Hacker News Reader

Comment by daniel_solano | Hacker News Reader

I used to think that fingerprint sensors were pretty cool, and even purchased the option on a laptop some years ago. That was until I found out the relative ease of duplicating fingerprints [1]. Now, I am wary of leaving my password on everything I touch.

[1]: http://dasalte.ccc.de/biometrie/fingerabdruck_kopieren?langu...

View on HN

I enter a 4 digit password into my phone a hundred times a day. Standing behind me at Starbucks is probably easier than dusting for prints and recreating my thumb.

And you're probably the only person in line to even bother with a 4 digit password.

This is what first came to my mind as well. But I also reacted to Ars Technica reporting[1] that the sensor has the capability to scan "sub-epidermal skin layers". That might be a way to protect the system from the fingerprint "copy-paste" method described in your link, since the sensor used there only scans the surface.

[1]: http://live.arstechnica.com/apple-september-10-event/

Doing that is way harder then guessing 4 digit pass code. Besides depending on technology used in Apple's device you might need to get way more sophisticated. With processing power of mobile devices nowadays, how much would you need to invest to make a fake that is not easily statistically distinguishable from real thing? What is stopping that scanner from taking 20-100 pictures and then analyzing them in background? I really do not think run of the mill fingerprint faking will be sufficient to overcome modern fingerprinting with sufficient security emphasis put into them.

I'd guess false negatives. You _really_ don't want persistent false negatives. I wonder what's the solution to the `I cut my index finger' problem. Does it require multiple fingers to be enrolled?

The Chaos Computer Club in Germany got tired of a certian minister proclaiming that biometrics were perfectly secure and fool-proof. So they published his fingerprint in a little piece of plastic, with instructions on how to leave his fingerprints everywhere. http://www.wired.com/threatlevel/2008/03/hackers-publish/

In the announcement, they said the feature was aimed at people who don't have a lock screen enabled at all. It was basically "fingerprints: better than nothing!"

Reply on news.ycombinator.com