And wood glue! Looks like that method proved unreliable, so they expanded it:
"To create the mold, the mask is then used to expose the fingerprint structure on photo-senistive PCB material. The PCB material is then developed, etched and cleaned. After this process, the mold is ready. A thin coat of graphite spray is applied to ensure an improved capacitive response. This also makes it easier to remove the fake fingerprint. Finally a thin film of white wood glue is smeared into the mold. After the glue cures the new fake fingerprint is ready for use."
People reported that pet's pawns work.
How is the iris scanner on Microsoft phones in comparison?
AFAIK CCC never had a proof of concept of a real world usage of this. They needed access the original finger.
That isn't to say it's not possible but it is a pretty major asterisk.
Can't find the reference right now, but somebody's gotta remember this, it was when the UK was considering using biometric data as IDs.
https://www.ccc.de/updates/2008/schaubles-finger (in German)
Which, imo, isn't much different conditions tbh (i.e. not representative of the real world)
There's no need to get a perfect copy.
"fingerprints are usernames, not passwords" is the standard advice I've read.
It's actually the same guy as with the S8, aka Starbug.
They also managed to get the fingerprint of a politician via a high resolution picture taken at a speech. (Also a phone PIN via eye reflection captured by the front camera.)
Yes, hopefully he will give another talk at 34C3. Very entertaining guy too!
The use of biometrics on mobile devices somewhat mix this, with the assumption that if some user was authenticated within a certain time frame (via a pin or some other knowledge bound check), a simple id is enough to extend that authentication.
Authorization is the counterpart to Authentication: authentication proves who you are (with passwords/tokens/biometrics aka something you know/have/are), authorization controls what you can do (with permissions/ACLs/roles/etc.)
To put it another way, the bouncer at a club checks your photo ID to see that you match it (authentication via something you are), then uses it to see if you can enter (authorization by checking your birthdate against a cut-off/name against a guestlist).
In 2013 a CCC member broke TouchID access within a few hours after release of the IPhone. All needed was a photograph of the fingerprint on a glass surface. https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
Same method worked on the Iphone 6, as Apple hasn't changed a thing. Biometry is fundamentally broken.