taxes, private chats, private images and videos, work accounts, work documents, work chats, group memberships, on and on. Think of any sensitive information possible, someone is storing it on their phone. Most people have their phone as the center of their information technology worlds.

If access to that isn't concerning then there isn't much else that could change your mind I don't think.

> Most people have their phone as the center of their information technology worlds.

Those people are foolish. Putting all your eggs in one basket and then whining about the consequences is a sign of bad character. Besides that it’s pretty irrelevant to the topic at hand, which is whether fingerprint readers are an acceptable means of securing digital transactions. In fact you seem to be suggesting they are, by proxy.

Any one of those accounts is sensitive, even if you just had one it should be protected. But also, in matters of policy we don't really care about someone's character, we care about how it impacts everyone.

Since everyone has a phone now, that means technologically illiterate people are using them for whatever their authority figures tell them to. They trust those entities, and perhaps they shouldn't, but that is the reality. Any policy that doesn't cater for the reality is bad policy.

Smoking is a historical example, at one point doctors, movie stars and media all told you smoking was good for you. Now, decades later, health policy has to take into account that people smoke. Maybe one day down the line there will be regulation on companies as to how they influence people to use their devices, but for now we accept that people put sensitive info on their phones.

My claim isn't that your phone doesn't contain sensitive information, or that a stolen fingerprint image can be used to unlock your phone, it's that the attack is very unlikely to be carried out, scales poorly (you need physical access to the phone), and there are a dozen other ways of obtaining the same result (ie. lifting the fingerprint off the phone or a nearby object). It's not as simple as hacking into the HR system's fingerprint database and you get all the employees' dickpicks at your fingertips.

It would work the other way around I think, steal someone's phone then look it up on the database. But you're right, it's not the vector I would be most worried about either.

Reply on news.ycombinator.com