Hacker News Reader

Comment by scottLobster | Hacker News Reader

Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial.

If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway.

For your average everyday person fingerprint security is fine. The thief who snatches your phone when you step away from your table in the mall food court isn't going to be able to crack it via this method.

View on HN

>If you're already being personally targeted by an organization professional enough to follow you around, take a photo of your fingerprint on something you touched, then painstakingly reproduce said fingerprint through highly technical means and then gain physical access to your personal device that uses a fingerprint reader to use said fingerprint, you should be aware of your position and have multi-factor authentication set up for everything anyway.

But the whole point is that it's easier than you describe as people make photos with fingerprints themself accidentally, and technical means to reproduce fingerprints are not highly technical.

You'd be surprised how low the bar is for "highly technical" among the general populace, particularly those inclined to steal used technology from targets of opportunity. How many people do you know who even own a laser printer, a subscription to photoshop and the skill to use it, and know what an "acetate sheet" is? The vast majority of people, if they have a printer at all, use cheap inkjets, they don't know how to use photoshop and don't care to learn, and they've never heard of acetate sheets.

Could an enterprising criminal master this technique? Sure, but I'm not convinced it's reliable or lucrative enough to make the time/risk investment worth it for someone with that skill-set.

Yep, physical proximity is a huge barrier to any attack, and requiring persistent physical access even more so. If you have a plug in USB keyboard, this sort of quick attack through MitM passthrough is even easier.

However, having some experience with biometric sensors the False Accept/Reject ratio both for matching the fingerprint and detecting "liveness/spoof" is a BIG DEAL. Matching many prints or to many people is also MUCH HARDER (combinatorically). At high SNR (more expensive, higher resolution, larger sensor, higher power, longer latency) these problems can be largely mitigated with accurate recognition and very difficult to spoof systems. Those aren't the ones people attack for online fame.

However, when display integrated ultra-thin low cost very convenient matching is required... it will trade off for False Accept/Reject ratios and make the system significantly (orders of magnitude) less accurate. Unfortunately, it appears that the old MacBook touchbar integrated sensor has sacrificed significantly in this area.

Time of Flight 3D sensors make spoofing Face ID with easily carried biometrics significantly more challenging (they tend to be head sized).

Agree with your overall post entirely, the thing about physical attacks is they don't scale well. If you're subject to an actual individual threat, it's a whole different and enormously scarier/more challenging threat scenario.

>Think this is still overestimating the threat. It's kinda like saying you can hack someone's password by watching video of them typing. True, but also non-trivial.

Isn't that genuinely getting pretty trivial in public though? And in turn I think that is a real argument for biometrics too. The amount of over-the-shoulder camera surveillance in business and urban areas is pretty scary at this point, as are the concealability and cheapness of even very tiny spy cams. There have been plenty of scandals around it even in things like AirBNBs or hotels, historically from the context of sex, but not a stretch to imagine that passwords could be a much bigger and more lucrative target. And ML/AI is getting ever more sophisticated, and humans entering PINs/passwords is pretty repetitive behavior with a high degree of uniformity in how it's done, at least the device-unlock level. Seems very amenable to highly reliable automated analysis, to the extent I'd be genuinely surprised if that's not secretly deployed already in surveillance states.

I don't enter PINs/passwords in public anymore if I can possibly help it. It just seems scalable in a way that physical attacks aren't.

I'm no guru but the only widespread use of spy cameras for password theft I've heard of is false covers on ATMs to catch PIN codes, which makes sense as an ATM eliminates a lot of variables. (angle camera needs to be at, number/size/position of keys on keyboard, required resolution/range, increased number of victims, etc).

In the wild I imagine it's one of those things that's simple in concept but difficult in execution due to all the edge cases. Even if you get 80% of a password, if you're not at the perfect angle to catch those last few key-strokes you haven't accomplished much.

There is a reasonable chance that the print is available on the very device it is needed to unlock (the phone screen, for example), perhaps enough for a thief who snatches your phone to have a decent chance.

Assuming they have a laser printer, photoshop skills/subscription and know about acetate sheets. I'm willing to bet most phone snatchers don't even have one of those ingredients.

Most phone snatchers aren't after the information on the phone. The point is not that this would not be a targeted attack (it would be), but that it might not require a particular combination of circumstances or set-up to follow one around and snap just-the-right-angle photo.

The problem is that none of the major OS seems to allow for multiple factor authentication.

Reply on news.ycombinator.com