Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Hacker Club Publishes German Official's Fingerprint

Posted by kdawson on Sat Mar 29, 2008 02:50 PM
from the sauce-for-the-goose dept.
Hardware Hacking Privacy
A number of readers let us know about the Chaos Computer Club's latest caper: they published the fingerprint of German Secretary of the Interior Wolfgang Schäuble (link is to a Google translation of the German original). The club has been active in opposition to Germany's increasing push to use biometrics in, for example, e-passports. Someone friendly to the club's aims captured Schäuble's fingerprint from a glass he drank from at a panel discussion. The club published 4,000 copies of their magazine Die Datenschleuder including a plastic foil reproducing the minister's fingerprint — ready to glue to someone else's finger to provide a false biometric reading. The CCC has a page on their site detailing how to make such a fake fingerprint. The article says a ministry spokesman alluded to possible legal action against the club.
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Hacker Club Publishes German Official's Fingerprint 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Respect, respect maan! (Score:4, Insightful)

    by Anonymous Coward on Saturday March 29 2008, @02:53PM (#22906604)
    I'd like to see this done to officials in all countries.

    Reminds me of Gone in 60 seconds (the Jolie version) where one of the car-thieves glues on Elvis' fingerprints.

  • couldn't possibly have negative consequences (Score:4, Interesting)

    by Shadowruni (929010) on Saturday March 29 2008, @02:58PM (#22906636) Journal
    So.... let's see.
    Oh all the people to humiliate... a senior public official who sets policy for something you directly care about.
    This couldn't possibly turn out badly.

    • Re:couldn't possibly have negative consequences (Score:5, Informative)

      by Yokaze (70883) on Saturday March 29 2008, @03:20PM (#22906774)
      Hardly. The CCC is a highly prolific club and is very likely keen on some legal "retaliation", as it would generate even more public attention on that matter.
      Since the Home Secretary stated, that storing fingerprints is no privacy concern, he would be hard pressed to explain his stance.

    • Re:couldn't possibly have negative consequences (Score:4, Insightful)

      by Anonymous Coward on Saturday March 29 2008, @03:22PM (#22906782)
      Since a senior public official still remains a public official, it could probably be defended on the same grounds that allow for political satire. It is expressly allowed in most countries to make fun of political figures, especially if you're doing it from a political standpoint yourself.

      Then again, we also have a new buzzword for crime with ideological motives. It's called terrorism...
    • >> Oh all the people to humiliate... a senior public official who sets policy for something you directly care about. This couldn't possibly turn out badly.

      I love the idea that the way to make politicians do what you want is to be nice to them.

      so apparently Monica Lewinsky was probably about a week away from getting us all free national healthcare, too. Curse you, mainstream media!

  • In future news... (Score:5, Funny)

    by Spartan Niner (1264332) on Saturday March 29 2008, @02:58PM (#22906638)
    We hear that Wolfgang Schäuble is convicted of committing 17 crimes. Simultaneously
    • One can only hope.

      What better way than a senior official to be convicted of crimes as a result of identity theft because officials such as him decided that privacy didn't really matter anymore?

      Personally, I sincerely wish that this happens in all the countries which have fingerprinting in place. Enough already.

        • Re:In future news... (Score:5, Insightful)

          by Znork (31774) on Saturday March 29 2008, @05:09PM (#22907564)
          DNA now that is good, and it is something difficult to duplicate.

          No need to duplicate it, free samples are falling off you everywhere you go. So no, DNA isn't very good either.

          There is however a very good biometric one can use. A neural imprint of a specific token; it currently can't be read without the cooperation of the person, it leaves no imprint around except as the owner desires and controls.

          It's known as a 'password'. A technology that is, perhaps, new and radical, but far more secure than other biometrics. Which, unfortunately, isn't particularly secure, just less insecure than the crap the scam artists of the biometrics industry are trying to push on the gullible.

          • Re:Movies come to mind... (Score:4, Insightful)

            by erroneus (253617) on Saturday March 29 2008, @07:21PM (#22908294) Homepage
            To that, all I'll have to add is that the truth is stranger than fiction.

