Ask HN: Does airport fingerprinting compromise my biometric security?

44 points by sampling 2 years ago | 69 comments

I recently went through airport security on an international flight where they recorded my fingerprints.

Like many others, my smartphone can be accessed via biometric fingerprint login to reveal sensitive data such as email.

This got me thinking about the security implications for my smartphone. I'm curious about the potential risks and how secure my data really is after such an interaction. Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?

GuB-42 2 years ago |

You are already putting copies of your fingerprints everywhere, by just touching stuff.

Fingerprints, like all biometrics are not a secret like a password. The point is to assess your physical presence. When used with a phone, your fingerprints are not securing your data, the phone, as a physical device does ("something you have"). The fingerprint is a second factor ("something you are"), a way to make sure the device is in your hands and not someone else's hand.

Security depends on the sensor device. That is, how good it is a making a difference between your actual, live finger and something else.

If you are worried about the security of your phone fingerprint sensor, use a password. Your fingerprint itself is already available to anyone who cares.

cassianoleal 2 years ago | |

I don't buy this.

Fingerprints and other biometrics can be used as both/either "something you are" and "something you have", if we're using the MFA terminology.

With that in mind, a system that required 2 biometrics for access might be as good as a system that requires 2 factors in other forms.

If someone steals my fingerprint from a glass in a bar, it's unlikely they also have a model of my face or a print of my retina, or some other biometric. Or if they do, it's likely they were motivated enough to also know my password/PIN/whatever.

Putting the tech aspects aside, a biometric is identification and authentication rolled into one: you're both saying who you are and proving it at the same time.

tiberious726 2 years ago | | |

This is simply untrue, and anyone who follows this advice will fail a NIST audit: https://csrc.nist.gov/glossary/term/multi_factor_authenticat....

All three factors have different security properties. The big downside of biometric factors is that they can't be replaced when compromised. You can't play language games and say "oh, I technically /have/ fingerprints" and pretend that changes their security properties.

rakoo 2 years ago | |

> The fingerprint is a second factor ("something you are"), a way to make sure the device is in your hands and not someone else's hand.

> Your fingerprint itself is already available to anyone who cares.

In that case your fingerprint can't prove you're here then

Daviey 2 years ago | | |

And this is why multiple factors are essential. It does indicate that you've had proximity to the credentials.

Ie, if I replicated your fingerprints from a drink glass in a bar, I'd likely not know your name (username) or password, which would be the first factor.

Equally if I got your credentials from a dark web leak, I'd not know your biometrics, which would be your second factor.

It isn't foolproof, but it is certainly significantly more secure than just making your password more complex.

That said, I do prefer fingerprints being an identifier (or username) rather than a credential, but as part of an MFA process I feel it adds value.

throwawayqqq11 2 years ago | |

> something you have

Like passkeys, which also cannot reach the secrecy of passwords.

anoopelias 2 years ago |

In India the entire population gave their fingerprint to the government via a massive program called Aadhaar! [1]

This is mandatory for bank accounts, sim cards and what not. So its practically unlivable without Aadhaar these days.

[1] https://uidai.gov.in/en/

asenna 2 years ago | |

It's not just the fingerprints, they have the scan of the retina for the entire population.

It's a disaster waiting to happen.

bayindirh 2 years ago | | |

I'm not sure retina is included in every passport. We're not a member of the EU, but our IDs and passports are compatible.

We have encrypted face biometry and fingerprints on them, but no retina. None of the countries I have visited required my retina scan, either.

In the older versions, some data was unencrypted, and most encryption was optional, and someone built a passport scanner and made a talk. I remember that some heads are proverbially rolled and some specifications are updated.

tiberious726 2 years ago | | |

What retina scanners do they use? I've been trying to get some to do 3FA on high security areas for years and can't find any that seem decent. (Note that iris scanning is completely different than retina scanning, and is just about as useless as face scanning.)

JakubDotPy 2 years ago | | |

India is a disaster already happening.

ghoomketu 2 years ago | |

There was also some (unconfirmed) news article that the whole database is for sale like $5 with millions of records. So if that was true, you can unlock almost any Indian persons phone!

vijaybritto 2 years ago | | |

If I have their biometric data I'm going to hack their bank not their phone

sofixa 2 years ago | |

In the EU, the ID and passport standard includes biometric data (fingerprints, photos), and those are stored on an NFC chip within the document.

6R1M0R4CL3 2 years ago | |

sooner or later, this is gonna hit you so hard in the butt you will feel it in your mouth.

your gvt will deeply regret this move someday. it's beyond stupid.

gorbypark 2 years ago |

I think the real issue would be physical access. With fairly high resolution 3d printers and a copy of your prints, I'm sure a replica of your prints could be created in a matter of minutes. Imagine you are at an airport and customs wants to look at your phone. You refuse to unlock it. Depending on the country, they can compel you to do so. If you refuse to comply, if they have a copy of your prints they could just have a replica printed out. This is why there is usually a way to set your phone into a state where it requires a passcode, which in theory is more legally protected than biometrics (on an iPhone, hold the power button + volume up/down for a second until you get the screen to turn off / make an emergency call. Even if you now hit cancel the phone requires a passcode to unlock).

