Slashdot Mirror
Subverting Fingerprinting
squizzar writes in with news of a 27 year old Chinese woman who was discovered to have had her fingerprints surgically swapped between hands in order to fool Japanese immigration. "It is Japan's first case of alleged biometric fraud, but police believe the practice may be widespread. ... The apparent ability of illegal migration networks to break through hi-tech controls suggests that other countries who fingerprint visitors could be equally vulnerable — not least the United States, according to BBC Asia analyst Andre Vornic." Time for some biometric escalation. Could iris scans be subverted as easily?
if you carry around a handy severed head.
The tech for swapping fingerprints apparently exists. I don't know anybody swapping out eyeballs.
However, the open question that TFA brings up is whether or not you can skin graft somebody elses fingerprints on to you. (Or vice versa). You can do allograft skin grafts, at least temporarily, so it's feasible.
Faster! Faster! Faster would be better!
This is only a security threat if someone removes my finger and graft's it to someone else's hand so they can get my data. So my data is only as secure as the skin on my finger. I'm so scared. The likelihood of someone stealing my finger to get data is really high. Worse, they'll steal my eyeball to fake an iris scan. Maybe soon they'll just steal my brain and remove the passwords I have memorized. I'm sure in all those scenarios what I'll be thinking is "OMG, My Data!"
Japanese newspapers said police had noticed that Ms Lin's fingers had unnatural scars when she was arrested last month for allegedly faking a marriage to a Japanese man.
Seems like until they can get rid of the circular scars around their fingertips, they aren't going to fool anyone. From now on, when officials notice circular scars or other shaped scars around fingertips, they will probably have the person undergo further testing.
As far as iris switching...I don't think so. I have a feeling that the permanent blindness that likely follows(though I am not an ophthalmologist, so I can't be sure as to what is possible) will override any benefits that come from the short term gains of biometrics trickery.
I don't like Linux. This doesn't make me a troll.
The only real identity that is immune from subversion is consistent, community agreement.
What I mean by this is that every piece of data measured can be faked, copied, or altered in the database against which the measurement is checked. DNA can be planted, id cards will be sold on black markets and faked, biometrics can be later changed or forged. The measured data in the database against which identity is checked can be altered - *all* the technology-based methods for ID have vectors of attack.
What cannot be faked is what ones peers and friends agree upon regarding who an individual really is, and that the human in wuestion really is the person they agree it is. If all the friends and neighbors agree you really are Bob, then you're Bob regardless of what you do, or what data is stored in electronic systems. This is an unwieldy (nearly impossible) metric for access to a bar, authentication for into services, permission to drive, or asserting your ID at the bank to get your money. However, at its heart, community consistency could be the unalterable root from which all the other identification methods would rely upon. Basically one can create all kinds of electronic, physical, and technology based systems that will need to get reset when they are faked or forged or incorrect. To rely on other electronic systems for that reset is flawed and misses the essential nature of how people understand and use interpersonal identity.
"other countries who fingerprint visitors could be equally vulnerable — not least the United States", according to BBC Asia analyst Andre Vornic.
Vornic needs to do some research. Criminals in the US have been attempting to surgically alter or mask their fingerprints since at least the 1930s, and the FBI has been researching the techniques since then as well. I remember reading about this in a book from the 60's, where a counterfeiter surgically swapped his prints around, and the FBI recognized them, out of order, and matched them back up with the original fingers.
And as you tread the halls of sanity, You feel so glad to be, Unable to go beyond. I have a message, From another time..
So the only way this person's surgery is actually worth anything is if fingerprint scans care which hand the prints are one? I would think that if you switched your hands' fingerprints, you'd still have the same prints, which could be picked up easily enough as long as the scan tests the prints against your right and left hands both.
Not to mention, as I'm sure someone has by now, they would probably notice the scars. I would think it would be more worth it to get someone else's fingerprints, if you could.
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
"The Myth of Fingerprints" - Paul Simon, right? As far as I understand it they only use a few "distinguishing features" anyway - and they allow for damage to those (like a cut). However, the point is that it's hard to predict what will "fool the scanner" and what won't. If you don't know which "distinguishing features" it's looking for what do you change? Even harder is to get the scanner to give a false hit on someone else's finger print data (so you can pretend to be them).
As evidence at a crime scene I think finger prints are far more suspect than they might at first appear.
Yes, Darth Vader has been able to slip undetected into numerous Western democracies for this very reason.
According to mythbusters you could get past most scanners with a photocopy of someone else's fingers :P
Is it really fraud? Is there some promise that everyone has made to never make alterations to their bodies?
(I think it's dumb, but I don't see how it is fraud, she didn't actually impersonate anyone or anything)
Nerd rage is the funniest rage.
"Yes, I have changed my fingerprints. Pray that I don't alter them further!"
-- Braden's law of data: All data spends some of its lifetime in an excel spreadsheet.
How about a public (anonymised) repository of fingerprints. The idea is this: I can't change my prints, nor can I get back control once the government has taken them. But I could publish them to the world. That makes the print very easy for anyone else to fake. In other words, plausible deniability.
