Cutting edge security

@normalmemess #phone #joke #funnyvideos ♬ Originalton - Normal Memes

Something no one really wants to talk about is the fact that most biometric authentication is just one knife accident away from being token-based authentication.

Brute Force: Now with less brutality

from here and here

My fingers are resting just a little bit easier knowing that there are now attacks against fingerprint authentication that involve a dictionary of digitized fingerprints. I'd just as soon the vulnerabilities involved not get fixed as that would force attackers back to using less civilized means. 

I suppose it might be more accurate to call it a dictionary attack rather than a brute force attack, but what do I know?

It's more "secure"

from here and here

There are some scenarios where I can see fingerprint biometrics providing a lot of additional security, but phones and laptops aren't among them. It's like a combination lock with the combination written on it. They do provide convenience, and maybe that's what we should be caring about, but we shouldn't try to pretend it's for security

Good thing you didn't forget which finger to use

found on Acid Cow

There are a variety of reasons why unlocking a phone with just a fingerprint might not be a good idea (such as the fact that it can be entered without your consent by an intimate contact or compelled from you by the authorities) but if those kinds of adversaries aren't part of your threat model then forgetfulness is certainly an argument in favour of fingerprint unlock.

Have fun with passwordless authentication

found on Reddit

They've been trying to get rid of passwords for years, opting instead for things like your phone (as a token) or biometrics, or both. Unfortunately alternatives to passwords require additional hardware and just aren't as reliable as passwords.

Turn the other cheek

from here and here (image source)

I sometimes question whether fingerprints are actually more secure than passwords, but I'm not sure if buttprints have the same caveats 

Computerphile: Fingerprint Recognition

Watch on YouTube

There are of course additional steps one can add to the process to make sure you're dealing with a live genuine finger rather than some sort of facsimile, but it still boils down to comparing minutae points.

Biometrics are easy, they said

found on Reddit

There are a lot of assumptions inherent in any authentication mechanism, but ones that are relatively new deserve to have things spelled out a little more clearly than just 3 words. It's not like they don't have room for more words, there's plenty of room.

No access for Sweaty McClammyHands

found on Funny Junk

Generally this would be an annoyance, but if the reason your fingers were sweaty was because the cops were interrogating you then maybe this works out in your favour.

Biometrics, how do they work?

from here and here (image source)

Is this a real mistake that people make? I don't know, but I do know that people do make mistakes with biometrics. Try as we might to make idiot-proof systems, the universe just keeps making bigger and better idiots.

The escape key won't help you now

from here (image source)

What happens when you don't understand how your protective measures work is that you wind up squandering the protection they offer.

Hold that pose, Drake

from here and here

Maybe you're enthusiastic about the idea that we'll soon be able to get rid of passwords. Maybe you even point out that "No one's going to guess your thumbprint".

If so, I'm going to have to rain on your parade and remind you that your prints can be extracted from normal photos, and multiple criminals have already been identified and arrested based on this technique.

Bypassing a fingerprint scanner with Elmer's glue

Watch on YouTube

I remember when this kind of bypass required a little more specialized materials than the paste your kid eats in kindergarten. I guess it just goes to show that attacks only improve over time

Putting the 'trick' in biometric authentication

Watch on YouTube

There's a now well known problem with fingerprint biometric authentication - someone can use you're fingerprint without your consent. Well, if you're willing to put up with a little bit of inconvenience, perhaps using something other than your finger could mitigate that problem. You'll probably want to make sure no one sees you unlock your phone, though, or they'll just use whatever you normally use.

No TouchID for you!

found on Izismile

Biometrics may be a pain, but you could have an interesting criminal career with that physical 'defect'.

An early biometric database

found on Acid Cow

Imagine how much bigger (and smaller) biometric databases are now that they're computerized. That many fingerprints could probably fit on an external harddisk you could fit in your pocket, but they probably still need a room that big to hold all the data they hve now.

Can't quite put my finger on what went wrong

from here and here (image source one and two)

I considered the possibility that hackers uploading their fingerprints to a crime scene might be a technologically impaired hacker, but honestly I think there must be a fair bit of skill in that. It's just a really dumb thing to do.

Sometimes biometrics are a little TOO convenient

found on Izismile

Even if she hadn't added her own fingertip, she could have easily used your finger while you slept. Then there's the authorities who can compel you to provide your finger to unlock your devices even when they can't compel you to give up your password - not to mention less legal attackers who could get your fingerprint in all sorts of different ways.

At least it still stops butt-dialing

from here (image source)

Being able to unlock a phone with a finger instead of a fingerprint is certainly more convenient, but sometimes convenience isn't worth the cost.

Graham Cluley has an interesting theory about how this problem works (that enrolling with the screen protector on means you enroll a fingerprint without ridge details), but doesn't see how a software update can fix it - and in the strictest sense he's right that a software update isn't going to make the ridge details magically appear, but the software update would be able to detect the absence of those ridge details. In essence it could detect when poor biometric data has been used for enrollment and protect users from the consequences of this failure by alerting them to it and/or refusing to use poor quality biometric data.

404 Fingerprint not found

found on Imgur

I know there are plenty of things that can happen to a finger that would cause fingerprint recognition to fail (either temporarily or permanently), but it never even occurred to me something as simple as having a wet finger (washroom hygiene?) could cause a problem. In retrospect it makes perfect sense, though.