http://www.forbes.com/sites/thomasbrewst...3c7d398d9d

Quote:Feds Walk Into A Building, Demand Everyone's Fingerprints To Open Phones


In what’s believed to be an unprecedented attempt to bypass the security of Apple iPhones, or any smartphone that uses fingerprints to unlock, California’s top cops asked to enter a residence and force anyone inside to use their biometric information to open their mobile devices.

To me, this represents the death of biometrics as the superior option for private citizens. For one ... you can never reset a biometric if it is stolen. The device has to digitally store your biometric data in SOME WAY to compare against. Well when that digital representation is stolen ... you're permanently boned. Secondly ... it's impossible to deny the government access to your biometrics. They can just as well drug you and get your iris/fingerprint/dna while you're out. And lastly ... there is no plausible deniability. With some password security systems, there exists a possibility to setup a double password. One password works ... but shows less sensitive info. It provides no way of knowing there is a second password that unlocks the real hidden material. And there is no way to prove a second password even exists. Plausible deniability.

(10-17-2016 06:20 PM)georgia_tech_swagger Wrote:  http://www.forbes.com/sites/thomasbrewst...3c7d398d9d

Quote:Feds Walk Into A Building, Demand Everyone's Fingerprints To Open Phones


In what’s believed to be an unprecedented attempt to bypass the security of Apple iPhones, or any smartphone that uses fingerprints to unlock, California’s top cops asked to enter a residence and force anyone inside to use their biometric information to open their mobile devices.

To me, this represents the death of biometrics as the superior option for private citizens. For one ... you can never reset a biometric if it is stolen. The device has to digitally store your biometric data in SOME WAY to compare against. Well when that digital representation is stolen ... you're permanently boned. Secondly ... it's impossible to deny the government access to your biometrics. They can just as well drug you and get your iris/fingerprint/dna while you're out. And lastly ... there is no plausible deniability. With some password security systems, there exists a possibility to setup a double password. One password works ... but shows less sensitive info. It provides no way of knowing there is a second password that unlocks the real hidden material. And there is no way to prove a second password even exists. Plausible deniability.

Thanks for sharing. I think you're right, biometrics will prove less secure than cryptography or passwords.

Bumpity

Related article I read the other day

https://www.nraila.org/articles/20161014...r-concerns

Quote:As part of his executive gun-control fixes, President Obama has endorsed so-called “smart” gun technology on the premise that if “you can’t unlock your phone unless you’ve got the right fingerprint, why can’t we do the same thing for our guns?”

Never mind that smartphone technology is currently far from infallible. A fingerprint ID feature is liable to fail when it is cold outside, or when fingers are sweaty, wet or dirty. Smartphone engineers continue to wrestle with more general performance and safety concerns, like inexplicably exploding phones.

It’s not particularly surprising, then, that a “smart” gun recently showcased revealed some of the same failings. A prototype using a Glock 22, developed by 19-year-old inventor Kai Kloepfer, has a biometric fingerprint sensor, similar to the one in a smartphone, built into the grip and aligned to approximately where the shooter’s middle finger would rest. The prototype takes approximately a second and a half to recognize a fingerprint and unlock the gun. In order for the gun to continue to be available to fire, the shooter’s finger has to remain aligned with the sensor. The sensor can’t recognize a wet fingerprint, and the gun isn’t designed to work for persons with dirty hands or who are wearing gloves. The modifications to the gun also mean that the magazine capacity is downsized from 15 rounds to nine. All of these raise concerns about the viability of the gun as a weapon in a critical defensive use situation.

Quote:The NRA doesn’t oppose technological advances and has never opposed “smart” guns or the ability of consumers to make their own choices. What it doesn’t support – in common with the vast majority of Americans – is government mandates that impose expensive and unreliable technology on the buying public as a matter of law.

Both of the major parties want to corner the market as being the party that champions national security. Therefore, regardless of who holds office the march will be to take your data whether overtly or covertly. GWB's administration with the Patriot Act and Obama's FBI forcing residents to unlock their phones with their fingerprints. Frankly, I never understood why biometrics got such a huge push in the first place. At least a code can be locked away in your head and you could simply refuse to give up your passwords. The biometrics, OTOH, are easy to circumvent because a LEO can simply force you to put your fingerprint on the unlock screen.

ETA: A mugger can do the same thing if you had anything else protected thru biometrics.

I remember when I worked at a grocery store. They tried to role out a pay by touch feature where you could put your index finger on a pad that was linked to be credit card. It failed miserably as no one wanted to use it

swagger,

If you're going to claim that the device must store a local copy of the biometric password, then how can you claim it is impossible to prove that a sudo password (for lack of better term) exists?


miko,

I would just think for convenience, more than anything. You never have to remember the configuration of your fingerprint.

(10-18-2016 01:13 PM)Kaplony Wrote:  Related article I read the other day

https://www.nraila.org/articles/20161014...r-concerns

Quote:As part of his executive gun-control fixes, President Obama has endorsed so-called “smart” gun technology on the premise that if “you can’t unlock your phone unless you’ve got the right fingerprint, why can’t we do the same thing for our guns?”

Never mind that smartphone technology is currently far from infallible. A fingerprint ID feature is liable to fail when it is cold outside, or when fingers are sweaty, wet or dirty. Smartphone engineers continue to wrestle with more general performance and safety concerns, like inexplicably exploding phones.

