Slashdot Mirror
Researchers Hack Biometric Faces
yahoi sends in news from a week or so back: "Vietnamese researchers have cracked the facial recognition technology used for authentication in Lenovo, Asus, and Toshiba laptops in lieu of the standard logon/password. The researchers were able to easily bypass the biometric authentication system built into the laptops by using photos of an authorized user, as well as by presenting multiple phony facial images in brute-force attacks. One of the researchers will demonstrate the hack at Black Hat DC this week. He says the laptop makers should remove the facial biometrics feature from their products because the vulnerability of this technology can't be fixed."
Shouldn't they get charged with hacking the researchers faces off? That is kind of brutal no?
He says the laptop makers should remove the facial biometrics feature from their products because the vulnerability of this technology can't be fixed.
If that's the standard, all security features should be removed. Everything is somewhat vulnerable, and a determined intruder with infinite resource will almost always find a way in. The object is to make this unreasonably hard for most applications.
If you get your laptop lifted at the coffee shop, they better lift your wallet too I guess.
=======
Science -- Sealed, Delivered.
Any security measure other than a (secure) password for computers are not going to provide much security. Fingerprint scanners can be bypassed, physical dongles can be duplicated, and other things are trivial to remove. A secure password with encryption is the only way that you can really make sure a computer is 100% secure. But most people don't need 100% security. There are very few robbers who would steal a laptop then proceed to attempt to remove data on it via fingerprints or other biometrics. So for the average user, it isn't a security risk. Its like saying that locking your door at night isn't good enough because a determined person can break through the glass.
Taxation is legalized theft, no more, no less.
The researchers were able to easily bypass the biometric authentication system built into the laptops by using photos of an authorized user [...]
Tragically, sadly obvious. Not even a hack, really.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Even made a point of saying "facial recognition systems aren't all that secure. They can't tell the difference between a person and a photo of the person". Then he proceeded to break into the room by holding up a picture of someone that had access.
...your average joe-6-pack criminal isn't going to have the brain cells for black hat cracking stuff like this. If they can't get into the laptop, they are probably going to part it out and sell it for any money they can get. On the other hand, if they have full access and can get wifi somewhere, then having Adeona (http://adeona.cs.washington.edu/) installed might pay off. A chance of getting your laptop back is probably better than none at all... If you're really concerned about security, true crypt + usb key would probably be a better choice imo. I guess it all comes down to how_secure you want your laptop to be...
Once upon a time in a mythical land called Soviet Russia, a hot bowl of grits had Natalie Portman.
Wonder if, when you 'enrolled' your face in the recognition software, you held your hand(s) up in the image forming a symbol -- peace sign, one finger salute, whatever. Then someone would have to capture your image at the instant you authenticated.
It would be customizeable and and changeable, unlike your face, and hard to duplicate blindly.
but wouldn't those hackers be pissed if they go through all the trouble to get a good face pic of the user only to find out that there's a password screen immediately after that. i'd say it's a great addition to a layered security system.
I can't understand the mindset that people must have to actually post trollish crap like this under their username.
It boggles the mind that we as a society are producing a generation of kids that actually takes pride in being anti-social and disruptive. Yet we have the arrogance to wage wars in an effort to make other nations emulate our social paradigm.
Perhaps it's not them that needs liberating from dictatorial governments, it's us that needs liberating from a downward spiral into social implosion.
Yes, yes I'm ready for the off topic mods now.
If you've ever posted a photo of yourself on Twitter, Facebook, Myspace, a blog, or your website, people can easily get a high-quality photo of you without you knowing it.
Just sayin'.
What planet have you been on for the last couple of years? Seriously.. which one?
This has nothing to do with tin-foil-hat paranoid delusions. The GP may have been referring to Dmitry Sklyarov, which another poster just mentioned to you. That was about Adobe. Adobe did/does have huge flaws in it's software and Mr. Sklyarov came to the U.S to demonstrate that Adobe's representations of security were basically just fluff. He was arrested, and it was a HUGE deal.
This is not the only instance either. Anytime somebody dares to demonstrate how a security technology may be flawed those affected companies are using the DMCA and the corrupt/broken legisilative/judicial system to quash any dissemination of data that would reveal their products are snake oil.
Just awhile back there was a posting here on /. where a group of university kids (MIT) were involved in a lawsuit to suppress information they uncovered involving vulnerabilities in another security system.
There are plenty of examples where security is proven to be worthless and those affected financially have resorted to corrupt influences in the government to suppress the information and punish those involved with arrest.
These things I have mentioned to you are not delusional. I would suggest you educate yourself with the facts before accusing somebody of just being paranoid. Especially, since the GP was referring to something factual.
If facial recognition is being offered as a replacement for passwords, then it is being sold as a replacement for security.
I'll never make that mistake again, reading the experts' opinions. - Feynman
Here's an up-to-date partial list of security researchers who have been threatened with legal action for releasing research on security vulnerabilities:
http://attrition.org/errata/legal_threats/
It should give you an idea of why people are concerned.
End of lesson. You may press the button.