Slashdot Mirror
Researchers Hack Biometric Faces
yahoi sends in news from a week or so back: "Vietnamese researchers have cracked the facial recognition technology used for authentication in Lenovo, Asus, and Toshiba laptops in lieu of the standard logon/password. The researchers were able to easily bypass the biometric authentication system built into the laptops by using photos of an authorized user, as well as by presenting multiple phony facial images in brute-force attacks. One of the researchers will demonstrate the hack at Black Hat DC this week. He says the laptop makers should remove the facial biometrics feature from their products because the vulnerability of this technology can't be fixed."
Any security measure other than a (secure) password for computers are not going to provide much security. Fingerprint scanners can be bypassed, physical dongles can be duplicated, and other things are trivial to remove. A secure password with encryption is the only way that you can really make sure a computer is 100% secure. But most people don't need 100% security. There are very few robbers who would steal a laptop then proceed to attempt to remove data on it via fingerprints or other biometrics. So for the average user, it isn't a security risk. Its like saying that locking your door at night isn't good enough because a determined person can break through the glass.
Taxation is legalized theft, no more, no less.
I definitely disagree here. While passwords can be brute forced given enough time, your face is almost certainly available to someone who has access to get at your computer.
There is a difference between identification and authentication (your claim of who you are, and your proof of that claim). What you look like is identification.
If that's the standard, all security features should be removed. Everything is somewhat vulnerable, and a determined intruder with infinite resource will almost always find a way in. The object is to make this unreasonably hard for most applications.
Not quite. Biometrics are horrible for security, because 1. they're not secret, 2. they're not easily replaceable. Once they have a picture of you, facial recognition is broken. Once they have your fingerprint, that's broken as well.
Once they have your password, you choose another one and that's it. I'd like to see you do that with your face.
...your average joe-6-pack criminal isn't going to have the brain cells for black hat cracking stuff like this. If they can't get into the laptop, they are probably going to part it out and sell it for any money they can get. On the other hand, if they have full access and can get wifi somewhere, then having Adeona (http://adeona.cs.washington.edu/) installed might pay off. A chance of getting your laptop back is probably better than none at all... If you're really concerned about security, true crypt + usb key would probably be a better choice imo. I guess it all comes down to how_secure you want your laptop to be...
Once upon a time in a mythical land called Soviet Russia, a hot bowl of grits had Natalie Portman.
Biometrics are one part of a good authentication system. But there are always trade-offs: to lower FRR (False Reject Rate, or rate of false negatives) you have to raise FAR (False Accept Rate, or rate of false positives). Iris and fingerprint recognition are mature technologies; they can deliver low false negatives with virtually no false positives. There are well-defined and effective ways of preventing spoofing. But yes, they are only a single component, and should be combined with password and/or physical tokens.
On the other hand, facial recognition is much, much less developed. Using it for your sole authentication modality is absurd. In order to prevent an extremely high level of false negatives, you'd have to accept an unacceptably high level of false positives. This makes spoofing easy.
Just because you sold your soul to the devil that needn't make you a teetotaler. --The Devil and Daniel Webster
Well, Mythbusters got past fingerprint recognition systems with a Xerox and a Sharpie (after getting the fingerprint off of a can or glass, IIRC). My comment at the time to the group I was watching it with was approximately "I hope their stocks drop hugely tomorrow".
but wouldn't those hackers be pissed if they go through all the trouble to get a good face pic of the user only to find out that there's a password screen immediately after that. i'd say it's a great addition to a layered security system.
Iris and fingerprint recognition are mature technologies; they can deliver low false negatives with virtually no false positives.
Passwords deliver 0% false negatives and 0% false positives. If it rejects you, just type it again.
There are well-defined and effective ways of preventing spoofing.
Like what? A hash of my whole eyeball?
Anyway, nice job twisting my point. Let me repeat:
1. Not secret. Unique, but not secret. Which means, if someone gets the technology to spoof one, they can spoof all. What, fingerprints? They use them to catch criminals because we leave them all over the place.
2. Not replaceable. If you find out someone can spoof your iris, what do you do? Grow new ones?
Just because the technology isn't available yet, don't assume it never will be.
There is only one thing that biometrics add to security: noone has to tell the Big Boss he can't juse his initials as password anymore. Apparently it's worth it.
In single-system scenarios, you are correct. Once the password or biometric ID is cracked, the system is cracked, game over, etc. In that sense, they are equivalent. The problem is that your life, which is ultimately the use case you care about, isn't a single-system scenario, it is a long series of systems and accounts and whatnot over your entire life. If a password is broken, and your email account or whatever is compromised, that sucks; but you can generate a new one for future rounds. If a biometric ID is cracked, you can't generate a new one, so any and all systems, for the rest of your life, that are "secured" by biometrics aren't secure. That is where biometrics really falls flat.