It’s not particularly surprising, then, that a “smart” gun recently showcased revealed some of the same failings. A prototype using a Glock 22, developed by 19-year-old inventor Kai Kloepfer, has a biometric fingerprint sensor, similar to the one in a smartphone, built into the grip and aligned to approximately where the shooter’s middle finger would rest. The prototype takes approximately a second and a half to recognize a fingerprint and unlock the gun. In order for the gun to continue to be available to fire, the shooter’s finger has to remain aligned with the sensor. The sensor can’t recognize a wet fingerprint, and the gun isn’t designed to work for persons with dirty hands or who are wearing gloves. The modifications to the gun also mean that the magazine capacity is downsized from 15 rounds to nine. All of these raise concerns about the viability of the gun as a weapon in a critical defensive use situation.

Quote:The NRA doesn’t oppose technological advances and has never opposed “smart” guns or the ability of consumers to make their own choices. What it doesn’t support – in common with the vast majority of Americans – is government mandates that impose expensive and unreliable technology on the buying public as a matter of law.

I have no problems with biometrics on firearms...let the free market decide. I have no interest in ever having it on mine but if other people want it, make it an option that is priced accordingly.

Also, I'm not sure if I accept the baseline premise that while you can never 100% "hide" your bio password, that you in theory could refuse to divulge your virtual password.

Some combination of torture or drugs, is going to make you crack.

(10-18-2016 01:36 PM)rath v2.0 Wrote:  

(10-18-2016 01:13 PM)Kaplony Wrote:  Related article I read the other day

https://www.nraila.org/articles/20161014...r-concerns

Quote:As part of his executive gun-control fixes, President Obama has endorsed so-called “smart” gun technology on the premise that if “you can’t unlock your phone unless you’ve got the right fingerprint, why can’t we do the same thing for our guns?”

Never mind that smartphone technology is currently far from infallible. A fingerprint ID feature is liable to fail when it is cold outside, or when fingers are sweaty, wet or dirty. Smartphone engineers continue to wrestle with more general performance and safety concerns, like inexplicably exploding phones.

It’s not particularly surprising, then, that a “smart” gun recently showcased revealed some of the same failings. A prototype using a Glock 22, developed by 19-year-old inventor Kai Kloepfer, has a biometric fingerprint sensor, similar to the one in a smartphone, built into the grip and aligned to approximately where the shooter’s middle finger would rest. The prototype takes approximately a second and a half to recognize a fingerprint and unlock the gun. In order for the gun to continue to be available to fire, the shooter’s finger has to remain aligned with the sensor. The sensor can’t recognize a wet fingerprint, and the gun isn’t designed to work for persons with dirty hands or who are wearing gloves. The modifications to the gun also mean that the magazine capacity is downsized from 15 rounds to nine. All of these raise concerns about the viability of the gun as a weapon in a critical defensive use situation.

Quote:The NRA doesn’t oppose technological advances and has never opposed “smart” guns or the ability of consumers to make their own choices. What it doesn’t support – in common with the vast majority of Americans – is government mandates that impose expensive and unreliable technology on the buying public as a matter of law.

I have no problems with biometrics on firearms...let the free market decide. I have no interest in ever having it on mine but if other people want it, make it an option that is priced accordingly.

Same here, and as posted above that is and has been the NRA's stance for as long as I can remember. But if you ask the anti-gun left the NRA and gun rights supporters are opposed to "smart guns".

Rath,

Then perhaps you'll have to hand-make your own ammo? IE, if all store bought ammo will only fire on guns with biometrics enabled?

That's how my office email works on my phone. It won't open unless it detects the 'password' feature on the phone. Gonna be expensive on 300mm guns that don't have such features.

We gonna do 'cash for clunkers'? Billions for Barettas? Gold for Glocks?

(10-18-2016 01:40 PM)MplsBison Wrote:  Rath,

Then perhaps you'll have to hand-make your own ammo? IE, if all store bought ammo will only fire on guns with biometrics enabled?

I already reload all of my ammo except what I use in my Mosin Nagant and my deer rifle. If Mosin surplus ammo wasn't so cheap and if I could build a round that performs as good as the Hornaday ammo in my deer rifle I would load them too.

Reason biometrics will never take hold under the current technology...how many on here have attempted to use your thumb to open your phone and it didn't work on the first attempt? Right...cops are going to put their lives on the line on that? Sure as hell most citizens won't.

As far as ammo, not happening either. Besides, I have enough to use at my normal range, SD and hunting usage to last me 10-12 years. Anyone who does not stock up or hand load is naive. Shelves are going to look like an empty Bulgarian Cold War bread shop on November 9th. Worse come January.

Oh yeah, I buy all of my ammo and supplies from online retailers and save a ton on a better selection of product at case discounts. I love that progressives get all hot and bothered about that.

(10-18-2016 01:34 PM)MplsBison Wrote:  If you're going to claim that the device must store a local copy of the biometric password, then how can you claim it is impossible to prove that a sudo password (for lack of better term) exists?

False analogy. Sudo is a Linux tool to execute something with root ("God") privileges despite being launched from a privilege restricted user account.

I'm talking about double passwords. If you'd like to see it in action ... look at how TrueCrypt works. There is no force ON EARTH that can crack a triple encrypted double container TrueCrypt volume. And it's the double container that gives you a double password with plausible deniability.

Maybe Im just old..but..I dont trust any of this schit for one second. That is why I have ONE credit card with a $1000 limit and pay for every damn thing else with cash or paper check. Fck any business that won't take my check. I don't even have a debit card. I don't trust that schit either. I'm that guy you all hate to get behind in the checkout line....and don't give a damn.

swagger,

My point had nothing to do with encryption. My point is: if they were able to coerce the first password out of you, why won't they be able to force the second password out of you with the same torture/drugs?? You're saying they're just going to say "shoot, we can't see inside that container ... guess we'll give up"?? No, they'll say "put in your key that opens that container".