News for hackers. Stuff that matters.

A comment on Smartphones can be fooled by fake, digitally composed fingerprints. Parent comment

Re:Smartphones can be fooled by fake, digitally composed fin... by majke on Thursday May 11, 2017 @03:58PM (#14319000)
That's not how it works. The process of reading your retina / fingerprint is error prone. You can't take hash out of error-prone data blob!

My understanding is that matching the pre-saved template against a fresh scan is a process similar to measuring Levenshtein distance. There is some threshold, and sample with smaller error are accepted. This does imply that the iphone has somewhere stored your _unencrypted_, _unhashed_ template of your fingerprint.

But this is not my area of expertise. Perhaps a subject matter expert can comment.

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by wlesieutre on Thursday May 11, 2017 @05:18PM (#14319611)
Not cryptographic hashing functions, definitely. What about locality-sensitive hashing?

https://en.wikipedia.org/wiki/Locality-sensitive_hashing

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by theoh on Thursday May 11, 2017 @04:17PM (#14319137)
I'm not an expert, but I remember getting an impression of a very principled approach to biometrics from John Daugman. This article is about iris recognition and I'm pretty sure it is worth posting in this context: https://www.cl.cam.ac.uk/~jgd1000/csvt.pdf
[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by out_of_protocol on Thursday May 11, 2017 @04:06PM (#14319055)
Indeed it is, inside a sensor (that's why so much trouble replacing one on iphone), gladly raw data never leaves it (same goes for Android as well, except really really old versions, like 4-)
[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by majke on Thursday May 11, 2017 @04:19PM (#14319156)
"data never leaves it" reference please?
[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by delinka on Thursday May 11, 2017 @04:45PM (#14319349)
https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Find the section titled "Secure Enclave." When the SE needs to store data on the filesystem, it's encrypted with a key that never leaves the SE. Effectively, assuming the encryption is implemented correctly, data 'owned' by the SE is never available to any other part of the system.

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by H4CK3RM4N on Thursday May 11, 2017 @04:44PM (#14319339)
https://www.apple.com/business/docs/iOS_Security_Guide.pdf

You're looking for the bit on the "Secure Enclave".

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by NwmG on Thursday May 11, 2017 @04:04PM (#14319039)
Yeah, pretty much. It compares the minutiae[1] from the new scan against that from one, or multiple saved scans from registration.

[1]https://www.wikiwand.com/en/Minutiae

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by tdist on Thursday May 11, 2017 @04:24PM (#14319180)
I addressed this when this study was discussed last week, but it's worth reminding that minutiae comparing is not the only technique used for fingerprint matching. [1]

(possible corporate bias) [1] https://corporate.fingerprints.com/en/newsroom/faq-regarding...

[ Parent | on HN ]
Re:Smartphones can be fooled by fake, digitally composed fin... by NwmG on Thursday May 11, 2017 @04:29PM (#14319233)
Thanks for the link! Yes there are many ways, I always thought minutiae was most common/simplest. There are some interesting advancements also occuring in the optical tomography. [1]

http://ieeexplore.ieee.org/document/7110228/?reload=true

[ Parent | on HN ]