            It's often rather difficult for people to make an objective assessment of the present especially since causes and facts are often incomplete "now" and often require now to be later before you can look back on now and get a more clear picture, but consider the shocks and fears generated when "1984" was published. Now look at how much farther we have gone beyond 1984's "science fiction" and how we don't even notice it, let alone are alarmed by it.

            Things aren't "getting bad." They ARE bad. Things are getting worse. For all the people out there who think we need to give up privacy and crap like that, you need only look back to your teenage years for why a sense of personal space and privacy is important for people in general. I don't know that there are any studies on the subject, but I'd be willing to place a very large bet on the notion that in societies with less privacy, the suicide rates are likely to be higher. A person's sense of safety is closely tied to their sense of privacy... you only need to sit on a toilet without walls surrounding it once to understand that notion.

    • Re:In future news... (Score:5, Insightful)

      by Naughty Bob (1004174) * on Saturday March 29 2008, @03:18PM (#22906760)

      We hear that Wolfgang Schäuble is convicted of committing 17 crimes. Simultaneously
      17 One-fingered crimes at that...

    • Re:In future news... (Score:5, Funny)

      by evil_aar0n (1001515) on Saturday March 29 2008, @03:47PM (#22906952)
      On the other hand - no pun intended - this might actually work out in his favor, since he _could_ go out and commit a crime, and they'd have to wonder whether the fingerprint evidence was valid or not.

  • Good for them (Score:5, Insightful)

    by Scareduck (177470) on Saturday March 29 2008, @03:00PM (#22906648) Homepage Journal
    High officials often seem to think the consequences of privacy-invading legislation will only occur to other (read: little) people. It's good to remind people in those positions that they do not have absolute power, and that they need to think about second order consequences.

    • Re:Good for them (Score:5, Interesting)

      by swright (202401) <me@nOsPam.shanewright.co.uk> on Saturday March 29 2008, @03:12PM (#22906726) Homepage
      Maybe this is what you meant, but I just think this is the perfect example to illustrate to all how biometrics are just NOT the be-all and end-all. If only for the one simple fact that he cannot change his fingerprint like he could a password that got compromised!

        • Re:Good for them (Score:5, Insightful)

          by IgnoramusMaximus (692000) on Saturday March 29 2008, @03:30PM (#22906842)

          All three easily solved via a security by-pass incentive in a form of a pistol to the head or a kidnapped lover/child/dog etc which will "get it" if you do not cooperate or some poison with time release and the antidote delivered upon your succesful authentication, etc and so on and on and on and on.

          "Ironclad security" does not exist.

          • Re:Good for them (Score:4, Funny)

            by Morten Hustveit (722349) on Saturday March 29 2008, @03:40PM (#22906904) Homepage Journal

            "Ironclad security" does not exist.

            Not even when you completely cover something with iron?

            • Re:Good for them (Score:5, Funny)

              by Plutonite (999141) on Saturday March 29 2008, @04:49PM (#22907396)
              Ironclad Security only exists when you have Chuck Norris on the shift. Do we really have to discuss this?

              • Re:Good for them (Score:4, Insightful)

                by CastrTroy (595695) on Saturday March 29 2008, @09:35PM (#22909010) Homepage
                Just because you can cut the iron, doesn't stop it from being iron. Iron clad doesn't mean inpenetrable, it simple means really hard to penetrate. If you are going to go through the trouble of blowing the door off a bank vault with C4, you can have the money. If you're going to go through the trouble to shoot me for my password, you can have it.

          • Re:Good for them (Score:5, Interesting)

            by aproposofwhat (1019098) on Saturday March 29 2008, @03:44PM (#22906934)
            Two words.

            Duress codes.

            Enter one code to authenticate normally, another to flag up that you are being forced to authenticate.

            Not quite ironclad, but an extra level of safety.

