back

by ortusdux·15y ago·view on hn ↗
I like the new trend of replacing the unlock button with a fingerprint reader-

http://cdn.cbsi.com.au/story_media/339308370/moto-atrix-fing...

Not only is is faster and more secure, but it also creates many interesting opportunities:

-User accounts with different permissions (your kids could play games but not access the dialer or edit files).

-different actions for different fingers (ring finger sends a call to voicemail).

-True wallet replacement (square could have a field day).

-A trustworthy form of temporary bricking would nearly eliminate simple theft (10 wrong swipes and you have to visit a vendor with some id to have it unlocked)

3 comments
A fingerprint reader is probably more secure, but actually wouldn't solve the "smudge" problem. You've most likely left latent prints all over your phone. These can be used pretty easily to create a fake finger that would probably fool the sensor.

Additionally, the history of swipe sensors in laptops is a mixed bag as far as this sort of solution goes. They are in almost all laptops, but almost no one actually uses them. Most people perceive them as too much of a hassle compared to the standard username/password setup. Maybe if phones start holding data that people value more (like digital money) they'd be willing put up with the additional work of using the sensor.

The ultimate solution would probably be something that grabs the biometric data without the user having to do anything special. This would make it easier to use and more secure. Apple actually already has a patent on this: http://www.engadget.com/2009/03/27/recent-apple-patent-filin...

> These can be used pretty easily to create a fake finger that would probably fool the sensor.

At this point aren't all bets off? If a person is willing to do that, I would think they'd also be willing to disassemble the phone and extract the information that way. You would need a sort of whole-disk encryption too.

Main problem with any kind of biometric authentication is that it cannot be used as basis for generating encryption keys (eg. for whole disk encryption). Because in that case it's totally irrelevant if you can fool the sensor, you just have to process somehow "stolen" biometric data in same way as the sensor (+ encryption software) does.

For other authentication applications, all security lies in fact that it's not possible (for reasonable values of "possible") to fool the sensor or bypass it. But most commonly used fingerprint scanners are incredibly easy to fool (even including so called "high-security" sensors that happily accept photocopy of fingerprint as valid finger). Bypassing the sensor is often even easier, but on the other hand I've seen systems (for example BIOS level fingerprint authentication on ThinkPads) that are explicitly designed as to make that very expensive (in the ThinkPad case you would have to actually decapsulate the sensor chip from it's package).

Finger prints are good for identification (think username), but horrible at authentication (think password). We leave finger prints all over the place.
I disagree that fingerprints are a secure form of authentication. As the Chaos Computer Club has shown, it is relatively simple to create duplicates of fingerprints that can fool sensors.

In essence, relying on your fingerprint for authentication amounts to leaving a copy of your password on everything you touch.