Advantages of fingerprint sign in on cell phone?

[markn_1]

I tried in on my Galaxy S6 for a few weeks. It worked for me about 75% of the time. Other times it would require multiple attempts. If my finger was slightly damp, like after washing my hands, it wouldn’t work at all. I decided it was not worth the trouble and turned it off. It takes a fraction of a second to enter an unlock pattern. YMMV.

–Mark

[Donnerwetter]

Marc Rogers, intelligence expert and current Principal Security Researcher at Lookout Mobile Security told the Huffington Post that sensors can provide a convenient way to unlock gadgets while also boosting security. Though he also warns that in extreme cases thieves have mutilate victims to gain access to fingerprint enabled devices. “Thieves in some regions have worked out that you can force a victim to unlock a secured device, and in some extreme cases have also mutilated victims in order to steal their fingerprint,” he said.

In 2005, BBC News reported that car thieves in Malaysia cut off the owner’s index finger with a machete because the car, a Mercedes S-class, was protected by a fingerprint recognition system. But thieves need not resort to hacking off fingers to bypass fingerprint protected devices. There are way to lift and duplicate prints with technology that “is only going to improve with time,” Rogers said.

http://www.idigitaltimes.com/iphone-5s-fingerprint-sensor-brings-fears-thieves-will-sever-fingers-gain-access-smartphones-363794

[lazybratsche]

FWIW, even though I have a Nexus 5x that I unlock with my fingerprint, once a day or so it asks for the PIN to unlock it. That provides a reasonable degree of protection against attacks by fake fingerprints, as well as any government-compelled fingerprint unlocks.

It doesn’t protect me against getting my finger chopped off by muggers, but in my mind that risk is filed somewhere between “getting struck by lightening” and “killer penguin attack at the zoo”. Possible, yes, but so rare as to be not worth worrying about.

[SpeedwayRyan]

@Arcite

Yeah, the disadvantage is that it doesn’t work. I have this feature turned off on both my Samsung Galaxy S6, and my Ipad. When I first register my fingerprint, it works, but its ability to recognize my fingerprint somehow decays over a few days, so that I have to re-register it.

As a counterpoint, I’ve used the feature on my last two iPhones and have never once had this problem, and I’ve never had to re-register/setup the fingerprint scan.

On an unrelated note, I always scan both thumbs and both index fingers at a minimum…that way it works in either hand, works when sitting on a table or holding something and an index finger is more convenient than a thumb, etc. Takes a couple of minutes up front and makes it even more convenient to use.

[pidgeon92]

I use it on my iPhone 6. It was one of the main reasons I upgraded from my previous iPhone. so much easier than entering the 4-digit (now 6-digit) code. The only time it fails for me is if my hands are a bit wet.

[carnivorousplant]

@beowulff

Has this ever happened?

It worked for that guy on 24.

[Donnerwetter]

@lazybratsche

“killer penguin attack at the zoo”.

strikes “visit to the zoo” from summer activities list

[Atamasama]

For most thieves a phone’s value is in reselling/pawning the physical phone, not getting data off of it.

Given that my phone won’t recognize my print if my thumb is slightly dirty, or wet, or has swollen/shrunk in hot/cold weather or after a shower I have doubts that it would work very well after someone has chopped or ripped it off my hand.

[NeonMadman]

@Arcite

Yeah, the disadvantage is that it doesn’t work. I have this feature turned off on both my Samsung Galaxy S6, and my Ipad. When I first register my fingerprint, it works, but its ability to recognize my fingerprint somehow decays over a few days, so that I have to re-register it.

I have the same problem with my iPad. I’m getting a new iPhone SE any day now, so we’ll see if I can get it to work on that.

[ftg]

@iamthewalrus_3

Heh. Unless you wear gloves when you use your smartphone, no one has to hack your phone to get your fingerprints. They’re all over the screen!

If the miscreant is in Russia, it’s kind of hard to take prints off the screen.

Fingerprints, unlike passwords, when stored on a phone are an ID hazard. They cannot be encrypted due to the need to be able to approximately match a print.

If you work at a facility that also uses fingerprints for access, these kind of phones are a prime target for people trying to break into the site. All the initial prep can be done securely from home. They only have to take a real risk during the actual break-in.

Imagine coming in on Monday to find that a ton of stuff was stolen from your employer and you were the only one to access the building during the time.

[rbroome]

@Arcite

Yeah, the disadvantage is that it doesn’t work. I have this feature turned off on both my Samsung Galaxy S6, and my Ipad. When I first register my fingerprint, it works, but its ability to recognize my fingerprint somehow decays over a few days, so that I have to re-register it.

I have had my iPhone 6 since they came out. I have never had to register my fingerprint. My wife has her print encoded in the phone and she uses that feature about once every six months. Never had a problem.

[beowulff]

@ftg

If the miscreant is in Russia, it’s kind of hard to take prints off the screen.

Fingerprints, unlike passwords, when stored on a phone are an ID hazard. They cannot be encrypted due to the need to be able to approximately match a print.

