Hacker Club Publishes German Official's Fingerprint 253
A number of readers let us know about the Chaos Computer Club's latest caper: they published the fingerprint of German Secretary of the Interior Wolfgang Schäuble (link is to a Google translation of the German original). The club has been active in opposition to Germany's increasing push to use biometrics in, for example, e-passports. Someone friendly to the club's aims captured Schäuble's fingerprint from a glass he drank from at a panel discussion. The club published 4,000 copies of their magazine Die Datenschleuder including a plastic foil reproducing the minister's fingerprint — ready to glue to someone else's finger to provide a false biometric reading. The CCC has a page on their site detailing how to make such a fake fingerprint. The article says a ministry spokesman alluded to possible legal action against the club.
Respect, respect maan! (Score:4, Insightful)
Reminds me of Gone in 60 seconds (the Jolie version) where one of the car-thieves glues on Elvis' fingerprints.
Re:Respect, respect maan! (Score:4, Insightful)
Re:Respect, respect maan! (Score:5, Funny)
Re: (Score:3, Funny)
Re:Respect, respect maan! (Score:5, Insightful)
Re:Respect, respect maan! (Score:5, Insightful)
Re:Respect, respect maan! (Score:4, Informative)
China is a pathetically low standard to compare to.
Wait, godwin is that you???
You're a moron.
Yep! Really, really well done! (Score:3, Interesting)
Re: (Score:3, Insightful)
Yup, fingerprints are extremely weak security checks since a normal person leaves hundreds of prints behind them every day.
gag (Score:2, Funny)
couldn't possibly have negative consequences (Score:4, Interesting)
Oh all the people to humiliate... a senior public official who sets policy for something you directly care about.
This couldn't possibly turn out badly.
Re:couldn't possibly have negative consequences (Score:5, Informative)
Since the Home Secretary stated, that storing fingerprints is no privacy concern, he would be hard pressed to explain his stance.
Re: (Score:2)
Estoppel sounds more like the defense for the CCC, not for the Home Secretary.
Re:couldn't possibly have negative consequences (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Re:couldn't possibly have negative consequences (Score:4, Insightful)
Then again, we also have a new buzzword for crime with ideological motives. It's called terrorism...
Re:couldn't possibly have negative consequences (Score:5, Funny)
I love the idea that the way to make politicians do what you want is to be nice to them.
so apparently Monica Lewinsky was probably about a week away from getting us all free national healthcare, too. Curse you, mainstream media!
don't see a downside (Score:2)
In future news... (Score:5, Funny)
Re:In future news... (Score:5, Insightful)
What better way than a senior official to be convicted of crimes as a result of identity theft because officials such as him decided that privacy didn't really matter anymore?
Personally, I sincerely wish that this happens in all the countries which have fingerprinting in place. Enough already.
Re: (Score:2)
Re: (Score:3, Insightful)
I make DNA all day in the lab. It's getting easier and cheaper to make every year.
DNA isn't going to turn out to be any more of a panacea than fingerprints.
Re:In future news... (Score:5, Insightful)
No need to duplicate it, free samples are falling off you everywhere you go. So no, DNA isn't very good either.
There is however a very good biometric one can use. A neural imprint of a specific token; it currently can't be read without the cooperation of the person, it leaves no imprint around except as the owner desires and controls.
It's known as a 'password'. A technology that is, perhaps, new and radical, but far more secure than other biometrics. Which, unfortunately, isn't particularly secure, just less insecure than the crap the scam artists of the biometrics industry are trying to push on the gullible.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
I dunno, DNA wants to duplicate, although that's not what you meant.
In terms of different individuals having the same DNA, talk to identical twins. About all DNA tests can really do is disprove that someone with non-matching DNA is guilty. DNA "matches" don't compare 100% of the DNA (even if they did, that doesn't rule out twins), and close relatives may well "match" also (and the fewer comparison points, the less-close the relative that cou
DNA has the same problem as fingerprints... (Score:3, Interesting)
The only way to be sure you're looking at the right DNA is to stick a needle into a person and take a sample from deep inside them...