            • Re:Good for them (Score:5, Funny)

              by Matt Perry (793115) on Saturday March 29 2008, @04:11PM (#22907096)

              Enter one code to authenticate normally, another to flag up that you are being forced to authenticate.
              Then they'd have to keep TWO post-it notes under their keyboard.

            • Re:Good for them (Score:5, Interesting)

              by v1 (525388) on Saturday March 29 2008, @05:14PM (#22907600) Homepage Journal
              Those can work against you too. My mom's got a security system in her apartment building, which is also secured. She was in a hurry one day and entered the wrong code to the alarm when she opened her apartment door, and re-entered it and it silenced as it should. 30 minutes later (!!) there's a knock on the door and looking out thru the hole she sees a row of cops lining the hallway all the way to the end, and a guy dressed in a white coat at the door "wanting to talk". She insisted it must be a mistake since the alarm company always calls before sending the cops. not when you enter the hostage code. oops! So they insisted on coming in for a bit and while they chatted with the white-coat, several of the officers methodically swept their place making sure there wasn't a guy with a weapon holding one of the family members hostage in a closet or something. It had taken them over 20 minutes to get someone else to buzz them into the building or they'd have been there a lot sooner.
  • At least until extreme body modification is commonplace, biometrics suck for identification. It's the only modern "security" mechanism that lacks revocation. Without revocation, a security model is eternally broken as soon as one chink is found.

    A person only has 20 digits, 2 palms, 2 soles, 2 retinas, and one genome. All of the biometric properties of those can easily be duplicated with noninvasive methods (simply enrolling in a biometric system requires the same access as duplication would). When one of those 27 properties is compromised, how do you revoke its use? I guess start with the fingers and palms and as people get older they have to start using their feet for identification, and at the very last make them get pricked for each identification. When all the biometric identifiers are used up, the now useless (at least in a Secure(TM) society) people can be recycled in the soylent green program or something.

    • Re:Biometrics: lamest of all security protocols (Score:5, Funny)

      by Fission86 (1070784) on Saturday March 29 2008, @03:28PM (#22906832)

      When one of those 27 properties is compromised, how do you revoke its use?
      Cut it off?

      • Ah, the Yakuza solution. (Score:4, Funny)

        by Chas (5144) on Saturday March 29 2008, @03:37PM (#22906888) Homepage Journal
        Yep. The problem is, what do you do if they compromise multiple sections of your biometric profile?

        Bob: DAN! What the fuck happened to you? You have no arms and not legs.
        Dan: And no testicles either. They took those too.
        Bob: No tes..what happened?
        Dan: Somebody got a copy of my biometric profile. So we had to make changes...
        Bob: But you have no arms and no legs!
        Dan: They even changed my name...
        Bob: They did? What's your name now?
        Dan: Matt

  • No better thant he status quo? (Score:5, Interesting)

    by EaglemanBSA (950534) on Saturday March 29 2008, @03:10PM (#22906714)
    This seems a bit over the top if you ask me, but hopefully it will expose biometrics for what it is: an unchangeable, and in many cases public, password. It's not very easy to hide your fingerprints (or even your DNA, for that matter) from people who really want to find them, and to rely on them for definite identification has the same problems as a social security number. Plus, anyone with a police record would be somewhat compromised from the get go here in the U.S.

    I'd hate to see people get proficient at faking fingerprints, because that leads to all sorts of interesting results in the realm of law. If fingerprint fraud becomes widespread, for example, will fingerprints at a crime scene still be valid evidence in court?

    • I'd hate to see people get proficient at faking fingerprints, because that leads to all sorts of interesting results in the realm of law. If fingerprint fraud becomes widespread, for example, will fingerprints at a crime scene still be valid evidence in court?
      What are you talking about?! It's fantastic.

      I mean, since fingerprints cannot be conclusive anymore, I foresee our politicians with moral fibers of steel pushing for more surveillance. I mean, if we cannot really tell whose fingerprints they are, we certainly need video proof! And since we do not know where a crime may happen, the policy makers (who typically have about as much morality as a pea) have decided that the way around this is to have cameras everywhere. Public restrooms and your house included.

