SoylentNews is people
SoylentNews
Submitted via IRC for AndyTheAbsurd
Hackers Unlock Any Phone Using Photographed Fingerprints In Just 20 Minutes
According to the Chinese blog Abacus, Tencent's X-Lab team showed how this technique works at the recent GeekPwn 2019 hacking conference in Shanghai. X-Lab's leader Chen Yu asked an audience member to touch a glass and took a photo of the fingerprints.
Yu then ran the photo through an app they have developed in house, which extracts and process the necessary data to clone a physical fingerprint. The team didn't show the physical cloning process, but we can assume that they used a 3D printer like other people have done in the past. He then proceeded to use the cloned fingerprint to open three smartphones that had been registered with the audience member's fingerprint — plus two event registration machines that use fingerprint scanners.
[...] Each of those phones used one of the three existing fingerprint scanning technologies: capacitive, optical. and ultrasonic, like the one in the Samsung Galaxy S10. The latter one is especially worrying, since this technology is supposed to avoid this type of hack by scanning the three-dimensional structure of your fingerprint.
[...] In other words: fingerprint security sucks. And facial identification is not that much better, really. If you are really worried about security, the only thing you can do is probably use a longer password.
Still harder than shoulder-surfing or having no password, right?
(Score: 0) by Anonymous Coward on Saturday November 02 2019, @06:28PM
"Something you are" is not an authentication factor. People like to pretend it is, but it isn't. Spreading this misconception is dangerous.
To be an authentication factor, something must be :
* difficult to copy
* changeable
* shared only with the entity you are authenticating with
The first one is why passwords are encrypted. Security tokens are strong, passwords are strong under the right circumstances, and biometrics are mediocre.
The second one is obviously strong for passwords, weak but possible for tokens, and a complete failure for biometrics.
The third is strong for tokens, good for passwords if you don't reuse them, and again a complete failure for biometrics.
Biometrics are weak on one count and a complete failure on the other two. The only advantage is that they "seem futuristic." That is not useful.