Like many others, my smartphone can be accessed via biometric fingerprint login to reveal sensitive data such as email.
This got me thinking about the security implications for my smartphone. I'm curious about the potential risks and how secure my data really is after such an interaction. Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?
Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the device is in your hands and not someone else's hand.
Security depends on the sensor device. That is, how good it is a making a difference between your actual, live finger and something else.
If you are worried about the security of your phone fingerprint sensor, use a password. Your fingerprint itself is already available to anyone who cares.
Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.
With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.
If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.
Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.
All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.
> Your fingerprint itself is already available to anyone who cares.
In that case your fingerprint can't prove you're here then
Ie, if I replicated your fingerprints from a drink glass in a bar, I'd likely not know your name (username) or password, which would be the first factor.
Equally if I got your credentials from a dark web leak, I'd not know your biometrics, which would be your second factor.
It isn't foolproof, but it is certainly significantly more secure than just making your password more complex.
That said, I do prefer fingerprints being an identifier (or username) rather than a credential, but as part of an MFA process I feel it adds value.
Like passkeys, which also cannot reach the secrecy of passwords.
This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days.
It's a disaster waiting to happen.
We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either.
In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that some heads are proverbially rolled and some specifications are updated.
your gvt will deeply regret this move someday. it's beyond stupid.
https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...
Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone?
> Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?
I think not, if the third party is a government.
Think of a fingerprint reader as a USB keyboard that types out your fingerprint number for you when you touch it. While an attacker can steal the finger and put it on the reader they are more likely to steal the number and type it in with a regular keyboard.
Border controls are about building a (passport, face, fingerprint) tuple under human (or remote human) supervision on trusted hardware to control physical movement. It feels like one of the few cases where fingerprint readers do actually work as an application.
Now that the border police have your magic finger number they can indeed unlock your phone too. It’s an offline attack though — they need to get logic probes between the reader and the CPU — so if the phone locks with a PIN after reboot, magic key press, or a period of time then that’s the appropriate defence.
I'm expecting that if you want to do it at scale (like once a day per airport), you can 3d print them within an hour
Re fingerprint: there’s risks around having your fingerprint lifted from something you touch (eg a glass). It’s a movie trope but it’s not that far fetched from being doable. Eg from 20 years ago: https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...
FWIW I really don't recommend just fingerprint for phone access. You can change a PIN if someone else gets a hold of it, there's not much you can do to change your fingerprints.
If not then I'd question what their IT department was doing not forcing a least PIN unlock on the phone.
It's like sticking a note with a password on your computer :)
Personal protip: I use fingerprint lock, but anything sensitive on my phone is blocked with extra pattern lock. With unlocked phone you can access my gallery but you cannot access bank apps. IIRC this will be the built in feature of next Android, I use Xiaomi smartphone which has many extra security features like this one since basically always. Maybe there is an app for this too, I don't know.
Of course this isn't 100% secure, I probably have USB Debugging unlocked, but at least saves me from a random person just grabbing my phone while I'm on a bus and running away with unlocked phone.
Before anyone asks "But aren't bank apps already locked with their own PIN codes?" - yes, they are. But some forces me to have 4 digits PIN only, some even suggests using fingerprint to unlock them (and for some I do). But I'm also blocking Google Play, a browser where I do the most private stuff, I could block a messenger app. Basic apps does not have extra security features.
But actually you made me think.. So I'm not sure about current models sold in EU, they removed a lot of MIUI features and replaced them with shitty Google alternatives on EU roms. But would they remove such a "deep" feature? It's not "just an app", it's a system core feature to me.
If you have this "Security"/"Control panel" (idk how it's named in English right now) app (the one with green shield icon) this feature should be available to you
30 years ago much of the population was concerned about typing a credit card number into 'the internet'. Now we have a small, hackable, stealable, insecure by design device with bank, personal communications, business communications, social security, family photos and numerous more data depending on your choice of app. It's a great win of drip-drip very convenient life is faster now (it isn't, there's just more gap for not planning).
Access by a criminal? probably not much - if they can get physical access to your phone, access to your fingerprint by social manipulation or threat isn't that hard.
