Re:Smartphones can be fooled by fake, digitally composed fin...
by hexane360 on Saturday May 13, 2017 @05:54PM
(#14333222)
You really think the gym would use a system where a large portion of fingerprints match as OP? No, we're not dealing with yes/no. We're dealing with "which fingerprint matches the given data best", not "does the given data match a given fingerprint well enough". The scanner doesn't return "is this person OP", it returns "which person is this".
Re:Smartphones can be fooled by fake, digitally composed fin...
by Godel_unicode on Saturday May 13, 2017 @09:59PM
(#14333853)
As someone who has done red teaming of systems like this and found exactly that type of bug? Yes. Yes I do.
I'm sorry, but you are simply fundamentally misunderstanding how this works.
"If this authentication system didn't work nobody would use it" is literally the reasoning I mentioned above.
> we're no longer dealing with yes/no results
That's exactly what we're dealing with. Iterate through the list of fingerprints in the database, does provided == stored.
You might be interested in reading about CER (crossover error rate). It's the term used for discussing the trade-off between type 1(false positive) and type 2 (false negative) in biometric systems especially.
https://security.stackexchange.com/questions/57589/determini...