CableNinja 2 years ago | |

You dont even need anything that advanced. Most biometric scanners can be bypassed with a gummy bear!

https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

gorbypark 2 years ago | | |

Well to be fair, the article is about a guy etching fingerprints into a photosensitive PCB to essentially create a mould, then using gelatine to cast a fingerprint....seems way more advanced than directly printing out replica finger or at least printing out a mould and casting it more or less like the article mentions with gelatine.

eesmith 2 years ago | | |

That was nearly 22 years ago. Does the same attack still work against most modern biometric scanners?

patates 2 years ago |

I'm not a security expert, but as far as I know, the fingerprint should only be used to identify a user (like a username), not authenticate.

Not sure about how much data any entity could leak but if you want to be sure, perhaps you can use a different method on your phone?

> Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock?

I think not, if the third party is a government.

somerandomqaguy 2 years ago |

Probably not worth worrying strictly about the info gathered by airport security unless you're a person of interest, either to that nation or it's allies. If you're that interesting to whoever, all bets are off. Plenty of other ways to get info off phone.

FWIW I really don't recommend just fingerprint for phone access. You can change a PIN if someone else gets a hold of it, there's not much you can do to change your fingerprints.

odyssey7 2 years ago | |

Though the traveler may not be particularly interesting, their employer’s trade secrets or database access might be up there.

somerandomqaguy 2 years ago | | |

Perhaps. I would hope that anyone accessing confidential information on a phone with such flimsy security would understand the risks they're taking.

If not then I'd question what their IT department was doing not forcing a least PIN unlock on the phone.

dzek69 2 years ago |

Fingerprint is never safe. I can just get your phone and it will be all covered with your fingerprints.

It's like sticking a note with a password on your computer :)

Personal protip: I use fingerprint lock, but anything sensitive on my phone is blocked with extra pattern lock. With unlocked phone you can access my gallery but you cannot access bank apps. IIRC this will be the built in feature of next Android, I use Xiaomi smartphone which has many extra security features like this one since basically always. Maybe there is an app for this too, I don't know.

Of course this isn't 100% secure, I probably have USB Debugging unlocked, but at least saves me from a random person just grabbing my phone while I'm on a bus and running away with unlocked phone.

Before anyone asks "But aren't bank apps already locked with their own PIN codes?" - yes, they are. But some forces me to have 4 digits PIN only, some even suggests using fingerprint to unlock them (and for some I do). But I'm also blocking Google Play, a browser where I do the most private stuff, I could block a messenger app. Basic apps does not have extra security features.

euazOn 2 years ago | |

What ROM are you using on your Xiaomi?

dzek69 2 years ago | | |

It should not matter that I'm using Xiaomi.eu ROM, this was available on stock rom too.

But actually you made me think.. So I'm not sure about current models sold in EU, they removed a lot of MIUI features and replaced them with shitty Google alternatives on EU roms. But would they remove such a "deep" feature? It's not "just an app", it's a system core feature to me.

If you have this "Security"/"Control panel" (idk how it's named in English right now) app (the one with green shield icon) this feature should be available to you

throwaway167 2 years ago |

If you're concerned about security, don't have all your sensitive information packed into a phone.

30 years ago much of the population was concerned about typing a credit card number into 'the internet'. Now we have a small, hackable, stealable, insecure by design device with bank, personal communications, business communications, social security, family photos and numerous more data depending on your choice of app. It's a great win of drip-drip very convenient life is faster now (it isn't, there's just more gap for not planning).

helsinkiandrew 2 years ago |

> Does airport fingerprinting compromise my biometric security?

Access by a criminal? probably not much - if they can get physical access to your phone, access to your fingerprint by social manipulation or threat isn't that hard.

Access by government agency that confiscates your phone? theoretically yes, but no more than using printed fingerprints on an arrest record or lifted from your home and printed so they can be used on your phone.

Access by a local sheriff/corrupt cop? a lot of hassle compared with getting access to your finger

lijok 2 years ago |

We’re gonna go full circle back to passwords - mark my words.

whacko_quacko 2 years ago | |

I think 2FA physikal tokens like yubi key will also play a big role.

And honestly, I fear that most people just don't care

rapjr9 2 years ago | | |

Especially most banks and government sites. Why doesn't Social Security and the IRS have Yubi key 2FA?

camillomiller 2 years ago | |

Ok, granpa!

whacko_quacko 2 years ago | | |

This is the insightful commentary that I came to expect of HN /s

number6 2 years ago |

Biometrics are a terrible choice for sensitive information:

* It is easier to push your thumb on a screen than to pry a password out of your head. (relevant XKCD: https://xkcd.com/538/)

* You will leave fingerprints and other biometric features everywhere.

logifail 2 years ago | |

> Biometrics are a terrible choice for sensitive information [..] It is easier to push your thumb on a screen than to pry a password out of your head

It's way worse than that, you may only need photographs of someone's thumb:

https://arstechnica.com/information-technology/2014/12/polit...