      I mean, think of the children! /cynic

      • Re:No better thant he status quo? (Score:4, Funny)

        by rnt (31403) on Saturday March 29 2008, @03:31PM (#22906844)

        I mean, since fingerprints cannot be conclusive anymore, I foresee our politicians with moral fibers of steel pushing for more surveillance.
        They will also be pushing for a whole new set of copyright laws, giving governments exclusive copyrights on their citizens' fingerprints. Unauthorized copying or publishing of your own fingerprints will be severely punishable!

  • Major flaw of biometrics (Score:5, Insightful)

    by this great guy (922511) on Saturday March 29 2008, @03:10PM (#22906716)

    This event highlights one of the major flaw of biometrics. This official had his fingerprint copied. There is nothing he can do. He can't change it. He can't prevent people from using it. No fingerprint reader will ever be able to determine with 100% certainty whether a particular fingerprint is real or fake. Bottom line: when one of your biometric traits gets stolen, you get screwed. For life.

    I hope this convinces governments that using biometrics for anything is a bad idea (other than perhaps criminal investigations, although what if this german official's fingerprint was found on a murder scene ?).

    • Re:Major flaw of biometrics (Score:4, Funny)

      by Deadstick (535032) on Saturday March 29 2008, @08:47PM (#22908770)
      although what if this german official's fingerprint was found on a murder scene ?

      He tells the cops to RTFA.

      rj

      • Re:Major flaw of biometrics (Score:4, Insightful)

        by BlackCreek (1004083) on Saturday March 29 2008, @04:08PM (#22907062)
        AFAICT the point that the parent poster was making is that unlike other security measures (say ID card, social security number etc) you just can't get a new biometric reading for your fingers (without at least some serious medical intervention), you can't get a new iris scan for your eyes, you can't get a new DNA code etc.

        Biometric data may put some entry barriers higher, so what? The problem is that you just can't get a new iris scan, like you get a new passport once your gets stolen.

        The worst of the situation is that we have all these politicians deciding --without the least form public debate about the real privacy implications-- that biometric data is now to be collected, and used, and kept by the government.

      • Re:Major flaw of biometrics (Score:5, Insightful)

        by BlackCreek (1004083) on Saturday March 29 2008, @04:56PM (#22907442)
        The whole point of the parent poster is apparently lost to you.

        The point being that my biometric data is mine. It is private. It is not the government's business to have my blood samples, or DNA, or finger print. I am not a criminal, and therefore I expect to be entitled to some privacy from the BigBrother.

        Once some retarded government bureaucrat decides to leave a laptop inside a taxi or something, my private data is lost, and I can never get a new fingerprint, or iris scan. I can get a new social security number, I can get a new passport, a new bank account number, but I **cannot** get a new DNA.

  • Legal action? (Score:5, Insightful)

    by HalAtWork (926717) on Saturday March 29 2008, @03:12PM (#22906730)
    The article says a ministry spokesman alluded to possible legal action against the club.
     
    To what ends? You can't deter it as it's already happened, and you can't suppress it, as even the method for tricking the security system is widely known. If the security system is broken, you can't legalize it into working again. The security system was built in order to keep things safe, and now we have to keep other things safe from the security system itself.

  • A perfect demonstration to the perfect person (Score:4, Insightful)

    by smolloy (1250188) on Saturday March 29 2008, @03:15PM (#22906748)
    This is a perfect way to demonstrate to the perfect person why such invasions of privacy are bad, and of the unintended negative consequences of their plans. Sometimes people in power forget that the "solutions" they develop to certain problems may be worse than the problems themselves. All they see is that a certain issue will be fixed -- not that the fix raises even worse issues.

    Bravo!

