Sorry but I have to nitpick here. Nobody was ever able to verify the fingerprint was the same as the German defence ministers.

What the attacker was able to do was take a high resolution photo of the defence ministers thumb and then produce a "fingerprint" that they could use to register as a "fingerprint" on their own phone and then unlock that phone with the "fingerprint".

It could be nothing like the defence ministers actual fingerprint but just look enough like any real fingerprint to register with a fingerprint scanner on a phone.

Thanks for the nitpick, you are right, but given the state of photogrammetry today I wouldn't be surprised if just a few pictures would be enough to give you an accurate representation.

If it was a good photograph Tia would be pretty easy to verify visually. It would also be trivial to replicate on towels to see if your methods actually were adequate to authenticate on your own device.

But that wouldn’t work with TouchID sensors right? They also check for “living tissue”. And at that point the attack becomes _very_ expensive to perform

I mean, as a electronics guy I'd say it kinda depends on how that living tissue detection is being done. You can trick a lot of sensors into outputing things that don't make much sense if you know which physical properties they are looking for.

The most sophistication would probably be something like a PPG (optical reflection changes due to blood flow in certain bands). If the fake is thin enough the PPG would likely just shine through it. Skin resistance/humidity can be easily faked as well.

It was mentioned elsewhere in the thread that a not too thick layer of gummy bear could fool it, due to light passing through it, but getting reflected back from the back. Not sure how true is it though.

Oh, I remember this, but I didn't know it was Ursula von der Leyen, now president of the european commission.

That’s exactly what I had in mind when writing that. That was a good one!