And Mythbusters has fingerprint scanners covered. As others have pointed out, use your faceprint or fingerprint for identification and a password or the like for authentication. Hell, even in Star Trek you have to say "Authorization Picard Alpha Two" in Picard's voice to blow up the ship.
While passwords can be brute forced given enough time, your face is almost certainly available to someone who has access to get at your computer.
Also, you could say that face recognition is just as secure as writing a reasonably long password on your forehead. Someone takes a picture and boom. Access.
Personally, I refrain from writing my passwords on my forehead - regardless if I can see a suspicious-looking character taking a picture of me square-enough in the face to capture all the digits. And, I also refrain of using or buying face recognition devices...
What puzzles me is the comment in the article: > This form of authentication is considered more convenient than fingerprint scans and more secure than traditional passwords Considered by whom? Their dog? No one that has three working neurons can think that how your face looks is a stronger secret than some word you have in your mind. When they announced this "security mechanism" every security specialist I know said it was worse than nothing, it didn't even qualify as weak security, and it would be abandoned within months. It is sad when security features of computers are designed in the marketing department.
I can't understand the mindset that people must have to actually post trollish crap like this under their username.
It boggles the mind that we as a society are producing a generation of kids that actually takes pride in being anti-social and disruptive. Yet we have the arrogance to wage wars in an effort to make other nations emulate our social paradigm.
Perhaps it's not them that needs liberating from dictatorial governments, it's us that needs liberating from a downward spiral into social implosion.
Yes, yes I'm ready for the off topic mods now.
Exactly how is someone going to get photo of you of sufficient quality to fool the recognition system without you knowing about it? You'll see the person taking the photo, and thus be able to deal with the potential breach before it ever happens.
Apparently you've never seen a telephoto lens in action.
If you've ever posted a photo of yourself on Twitter, Facebook, Myspace, a blog, or your website, people can easily get a high-quality photo of you without you knowing it.
Just sayin'.
What planet have you been on for the last couple of years? Seriously.. which one?
This has nothing to do with tin-foil-hat paranoid delusions. The GP may have been referring to Dmitry Sklyarov, which another poster just mentioned to you. That was about Adobe. Adobe did/does have huge flaws in it's software and Mr. Sklyarov came to the U.S to demonstrate that Adobe's representations of security were basically just fluff. He was arrested, and it was a HUGE deal.
This is not the only instance either. Anytime somebody dares to demonstrate how a security technology may be flawed those affected companies are using the DMCA and the corrupt/broken legisilative/judicial system to quash any dissemination of data that would reveal their products are snake oil.
Just awhile back there was a posting here on /. where a group of university kids (MIT) were involved in a lawsuit to suppress information they uncovered involving vulnerabilities in another security system.
There are plenty of examples where security is proven to be worthless and those affected financially have resorted to corrupt influences in the government to suppress the information and punish those involved with arrest.
These things I have mentioned to you are not delusional. I would suggest you educate yourself with the facts before accusing somebody of just being paranoid. Especially, since the GP was referring to something factual.
Reverse engineering code to demonstrate flaws is one thing. Testing the software in a complete fashion without breaking into the code is quite another. Get YOUR facts straight.
You leave your fingerprints everywhere, so it's pretty much public information. Now the only thing you're relying on is the attacker's inability, or choosing not waste time, to reproduce your fingerprint - but that's security by obscurity, isn't it?
So based on this argument, card + code is just as secure as card + code + fingerprint. The fingerprint step is there to make you feel safe rather than really make you safe.
...and carries the same level of security as speaking your password every time you type it.
Seriously, biometrics are a bad idea, unless also combined with other methods of authentication.
If facial recognition is being offered as a replacement for passwords, then it is being sold as a replacement for security.
I'll never make that mistake again, reading the experts' opinions. - Feynman
I was under the impression that for any serious application of a biometric (as in "for security reasons"), that the system should check that the subject is alive, to help deter people from chopping off fingers or poking out eyes. eg a fingerprint scanner would check for sub-surface bloodflow.
The fact that this system is fooled by a static image of the person therefore deems it not fit for purpose IMHO, and this finding should be gratefully received by the manufacturers who can now work on improving the system.
> If it can be defeated with a 2D picture, why not up the ante and ensure that the target
> is 3d by scanning it with a cheap laser?
Because the whole point was to offer biometric identification without spending any money on hardware. The camera was already there.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.