Access by government agency that confiscates your phone? theoretically yes, but no more than using printed fingerprints on an arrest record or lifted from your home and printed so they can be used on your phone.
Access by a local sheriff/corrupt cop? a lot of hassle compared with getting access to your finger
And honestly, I fear that most people just don't care
* It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/)
* You will leave fingerprints and other biometric features everywhere.
It's way worse than that, you may only need photographs of someone's thumb:
https://arstechnica.com/information-technology/2014/12/polit...
Fingerprints for unlocking is not very secure it's just a convenience. Consider it to be equivalent to face unlocking. Anyone who is determined enough will bypass it. Whether it's secure enough depends on your threat model. I trust face unlock to prevent my kids unlocking my phone but that's a whole different kind of threat model from a state actor.
As long as you keep the default of requiring attention, face lock is likely safer than a fingerprint from the kid threat vector.
"Fox News reports that six-year-old Ashlynd Howell from Arkansas spotted her mother Bethany taking a nap on the couch. The girl then took her sleeping mother’s thumb and placed it on her iPhone’s fingerprint reader to unlock the device, all so she could order $250 worth of Pokémon merchandise on Amazon." - https://wsvn.com/news/us-world/6-year-old-uses-sleeping-moms...
"Cryptographic expert Matthew Green has found his son Harrison bypassing the security measures, CNN Money reports, by swiping the phone with his thumb while he slept" - https://www.dailydot.com/debug/touch-id-child-iphone-unlock/
Though depending on how deeply you sleep:
"Man opens eyelids of sleeping girlfriend to unlock her phone, steals over Rs 18 lakh from her bank app" - https://www.indiatoday.in/technology/news/story/man-opens-ey...
and from five years ago: "Heavy sleepers, beware: Researchers bypass Apple FaceID using glasses with tape" - https://www.digitaltrends.com/mobile/apple-faceid-tricked-by...
Bonus: "Face ID shown unlocking for family members who aren’t alike" - https://bgr.com/tech/iphone-x-face-id-hack-family-members/ with the suggestion that Face ID continuously updates the facial features, and by sharing the phone the recognition algorithm may have ended up trained on both faces.
They are at best a quick convenience for perhaps a time logging machine? Where security really isn't a factor.
Two points to make:
First, I don't know about Android, but certainly on iPhone, the fingerprint data is stored in the Secure Enclave and the biometric reader on the phone establishes a secure communications channel (unique session key) with the Secure Enclave. So remote attacks are unfeasable unless you've managed to extract the underlying shared key from the Secure Enclave.[1]
Second, the definition of what is "stored". There are a number of different approaches to storing biometric data, and most if not all "modern" methods will store an algorithmic derivation of some sort rather than actual raw measurement data. Hence if the government is using algorithm A and your phone is using algorithm B, then in all likelyhood there is no viable way to transpose between the two.
Third, generally good OPSEC suggests to disable the biometric login to your phone anyway and rely on a password. That way, for example, someone can't just hit you on the head to render you unconcious and hold your finger to the sensor. (They would have to force the password out of you whilst you were concious, per XKCD[2] ;-)
[1]https://support.apple.com/en-gb/guide/security/sec067eb0c9e/... [2]https://xkcd.com/538/
if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and creating a fingerprint impression from this will be VERY easy. it takes simple glue and it is very low-cost. you use cyanolate and a gummy bear. the gummy bear will hold the fingerprint while you apply it to the sensor :)
here are a few links : https://blog.kraken.com/product/security/your-fingerprint-ca... https://blog.talosintelligence.com/fingerprint-research/ https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid
fingerprints are a conveniance. they will work at home where you want that phone to be protected from your kid you don't want to be accessing internet too easily.
as a security measure, it's stupid because it is very easy to grab fingerprints : you leave those all around. it is also very easy to just create an impression from a picture with a good quality camera. and once it's compromised, you CANNOT change your fingerprint for another one.
do. not. use. fingerprints. for. security.
Kyrgyzstan also has a similar database but with actual fingerprints, not hashes. It is illegal to not have a passport for anyone 16+ and your cannot have one without fingerprinting. The procedure was introduced by the ruling party to allegedly make elections secure and sponsored by the Japanese government (JAICA).
Who is "we" in this context?
