I think what he means is that you leave your fingerprint everywhere without even realizing it so it's the biometric equivalent of asking for your email; a random attacker won't know it but any one with a wee bit of motivation can get it.

What I meant is: you can not change it and you can not keep it secret so it makes a poor password replacement. Usernames do not have to kept secret (you know that my username on HN is petschge), so finger prints might be slightly more usable as usernames than they are as passwords. They are of course not great for that either. Their best use might be similar to the "card present verifier" on the back of a credit card, i.e. as a sign that the person who entered they username, they password (and possibly a physical auth token like a chip card) is actually present themselves. Or don't use fingerprints at all. They are not secure nor convenient as you think.

I agree with this, but think that faces face the same issue. If anything, we leave our faces more places than our fingerprints; fingerprints smudge over time, but faces are big enough to capture at sufficient detail using cameras that are already widely deployed. iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles. I would really like biometrics to work, verifiable proof-of-human would be great, but I can only buy into them as an additional requirement for authentication; a piece of privately known/held information is still our most secure authentication mechanism for competent users.

> iOS is betrer about facial recognition than Android (and I'm not an Apple fanboi), but it can still be hacked with some patience and enough video frames of the given face at different angles.

FWIW, I don’t think anyone has done this credibly yet.

It's an arms race where people keep breaking into a specific version, Apple makes it harder, and nobody can get into the new shit for a while. There was a method for the X (dunno if updates have made it harder), but not for anything more recent AFAIK. I bet we see another one drop in the next couple years. It's just an engineering problem.

> There was a method for the X

I don't recall seeing one. Do you have a link?

You are right. But note that I never said that faces where any better.

True that, I didn't mean to imply otherwise; I just thought your comment was the most coherent rebuking of fingerprints I'd seen so far while skimming, and I thought it would be a good place to expand on your sentiments with my own thoughts. I do see how my opening "but" could be confusing in this regard.

A wee bit of motivation, hah, are you James Bond or something?

Usernames can be guessed remotely, fingerprints can't really.

Please demonstrate an attack that takes "a wee bit" of effort where you can use a fingerprint you found in the wild to auth.

The CCC went after a German politician to show just how easily you could copy a fingerprint even without access to an object touched by the target[1]. A few pictures of the finger are more than enough.

[1] https://www.macrumors.com/2014/12/29/ccc-reproduce-fingerpri...

How do you actually use the picture of the fingerprint to get into a phone? It doesn’t accept pictures, only fingers.

Print with a laserjet onto overhead projector foil, spread a suitable kind of wood glue, dry, peel and apply to own finger tip. It is actually very straight forward.

From the NewScientist article Laforet linked above:

> fake fingerprints can be created by imprinting copies in rubbery gels or silicone plastic, says Marcela Espinoza of the Institute of Police Science in Lausanne, Switzerland.

Replace silicone with some other flesh-like material that's conductive.

Ok but isn't that significantly more trouble than seeing or guessing a username?

Does this take just a "wee bit of motivation"?

This video[1] is German, however as far as I can tell everything you need to get from an image to a fake print is easily available. The relevant part starts at 65 seconds. Only a few minutes to get a working fake. It is basically the process described by petschge.

[1] https://youtu.be/OPtzRQNHzl0?t=65