I'm sure in all those scenarios what I'll be thinking is "OMG, My Data!"
Gives a new meaning to the term "thumb drive".
Do not mock my vision of impractical footwear
Yea but that won't work on Americans.
True story:
I worked at a video game developer once who had biometric finger scanners to clock in and out, but required you to type in your employee number first.
"If it has my fingerprint, shouldn't it know my employee number?"
So I started playing with it. I started with the same finger on the same hand. It took it. Then a different finger on the same hand. Yup. It took a different finger on a different hand. And then we got creative.
Someone Else's finger? Check. Elbow? Check. Toe? Check. Tongue? Check.
In fact, we finally found the limit of the system. It took a warm hot dog pressed up against the fingerprint scanner, but not a cold one. A lot of my faith in fingerprint biometrics was shattered then and there. I since dated someone who had a fingerprint scanner on her computer, though that only seemed to let me trough wrongly some of the time.
Another thing we learned? Co-workers don't appreciate it when you lick the thumb scanner that everyone has to clock in with.
The ______ Agenda
that was likely a low tech scanner. Just because it says it scans for fingerprints doesn't mean it really does and just like in any other field you get what you pay for. I work on biometrics projects at my school and one of the labs I used to work in had a hand geometry scanner, made a dozen or so measurements of the length and such of fingers one of the older and less secure methods, it required an id number because while unlike fingerprint hand geometry is good for a one to any search. meaning that it will only confirm an id because mostly the accuracy is so low compared to what it would need to determine different people without combining other security vectors. Just keep in mind not all scanners are created equal and not all modalities, different biometric paths such as fingerprint iris and many others, are equal and they can be easily combined to increase security in a similar way multiple passwords adds security and it needs to be tailored to the application just like any other security approach. and just like all other methods of security it is a cat and mouse game.
every anarchist is a baffled dictator. Benito_Mussolini
Also the eye may dilate as you kill them which will also fuck the result.
Mydriasis happens with death, indeed.
But it's almost trivial to induce myosis instead, using the proper chemicals. (Cocaine, as an example of something which won't be difficult to obtain for would-be criminals. As a bonus, this same substances doubles as a way to kill the victim through overdoses AND a way to preserve the iris in myosis).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
We have already made eyeball replacements. Low resolution, only 12x12px, and it transmits the signals to your brain via the tongue, BUT IT WORKS.
Sorry, no. The thing is a *retinal* replacement.
That's where the whole trick lies.
The main problem is the way the signal processing in the eye function - the eye is already central nervous system.
Absolutely everywhere in the body, senses signal are processed the exact same way :
Some specilised type of cell detects some event (chemical, physical, whatever).
This signal is carried from there by a nerve - which linkes peripheral nervous system to central nervous system - to a first place (in the central nervous system) where the signal is processed : instead of discrete event and absolute signals (which could be subject to noise, level drift, etc.), the input from several source are averaged, and local differences is made between input. The output signal is not "local levels", but "global levels" and "constrast and other difference between points of data". That data - after going through a relay/gate (usually the Thalamus) is processed further by the brain. Thus the brain doesn't work in terms of signal strength, but in terms of variations over space and time.
With other sense : It easy, the nerves transmit the raw data, and the first process is occurring in places like the spins or the basal ganglia. There's a pretty simple 1-to-1 mapping between the things you sense and the signal in the nerves. And as the signal come from various parts of the body, the skin, whatever. it's pretty much easy to map "who is who" at a level where the nerves are still spread out. (Cochlear implants exploit this nicely : this signal is just a representation of the physical manifestation, and it's nicely spread along the cochlea. It's easy to find where to place each electrode for each corresponding sound frequency).
With sight : well it's not easy. This time, the first processing happens already in the eyeball. Those nice 1-to-1 nerves are the layers of cells which connects the deep photosensors (rods and cones) with the surface neural cells (which do the processing). This surface layer of cell works as the first central nervous system processor. What goes out of the eyeball is an already processed information, like the one which climbs up the spin in other senses.
The optical nerves itself is not a nerve technically. It connects 2 parts of central nervous system : the upper layer in the retina and the nucleus in the brain (which works as relay/gate).
From this come several problem:
- It's central nervous system. The connection can't regrow. Therefore the brain can't rewire itself to use the new eyeball as suggested by GP.
- It's processed signal. What travels the nerve are not pixels, but already processed data : contrast information about the picture, global light levels, etc.
- It's not nicely spread out. Instead it's lots of nerves wrangled together in a small area which don't 100% follow spacial representations of the pictures on the retina. (Ok, you can globally make distinction between left and right parts. but you can be precise down to each nerve fiber). It's like trying to map body regions on a cross-section of the spine it's hard to get it beyond a certain resolution.
Therefore it's easier to imagine a connection to the optical zone of the brain (like the huge plug at the back of the cranium in Matrix).
- You still got the "processed signal" problem (you can't just send raw pixels there)
- But at least its a region spread over a certain surface, thus having better accessibility and easier to map than everything wrangled together in a nerve
- And it's close to the target. There is no need for new nerves to grow, the signal is already there.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]