Slashdot Mirror
Fingerprint Scanners Still Easy to Fool
Anlan writes "A Swedish student wrote her Master's thesis about current fingerprint technology. After a thorough literature study some live testing took place. Simple DIY fingerprint copies were used (detailed how-to in the thesis). Have current commercial products improved as much as proponents claim? Well, this qoute from the abstract says it all: 'The experiments focus on making artificial fingerprints in gelatin from a latent fingerprint. Nine different systems were tested at the CeBIT trade fair in Germany and all were deceived. Three other different systems were put up against more extensive tests with three different subjects. All systems were circumvented with all subjects' artificial fingerprints, but with varying results.' You can guess how happy the sales people at CeBIT were - most systems claim to be spoof proof..."
So, will they remove these fingerprint scanners, in the US Internaitonal Airport ?
Trolling using another account since 2005.
make sure not to touch your car much or leave it parked in the same place too long.
Think of the simple RSA keyfob some of us carry; it gives us a number and we use that PLUS a password to get into secure systems (have + know).
Carry this one step further and have the system check your fingerprint/handprint/iris/whatever PLUS ask for a password.
I personally think it's damn scary in this age of terrorism that someone could fake a biometric and get onto a plane; if the airlines for example issued me a unique password to go along with fingerprint (or whatever) recognition then I'd feel a whole bunch better about the entire process and the underlying technologies.
These have been, and probably always will be easy to fool. If anyone needs ultra-high security, it's doubtful that they'd choose this form of biometrics to begin with, unless they themselves are foolish.
As is true with any security measure, if it can br beaten, the geeks will find a way.
Not at all actually, your extremedies (hands, feet) change temperature faster than the core of your body, and most people's extremedies are either colder (more common) or warmer (?) than the core of their body. So to make it heat sensitive would be to deny access to most users.
Is this is the state of our security today?
Even when you are using the scanner?
It's not a flawless way to fix it, but it would make it at least a bit more difficult to foil, neh?
It would also be impossible to use. 98.6 degrees is the temperature of certain orifices in your body. These orifices are generally pretty good at maintaining a certain amount of heat. However, your hands and feet are extremities that do not keep a constant temperature. In fact, your body will sometimes shut off the blood flow if it needs the heat somewhere else.
This means that you'll never be able to accurately predict the lower bounds of finger temperature. Someone may have just been outside in cold weather. Or they may have poor blood flow to their hands (e.g. my wife's hands barely even show up on an heat sensitive screen). Similarly, they may have just touched a warm car door, or lit up a cigarette. Maybe they have some coffee in their hands.
Basically, there's almost no way short of human or artificial intelligence to near flawlessly determine if the fingerprint belongs to a real human or not.
Javascript + Nintendo DSi = DSiCade
The temperature of your fingertips is going to vary widely. If you've been holding a cup of coffee, it'll jack up to 110, 120 maybe, if you just came inside it could be down around 60 or so.
98 degrees is an average core body temperature, extremedies generally run cooler. Thats why your testicles hang down - they dont work at 98 degrees, they need to be cooler. It's also why briefs and tight pants make you sterile.
Besides, all you'd have to do is put the fake finger in a cup of warm (98 degree) water..
I think the real solution is to realize that this kind of shit only works in movies or cartoons right now.
I don't need no instructions to know how to rock!!!!
Just wanted to interject... I suppose it depends on whether you have one that bounces small radio signals off of the inside of your finger or one that simply captures an image. Certain fingerprint readers bounce radio signals off of the inside of your finger and read the underlying tissue structure (no, I'm not going to plug the product here). This prevents people from doing what she did at the trade convention. Fingerprint technology is always improving, and I'm sure that the industry will take this to heart and make these things even more complex. When you get right down to it, the systems aren't as complex as you might think. Most fingerplate templates weigh in from anywhere to 300 - 600 bytes in size.. but that is more to ease hardware requirements. I think they will combine other methods in the fingerprint taking process and eliminate these problems. Just my take on it, tear it apart guys ;)
So what happens when some law enforcement organization such as the police or the passport office want to take your fingerprints? Do you deny their request and don't get anything done, or do you use glove prints rather than fingerprints. Even worse, what if someone hacks into the police database and creates fake gloves with other people's fingerprints etched in them?
