Re:Smartphones can be fooled by fake, digitally composed fin...
by Godel_unicode on Saturday May 13, 2017 @01:18AM
(#14329631)
> why would they still use it?
"If this authentication system didn't work nobody would use it" is literally the reasoning I mentioned above.
> we're no longer dealing with yes/no results
That's exactly what we're dealing with. Iterate through the list of fingerprints in the database, does provided == stored.
You might be interested in reading about CER (crossover error rate). It's the term used for discussing the trade-off between type 1(false positive) and type 2 (false negative) in biometric systems especially.
https://security.stackexchange.com/questions/57589/determini...
Re:Smartphones can be fooled by fake, digitally composed fin...
by hexane360 on Saturday May 13, 2017 @05:54PM
(#14333222)
You really think the gym would use a system where a large portion of fingerprints match as OP? No, we're not dealing with yes/no. We're dealing with "which fingerprint matches the given data best", not "does the given data match a given fingerprint well enough". The scanner doesn't return "is this person OP", it returns "which person is this".
Re:Smartphones can be fooled by fake, digitally composed fin...
by Godel_unicode on Saturday May 13, 2017 @09:59PM
(#14333853)
As someone who has done red teaming of systems like this and found exactly that type of bug? Yes. Yes I do.
I'm sorry, but you are simply fundamentally misunderstanding how this works.
This is 100% not the same type of reasoning. We have reason to believe that the fingerprint accurately distinguishes between 1000 different options. False positive and false negative aren't meaningful terms here, because we're no longer dealing with yes/no results.