Hacker News Reader

Comment by gruez | Hacker News Reader

>is at heightened risk for identity theft

This feels like pearl clutching to me. While it's probably technically true that having your fingerprint leaked increases your risk of identity theft by some non-zero amount, in the overwhelming majority of the cases it's effectively zero, because for the overwhelming majority of people the only place they have their fingerprints enrolled is on their phones. In the event you somehow acquire stolen fingerprint image data, it will be very difficult to use those to perform identity theft at mass scale, because you need physical access to phones.

>and is likely to withdraw from biometric-facilitated transactions.

What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.

View on HN

> What "biometric-facilitated transactions" are these? Aside from fingerprint unlock on phones, I'm struggling to come up with cases where fingerprints are used to secure sensitive information.

Phones have become people's defacto computing device, that they link to all kinds of personal, private, and governmental accounts. Medicare, councils, state accounts, bank details, taxes, private chats, private images and videos, work accounts, work documents, work chats, group memberships, on and on. Think of any sensitive information possible, someone is storing it on their phone. Most people have their phone as the center of their information technology worlds.

If access to that isn't concerning then there isn't much else that could change your mind I don't think.

> Most people have their phone as the center of their information technology worlds.

Those people are foolish. Putting all your eggs in one basket and then whining about the consequences is a sign of bad character. Besides that it’s pretty irrelevant to the topic at hand, which is whether fingerprint readers are an acceptable means of securing digital transactions. In fact you seem to be suggesting they are, by proxy.

Any one of those accounts is sensitive, even if you just had one it should be protected. But also, in matters of policy we don't really care about someone's character, we care about how it impacts everyone.

Since everyone has a phone now, that means technologically illiterate people are using them for whatever their authority figures tell them to. They trust those entities, and perhaps they shouldn't, but that is the reality. Any policy that doesn't cater for the reality is bad policy.

Smoking is a historical example, at one point doctors, movie stars and media all told you smoking was good for you. Now, decades later, health policy has to take into account that people smoke. Maybe one day down the line there will be regulation on companies as to how they influence people to use their devices, but for now we accept that people put sensitive info on their phones.

My claim isn't that your phone doesn't contain sensitive information, or that a stolen fingerprint image can be used to unlock your phone, it's that the attack is very unlikely to be carried out, scales poorly (you need physical access to the phone), and there are a dozen other ways of obtaining the same result (ie. lifting the fingerprint off the phone or a nearby object). It's not as simple as hacking into the HR system's fingerprint database and you get all the employees' dickpicks at your fingertips.

It would work the other way around I think, steal someone's phone then look it up on the database. But you're right, it's not the vector I would be most worried about either.

I disagree with you in principle, just because the phone is the only avenue that has so far made use of fingerprint biometric data doesn’t mean it won’t be used more in the future. (It seems to be used here for paystubs, so it is possibly getting more reach currently). Looking at it from a tightening of cybersecurity perspective it would make sense if people thought to add it as a second factor.

“The building isn’t on fire currently so there’s no need to move the gas can away from the fireplace.” Isn’t a compelling argument.

I mean, you could leave someone's fingerprints at the scene of a crime.

You could also write a confession in their name and leave it at the crime scene.

I don’t think this happens a lot.

If you're out to frame someone for a crime, I have a feeling that you're not going to stop just because you can't buy the victim's fingerprint on darknet markets. You can follow the person around and lift fingerprints off objects that he touched, for instance.

Post a hi-res scan of your fingerprints with your name and address, and see what happens - it might be a learning experience for you...

Note: I don't actually recommend you do this - it opens you up to the very real dangers which you're claiming don't exist.

Do you realize how easy it is to get a person’s fingerprints?

"Do you realize how easy it is to get a person’s fingerprints?"

Very easy. Though, it's more difficult to get a specific person's fingerprints. Frankly, this is a terrible argument. Fingerprints require an escalation from the digital world to the physical.

Physical security keys are great for exactly this reason. If you want my account, you must break into my home. That fundamentally changes an attacker's calculus.

Reply on news.ycombinator.com