Hacker News Reader

Comment by gjmulhol | Hacker News Reader

I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily. TouchID is more secure than that simply because someone needs to take a 2400dpi image of the person's finger to do it.

Locks (when physical access to a device is available) are to keep honest people honest. Most security experts that I know agree that if an intruder has physical access to a device, it can be considered compromised because it is just a matter of time.

View on HN

...2400dpi image of the person's finger...

Note: Finger Print, not finger.

Here, have a drink out of this freshly washed glass... no, don't worry, I'll wash the glass for you later. :)

On the last second point regarding access to a device, I could take a week to make up the fake print during which it won't matter if I have it or not. Since your print isn't changing I just need 5 minutes with your device at any point in the future.

Then create a detailed model using said high resolution fingerprint. If someone cares enough about your phone to do that, they can probably break into it by other means anyway (jail break, brute force passcode, etc)

You leave finger prints on the phone. Just snap a photo with a decent camera - it's probably enough detail. Print it. Stick some latex or glue on it (literally available everywhere).

That's it. This is not rocket science or time consuming like brute forcing. You don't even have to shoulder-surf to catch their password.

Importantly, this has been demonstrated. The CCC has been doing it for years and published a howto with material costs in the low one-digit Euro range.

http://translate.google.com/translate?sl=de&tl=en&js=n&prev=...

Actually it hasn't been demonstrated at all. They dusted a carefully made high quality fingerprint to defeat TouchID, not an opportunistic one taken from something an unwitting victim left behind.

Until they do that, this doesn't really indicate much about how weak TouchID is in the real world.

I strongly encourage you to try this and let me know how it turns out.

I'll wait.

I have accidentally seen basically all of my friends' passcodes as they type it in at bars etc. I could get into their phones easily.

And your friends could change their password 365 times per year every year for the rest of their lives.

With fingerprints, they get 10 password changes.

20 if they use their toes.

22 if they also use their nipples.

Then they'll draw even more attention unlocking it at a bar, though.

Does that actually work? I'm having... trouble... googling it.

More if they use their cat's paws.

But then again it might not be too convenient to carry said cat around all the time.

How do you change password with one finger left?

I'd say 9 password changes...

> Most security experts that I know agree that if an intruder has physical access to a device, it can be considered compromised because it is just a matter of time.

Anyone who says this is not a security expert. That hasn't been true since full disk encryption became available. A properly encrypted device is a brick if stolen, which is the only reason to have full disk encryption in the first place.

Most people outside of this community are not using disk encryption.

With that said and the caveat that I am not an encryption expert myself: given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken? If so, then it is just a question of computing power and time, not of whether it is possible to get to the data.

>given an infinite amount of computing power and an infinite amount of time, can full disk encryption not be broken?

Sure. But the difference between "infinite" and "a couple billion years" from a human perspective is minute.

Yeah, just a matter of time. Bring a flashlight though, because the sun is projected to burn out far sooner than the largest supercomputer will be able to brute force a 256 bit key.

Combinatorical problems tend to grow in the amount of effort to try out all possible elements quite quickly, and quickly growing things in turns often hit physical limits. The following post on Security.Stackexchange explains it quite nicely; excerpt: the sun doesn't emit enough energy over its lifetime to power an extremely efficient computer able to try all combinations.

http://security.stackexchange.com/a/25878/25947

So basically we need some new form of computer (one that's not flipping individual physical bits), and not "just faster" ones, to crack certain encryptions by brute force.

No, the physical access statement still holds true, even with FDE. First, if the machine is powered on, they can just extract the keys from RAM. Second, if you continue to use the device after it has been tampered with, you also lose (aka evil maid attack).

I take it you're not a security researcher either, because "A properly encrypted device is a brick if stolen, which is the only reason to have full disk encryption in the first place" is insufficient, too.

Cold boot attacks, copying the drive and hacking the bootloader to get the drive password the next time you log in are two trivial methods, both of which have been used already.

Once you lose physical access to your hardware, it's game over. You simply cannot trust your computer after that point if you care AT ALL about maximizing security.

I like how you refer to things that you have never tried as "trivial". And the defense against those is easy. Don't reuse it after it was stolen then returned. That's a different threat.

A comment on another article the other day (can't remember which or I'd link) noted that no-one will magically know your passcode when you sleep or nap, but it might not be too hard for them to gently put your thumb on your phone. One would do well to remember that involuntarily "surrendering" login information doesn't necessarily require hoses or wrenches...

Reply on news.ycombinator.com