If you work at a facility that also uses fingerprints for access, these kind of phones are a prime target for people trying to break into the site. All the initial prep can be done securely from home. They only have to take a real risk during the actual break-in.

Imagine coming in on Monday to find that a ton of stuff was stolen from your employer and you were the only one to access the building during the time.

This sounds like a “thought experiment.”
Has this type of break-in ever occurred?

[Clark_Cello]

@Tom_Tildrum

If it gets hacked, then the hackers have your fingerprint, yes?

Not really. The phone ins’t storing a picture of your fingerprint, or anything like that, it is storing a mathematical representation of your fingerprint. For a hacker to get from that to your fingerprint is very, very difficult.

As far as the OP, I use Touch ID on an iPhone, and love it. Not having to enter in my pass code every time is nice. Even better, though, is integration with apps. Not having to enter in my bank password or things like that is really, really nice.

I have never had problems with it working. It is fast and dependable, with the occasional exception of when my fingers are especially wet.

[rbroome]

@ftg

If the miscreant is in Russia, it’s kind of hard to take prints off the screen.

Fingerprints, unlike passwords, when stored on a phone are an ID hazard. They cannot be encrypted due to the need to be able to approximately match a print.

If you work at a facility that also uses fingerprints for access, these kind of phones are a prime target for people trying to break into the site. All the initial prep can be done securely from home. They only have to take a real risk during the actual break-in.

Imagine coming in on Monday to find that a ton of stuff was stolen from your employer and you were the only one to access the building during the time.

I’m sorry, but this post makes no sense. Perhaps you would care to review and rewrite? The information in an iPhone isn’t compatible or accessible for any other fingerprint reader. Apple bought the company that developed the sensor and that is the only use for that technology now.
FWIW, the fingerprint information on an iPhone is stored in a secure encoded location in static memory that can only be accessed by the phone’s security routines. There is no OS access at any level, if Apple had your phone, they could not access the fingerprint information. There are no hacks, low-level readers or anything else that can access the actual data encoding the fingerprint. When you unlock your phone, the scanner can only ask the security routine if there is a match. If yes, it unlocks. No software can access the actual fingerprint information. Admittedly, these statements are based on what Apple says, but they have every reason to tell the truth and every reason to fear being caught in a lie.

All that said, it has been easily and repeatedly demonstrated that given a copy of your fingerprint from another source (as has been stated, the glass face of the iPhone is a good source), a copy of the fingerprint can easily fool the sensor. So the scanner isn’t a particularly secure method of securing the phone, but it is convenient and far better than the average passcode. But the information encoding the fingerprint inside the phone is as secure as anyone can make it.

[Wolf333]

@ftg

If the miscreant is in Russia, it’s kind of hard to take prints off the screen.

Fingerprints, unlike passwords, when stored on a phone are an ID hazard. They cannot be encrypted due to the need to be able to approximately match a print.

If you work at a facility that also uses fingerprints for access, these kind of phones are a prime target for people trying to break into the site. All the initial prep can be done securely from home. They only have to take a real risk during the actual break-in.

Imagine coming in on Monday to find that a ton of stuff was stolen from your employer and you were the only one to access the building during the time.

Underlining mine…

From Apple:

Touch ID doesn’t store any images of your fingerprint. It stores only a mathematical representation of your fingerprint. It isn’t possible for someone to reverse engineer your actual fingerprint image from this mathematical representation. The chip in your device also includes an advanced security architecture called the Secure Enclave which was developed to protect passcode and fingerprint data. Fingerprint data is encrypted and protected with a key available only to the Secure Enclave.

About Touch ID advanced security technology - Apple Support

[Chronos]

They say that the best security is based on three factors, something you have (like a key or a dongle), something you know (like a password or a combination), and something you are (like a fingerprint or retina scan). A fingerprint is (currently) the easiest to implement in that last category.

[Senegoid]

I’ve also seen it pointed out that, if your fingerprint gets hacked, you can’t just change it like you can change your password. You’re stuck with it forever, and if it’s hacked, the hacker has it forever too.
\

[beowulff]

@Senegoid

I’ve also seen it pointed out that, if your fingerprint gets hacked, you can’t just change it like you can change your password. You’re stuck with it forever, and if it’s hacked, the hacker has it forever too.
\

…and?
What good does it do them?

[SeaDragonTattoo]

@scr4

Works fine on my Galaxy S6. I think the important thing is to hold the phone the same way when you register your fingerprint & when you unlock it every time. This makes sure the same part of your thumb gets scanned. The sensor is fairly small.

The downside is it doesn’t work with gloves on.

I have a GS6 too, and same. I have both thumbs and forefingers in the memory. The only time I had to redo the scans was after a major OS upgrade.

[markn_1]

Here’s an essay by Bruce Schneier, a leading security researcher, on using fingerprints for ID:

If Apple's iPhone Has Fingerprint Authentication, Can It Be Hacked?

One of his key points is “Your fingerprint isn’t a secret; you leave it everywhere you touch.”

And a followup a few months later describing how the iPhone fingerprint reader was successfully hacked:
https://www.schneier.com/blog/archives/2013/09/apples_iphone_f.html

–Mark