As much as the privacy advocates will laugh at this news article, fingerprints have been a proven source of clues for law enforcement agencys for decades. Nowadays, we have more sophisticated methods of detecting whether someone might have been at the scene of a crime or not, but fingerprinting is nice, quick, easy, and obvious. Of course, every system in existence can be fooled, and if you're really willing to break the system, you can. However, I hate to think that people other than the tinfoil hat crowd would be so concerned about fingerprints that they would wear gloves all the time. This is much more a legislative issue than it is a technological issue. Unless we stop legislative processes invading our privacy, technological means will be only a band-aid onto the root of the problem.
... defeating fingerprint scans is a lot harder than stealing a PIN.
There is an old saying that is attributed to the Secret Service. They can't stop someone really dedicated from killing the President. All they can do is raise the level of difficulty so high that the average individual won't be able to do it. I think that is applicable to the fingerprint scanners used in American airports. Yes, they can be beat, but they raise the threshold. They won't catch the dedicated/educated terrorists, but it will help against idiots. And stopping idiot terrorists is still a good idea. And don't fool yourselves, a lot of terrorists are idiots. Just look at the Shoe Bomber, not what I would call England's best and brightest.
Good thing this was written by a student who is NOT a US citizen or she would probably be prosecuted under the DMCA.
sudo eat my shorts
Fingerprint scanners are exactly that.
Finger. Print. Scanners.
They're not "Absolute Identity Verifiers", or "Identity Truth Machines".
They are simply tools to be used with other forms and methods of identification. Are *all* fingerprinting validation systems supposed to include "temperature, pulse, blood pressure, electric resistance, etc"? Only if some company were relying on fingerprints ALONE to verify someone's identity. But NO company would rely on fingerprints alone. Also, it would make the machine MUCH too costly for anybody to buy.
The bottom line is, yeah sure, fingerprint scanners can't tell the difference between a human finger and a gelatin one. But if a fingerprint is *all* that it takes to get access to something, then the institution has problems that dig far deeper than the inadequacies of any fingerprint scanner.
Imagine if the keyring that you currently keep in your pocket, kept leaving copies of itself on every object you touch. Imagine anyone who found a copy (with a little work) could drive your car away or freely spend your money or walk right in the front door of your locked house. Now imagine that the worst has happened, that someone has stolen a copy of your keys. Currently, it's rather inconvenient, you must create new keys (and sometimes, locks). Now tell me, how do you change your keys when the key is your right thumb? You can't. Once your key is stolen, you're totally screwed, forever.
this thesis is only a better documented, nicely written replay of a japanese experiment from some years ago :
the matsumoto experiment
and it surely doesnt mean the biometrics are not secure!
a complete biometrics based security solution has 3 "components" :
Something you know: e.g. a password or a PIN.
Something you hold: e.g. a credit card, a key, or a passport.
Something you are (biometrics): e.g. a fingerprint, iris pattern, etc.
their demonstration only fooled the 3-rd component of such a system ... which means they got NOTHING! ... plus, the most secure fingerprint scanners read the biometric info from under the epidermis(the outer "dead" skin) and are not so easily fooled with an artificial finger or fingertip ... the fact that they tested cheap of-the-shelf hardware is not exactly concludent.
.. while unfailible security does not exist, biometrics can make a big difference when used right!
The whole study is just an argument against bad hardware and sloppy security systems, not against the usage of the biometrics
"There is nothing more frightful than ignorance in action." Johann Wolfgang von Goethe
There's a big difference. If someone compromises your lock, you can change it.
If someone compromises your finger, you can't chop it off and grow a new one. Your method of authentication is screwed for the rest of your life.
--
*Art
Any reasonable authentication system will require more than one factor, only if you have someone's ID card and passphrase would this work in a 2 or 3 factor scenario. Maybe a concern for Lexus but not for most access control systems. In the world of biometrics its a trade off, throughput, accuracy and price for customer acceptance. Fingerprint is easy to use and inexpensive.