Hacker News Reader

Comment by loceng | Hacker News Reader

Time for fingerprint entry to become popular - at least until cloning specific body parts becomes a home-kit..

Mythbusters was able to defeat several fingerprint identification systems quite easily.

At first their attempts were pretty elaborate. They lifted a fingerprint from a glass a person had held and then used an acidic solution to etch that pattern onto a mold. This mold then opened all of the high-end thumbprint readers they had.

However, if I remember correctly, they then went low-tech and simply used a photocopy of the thumbprint which also opened several devices.

I think it is good to remember that security is situational. So unless a prisoner is holding a copy of every officer/guard/transfer agent's finger prints, they won't be able to undo the lock while in most detention situations (the only ones I can come up with are fairly contrived, or require the prisoner to escape in cuffs, making the point moot). Basically, if the arresting officer puts the cuffs on the detainee, and scans in his fingerprint as the "unlock with this fingerprint" option, it becomes very difficult for the detainee to get a copy of that print in a form that will work, and then use it, unlike an accessible hidden key known to work with $model-of-handcuff.

Of course that says nothing about other ways to defeat the cuffs, which would probably become the prime area of research at that point. (why attack the locking mechanism if there are easier to defeat weaknesses).

The CCC are onto it https://www.youtube.com/watch?v=mVu5ofv92e0

According to the article, that's not how handcuffs need to work.

Handcuffs are designed so that one officer can put them on and another can take them off. If that weren't the case this situation of being able to print 1 key for all handcuffs wouldn't exist - they would simply make unique keys per handcuff.

Fair enough, although, I think a procedure change and a "transfer authority" function could easily cover this. The transfer function would basically be: original cuffer presses the transfer button, swipes his print, the receiver then swipes his print, and the transfer is done.

However, in a broader view, yeah, there are probably better ways than fingerprints handle keys once electronic locking mechanisms are introduced. Probably something akin to a 2-factor cryptographic mechanism.

Easy nitpick, what if one of the officers gets sick, gets injured, or just plain forgets and goes home?

Good question. I don't know, but perhaps an override key. However now that the physical key isn't an open secret, and needed by everyone, they would be easier to secure. And small batches would have a specific key for that batch, but not for all cuffs, making it even harder for the detainee to have the right duplicate on hand.

I feel though that my larger point is getting lost in this thread. It was/is:

Just because a security technology doesn't work for reason $x in situation $y, that doesn't mean that the weaknesses also apply to situation $z.

Just for interest, this still can be done with unique keys: Officer Alice handcuffs prisoner and wants to hand off to Officer Bob. Officer Bob locks prisoner with his own handcuffs (prisoner is now wearing two pairs), then Officer Alice removes hers.

Much too late! http://www.h-online.com/newsticker/news/item/CCC-publishes-f...

Depending on the situation, I might be ok with fingerprint access (such as high secure areas and such). The problem is for normal everyday use, I wouldn't be able to tell where the data is going. Either the manufacturers themselves or governments or hackers could be storing the data about who enters which door and when which would be another attack on my personal privacy that I don't want to give up.

That's not really specific to fingerprint access though; I'm sure many companies track key card use.

God no. Haven't we learnt by now?

Two-Factor authentication (something you have + something you know) is for physical security as well as online.

If a house/building has windows or mostly wooden walls, the lock is really only preventing people from quietly using the door.

Indeed. If someone truly wants in somewhere they will get in.

You could probably build a convincing fake-finger to fool the scanner.

Cloning of a specific body part has been a billion dollar industry for some time now...

Reply on news.ycombinator.com