CableNinja 2 years ago | | |

You can also just use a gummy bear https://www.theregister.com/2002/05/16/gummi_bears_defeat_fi...

amenghra 2 years ago | |

Depending on jurisdiction, there might be cases where law enforcement can force you to use your biometric to unlock your phone but they can’t force you to reveal your pin. Reality vs what’s technically legal makes this comparison hard (ie consult with a local legal expert).

alkonaut 2 years ago |

The only time I have used fingerprints for flights is for bag drop. That is, the fingerprint verifies that the same person dropping the bag is the one that later boards the flight. In that scenario the fingerprint is not needed after that, and I'm sure there is no regulatory permission to store biometric data for any longer period of time than necessary, which is only until the plane leaves. I haven't seen these systems in a while though so its possible that newer regulation like the GDPR even made them too cumbersome to maintain. Of course there is a risk of compromise in such a system, but if someone wanted your fingerprints specifically it would probably be easier to get them from your car door than hacking an airport system.

Fingerprints for unlocking is not very secure it's just a convenience. Consider it to be equivalent to face unlocking. Anyone who is determined enough will bypass it. Whether it's secure enough depends on your threat model. I trust face unlock to prevent my kids unlocking my phone but that's a whole different kind of threat model from a state actor.

incomingpain 2 years ago |

Fingerprints aren't equivalent to security.

They are at best a quick convenience for perhaps a time logging machine? Where security really isn't a factor.

rwmj 2 years ago |

Spare a thought for people with unreadable fingerprints. Airports & foreign immigration are a continuing pain in the neck.

chatmasta 2 years ago | |

Is this a genetic condition, or caused by trauma like burns?

traceroute66 2 years ago |

> Even if a third party has my biometric fingerprint details, can I rely on how physical access to my phone is necessary to bypass the fingerprint lock

Two points to make:

First, I don't know about Android, but certainly on iPhone, the fingerprint data is stored in the Secure Enclave and the biometric reader on the phone establishes a secure communications channel (unique session key) with the Secure Enclave. So remote attacks are unfeasable unless you've managed to extract the underlying shared key from the Secure Enclave.[1]

Second, the definition of what is "stored". There are a number of different approaches to storing biometric data, and most if not all "modern" methods will store an algorithmic derivation of some sort rather than actual raw measurement data. Hence if the government is using algorithm A and your phone is using algorithm B, then in all likelyhood there is no viable way to transpose between the two.

Third, generally good OPSEC suggests to disable the biometric login to your phone anyway and rely on a password. That way, for example, someone can't just hit you on the head to render you unconcious and hold your finger to the sensor. (They would have to force the password out of you whilst you were concious, per XKCD[2] ;-)

[1]https://support.apple.com/en-gb/guide/security/sec067eb0c9e/... [2]https://xkcd.com/538/

moomin 2 years ago |

There's plenty of reasons to not use fingerprints to unlock an iPhone, just saying.

6R1M0R4CL3 2 years ago |

as far as i know, we do not store fingerprints but i kind of hash of the fingerprint. so if this hash is stolen, it should not be possible to reconstruct the fingerprint "curve points" to use it on your device. but if someone does gain access to your device, i'd say that device is fucked anyway.

if your device is locked with fingerprint, it will be FAR easier to grab your fingerprint from something you touched. and creating a fingerprint impression from this will be VERY easy. it takes simple glue and it is very low-cost. you use cyanolate and a gummy bear. the gummy bear will hold the fingerprint while you apply it to the sensor :)

here are a few links : https://blog.kraken.com/product/security/your-fingerprint-ca... https://blog.talosintelligence.com/fingerprint-research/ https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid

fingerprints are a conveniance. they will work at home where you want that phone to be protected from your kid you don't want to be accessing internet too easily.

as a security measure, it's stupid because it is very easy to grab fingerprints : you leave those all around. it is also very easy to just create an impression from a picture with a good quality camera. and once it's compromised, you CANNOT change your fingerprint for another one.

do. not. use. fingerprints. for. security.

gdsfgfsdg 2 years ago | |

> as far as i know, we do not store fingerprints but i kind of hash of the fingerprint

Kyrgyzstan also has a similar database but with actual fingerprints, not hashes. It is illegal to not have a passport for anyone 16+ and your cannot have one without fingerprinting. The procedure was introduced by the ruling party to allegedly make elections secure and sponsored by the Japanese government (JAICA).

mr_mitm 2 years ago | |

> as far as i know, we do not store fingerprints but i kind of hash of the fingerprint

Who is "we" in this context?