  • even worse (Score:4, Informative)

    by ILuvRamen (1026668) on Saturday March 29 2008, @03:22PM (#22906788)
    You don't have to go to any special measures really to do this. I mean plastic and all those synthetic rubber moulds and stuff that the average person couldn't do is a bit excessive. Remember on mythbusters when they tried to beat that "unbeatable" fingerprint lock on a door and managed to do it by printing off the fingerprint with a laser printer and licking it? Yeah, biometrics is a joke. And really good biometrics like DNA aren't practical or fast and the retina scan, well you do that every day for a year and see if you don't go partically blind. I can't care hoe safe they think it is. Facial recognition is pretty useless and easy to beat too. Until they find something that's 100% unique and fast and accurate, they should forget about biometics.
  • I wonder if anyone has actually tried making such a fingerprint copy, and then using it on a fingerprint reader like the ones on laptops etc.

    Do you really get a good enough copy? How hard is it? (After all, any security can be broken somehow. So an essential aspect is the "cost" of breaking the security)

    • I wonder if anyone has actually tried making such a fingerprint copy, and then using it on a fingerprint reader like the ones on laptops etc.

      As a matter of fact, Yes. [slashdot.org]

    • Yes, fingerprint readers are easily screwed. (Score:4, Informative)

      by Flu (16236) on Saturday March 29 2008, @03:48PM (#22906962) Homepage
      Yes, this was done a couple of years ago in Sweden as a Master Thesis, which was described in Swedish Engineering paper Ny Teknik http://www.nyteknik.se/efter_jobbet/kaianders/article32986.ece [nyteknik.se] (sorry, swedish only). The student Marie Sandström tested a simple yello, which was created using the same method as mentioned in the article above, on three commercial fingerprint-readers on the CeBit fair in 2004.
    • It doesn't seem hard at all at a 'normal' reader (see Mythbusters [youtube.com] episode.

      The high-end, ridicilously expensive fingerprint readers are a lot harder to crack though; But I wouldn't say uncrackable.
    • I think the only working model is the concept of security in layers. The more layers an attacker has to dig through to compromise a systems security the more secure that system is. Biometrics alone are pretty weak. Passwords alone are pretty weak. Use them together and they're a little less weak. The biggest obstacle is the user. Will they put up with multiple security checks? Can they remember a good password? Will they notice where they're leaving behind fingerprints or if someone is trying to record their voice?

      In the end you have to be realistic with your expectations for any security system. We lock our front door when we leave our house but we all know that someone that wants to get in can still get in if they want to try hard enough. When you lay in bed at night you have no way to be sure that a stranger hasn't secretly entered your home and is waiting to cut your throat in the dark. Yet we make a bigger deal over how secure access to your bank account and other sensitive information is. At some point you just have to say enough and go on with your life.

    • Re:Has anyone tried this on a fingerprint reader? (Score:4, Informative)

      by Chris Pimlott (16212) on Saturday March 29 2008, @04:22PM (#22907194)

      wonder if anyone has actually tried making such a fingerprint copy, and then using it on a fingerprint reader like the ones on laptops etc.

      Do you really get a good enough copy? How hard is it? (After all, any security can be broken somehow. So an essential aspect is the "cost" of breaking the security)
      Already been done. here's a video demonstration [youtube.com], again courtesy of our friends at CCC. Just takes a digital camera, a bit of wood glue, a bottlecap, a transparency and a bit of skin-friendly glue to apply the fake to your finger.

  • isn't biometric authentication a good thing? (Score:4, Interesting)

    by sentientbrendan (316150) on Saturday March 29 2008, @03:45PM (#22906948)
    Everyone knows that biometric data can be stolen, just like every other means of identifying yourself. I thought the point of biometric data was that it added one *more* piece of data that would have to be stolen before someone could successfully impersonate you.

    So in addition to needing to know a pin or password, someone also needs to have stolen my fingerprint in order to take money out of my bank account. Isn't this what is called two factor authentication? Isn't that a good thing that makes it that much more difficult to steal an identity?

    According to this article Germany's new passports:
    http://www.itsmig.de/best_practices/ePass_en.php [itsmig.de]

    they contain both fingerprint data, and a picture of the person. Thus, to steal your identity, a person would have to steal your passport, look like you, and also steal your fingerprint. This actually seems like a pretty good system that would prevent someone from using a stolen passport to steal the rightful owners identity. Without the fingerprint data, an identity theft doesn't need to do as much work.

    That said, I'm not from germany, so maybe there additional nuances about this thing that I'm missing.

    • Everyone knows that biometric data can be stolen, just like every other means of identifying yourself.

      Part of the problem is that you (and many other people) seem to think authentication is the same as identification. It's not. Biometrics are awesome as part of two-factor authentication, but they're horrible as a means of identifying yourself.

      Identification is the problem of determining, on your own, the identity of a given person.

      Authentication is the problem of determining whether or not a given identity corresponds to a given person.

      The difference is that, in authentication, you are given both a single person and a single identity, and your job is to answer true or false as to whether they match. Authentication is a yes/no question: your answer is either yes or no. In identification, you are given only a person, and your job is to produce a matching identity. Identification is not usually a yes/no question, although in some cases it can be disguised as one -- for example: to answer "Is this person a terrorist?" you typically have to determine a person's true identity (which a terrorist is not likely to offer to you) and then check that identity against known terrorist databases.

      National governments are fully aware of this distinction, and they exploit public confusion to further their agenda. Biometrics are being advertised as authentication tools (does this passport accurately identify this person?), for which they work pretty well, but in reality governments are using biometrics for identification (is this person a terrorist?), an approach which has fail written all over it.

      Even for authorization, biometrics are not a panacea, but they are at least a useful tool capable of contributing some benefits when employed properly. For identification, biometrics are an unmitigated disaster, for many reasons, chief among them the base rate fallacy [wikipedia.org], which says that the accuracy of an identity test drops precipitiously when the test is presented with large databases of identities.

  • Perfect alibi (Score:5, Interesting)

    by oever (233119) on Saturday March 29 2008, @04:09PM (#22907078) Homepage
    Mister Schauble can enjoy an easy career as burglar when he's out of office. With 4000 copies of your fingerprint circulating, it cannot be used as evidence any more.

    The only thing dumb thing he could get caught with is when he leaves wheelchair tracks [wordpress.com] at the scene of the crime.

  • There actually *are* things to like about Germany (Score:5, Interesting)

    by Qbertino (265505) on Saturday March 29 2008, @05:13PM (#22907586)
    The CCC is one of the things I like about Germany. It highlights a major element of german-style citizen-culture. It's clearly opposed to uncontrolled gouverment and any notion of a police-state. It has a taste of anarchy to it and on its fringes it has inofficial members with ties to the black-hat community. Yet it is a well organised official registered German association that speaks up on behalf of the people and democracy. With a 27-year tradition of keeping the public political debate alive on IT related rights-issues by perpetually coming up with creative ways of gaining attention. This recent 'Schäuble-Fingerprint' stunt being one of them. I don't know if they've exposed their selves with legal liability by doing this (after all it was officially published in their magazine 'Datenschleuder') but it sure is as funny, hilarious and exposing as ever. Creative non-sense at its best. Go, CCC!

    • Re:Brave defenders of freedom (Score:5, Insightful)

      by Anonymous Coward on Saturday March 29 2008, @03:18PM (#22906758)
      At least they get off their asses unlike American's who cry about the Constitution but do fuck all about it.

      Bush was right, it is JUST a piece of PAPER. Why? Because American's do NOTHING about it and do not believe in it.

      This is plain to see by their inactions.

        • Re:T-shirt (Score:5, Interesting)

          by AJWM (19027) on Saturday March 29 2008, @05:57PM (#22907856) Homepage
          My kids were watching the Scooby-Doo 2 movie the other day. There's a scene where Daphne activates a fingerprint activated lock by dusting the scanner with blush powder (highlighting the latent fingerprint from its last use) then using a pore-strip over her own finger to provide the right body temperature/capacitance/whatever without her fingerprint confusing the sensor.

          I was amused to see that the technology's weaknesses had made it to the Scooby-Doo level already. I don't know if that exact combination would work, but I've heard of similar successful attacks.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.