Most biometric systems are junkware being pushed by people who are after the lucrative government contracts. The bottom line is they don't reall
Re: (Score:2)
Re:Movies come to mind... (Score:4, Insightful)
It's often rather difficult for people to make an objective assessment of the present especially since causes and facts are often incomplete "now" and often require now to be later before you can look back on now and get a more clear picture, but consider the shocks and fears generated when "1984" was published. Now look at how much farther we have gone beyond 1984's "science fiction" and how we don't even notice it, let alone are alarmed by it.
Things aren't "getting bad." They ARE bad. Things are getting worse. For all the people out there who think we need to give up privacy and crap like that, you need only look back to your teenage years for why a sense of personal space and privacy is important for people in general. I don't know that there are any studies on the subject, but I'd be willing to place a very large bet on the notion that in societies with less privacy, the suicide rates are likely to be higher. A person's sense of safety is closely tied to their sense of privacy... you only need to sit on a toilet without walls surrounding it once to understand that notion.
Re:In future news... (Score:5, Insightful)
Re: (Score:2, Funny)
Re:In future news... (Score:5, Funny)
Re: (Score:2, Insightful)
Good for them (Score:5, Insightful)
Re:Good for them (Score:5, Interesting)
Re:Good for them (Score:5, Insightful)
All three easily solved via a security by-pass incentive in a form of a pistol to the head or a kidnapped lover/child/dog etc which will "get it" if you do not cooperate or some poison with time release and the antidote delivered upon your succesful authentication, etc and so on and on and on and on.
"Ironclad security" does not exist.
Re:Good for them (Score:4, Funny)
Not even when you completely cover something with iron?
Re: (Score:2)
Re: (Score:2)
Re:Good for them (Score:4, Insightful)
Re:Good for them (Score:5, Funny)
Re:Good for them (Score:5, Interesting)
Duress codes.
Enter one code to authenticate normally, another to flag up that you are being forced to authenticate.
Not quite ironclad, but an extra level of safety.
Re: (Score:2)
The criminal still has a gun pointed at you or your family.
Re: (Score:3, Insightful)
Re:Good for them (Score:5, Funny)
Re:Good for them (Score:5, Interesting)
Re: (Score:3, Informative)
Duress codes (Score:3, Interesting)
Agents dropped behind Axis lines were taught how to use 'security codes' if they were compromised (i.e. captured by the Nazis).
The imbeciles in London who received their messages, especially from the totally infiltrated Dutch circuits, were so stupid as to message them back saying 'why are you omitting your security codes?'
It got so bad that on April 1st 1944 the London operators received a plaintext mes
Re: (Score:2)
Brave defenders of freedom (Score:2)
I salute you, impressed by your action!
Re:Brave defenders of freedom (Score:5, Insightful)
Bush was right, it is JUST a piece of PAPER. Why? Because American's do NOTHING about it and do not believe in it.
This is plain to see by their inactions.
Biometrics: lamest of all security protocols (Score:5, Insightful)
A person only has 20 digits, 2 palms, 2 soles, 2 retinas, and one genome. All of the biometric properties of those can easily be duplicated with noninvasive methods (simply enrolling in a biometric system requires the same access as duplication would). When one of those 27 properties is compromised, how do you revoke its use? I guess start with the fingers and palms and as people get older they have to start using their feet for identification, and at the very last make them get pricked for each identification. When all the biometric identifiers are used up, the now useless (at least in a Secure(TM) society) people can be recycled in the soylent green program or something.
Re:Biometrics: lamest of all security protocols (Score:5, Funny)
Ah, the Yakuza solution. (Score:4, Funny)
Bob: DAN! What the fuck happened to you? You have no arms and not legs.
Dan: And no testicles either. They took those too.
Bob: No tes..what happened?
Dan: Somebody got a copy of my biometric profile. So we had to make changes...
Bob: But you have no arms and no legs!
Dan: They even changed my name...
Bob: They did? What's your name now?
Dan: Matt
T-shirt (Score:2, Insightful)
Re: (Score:2)
But the whole point of this is actually the E-Pass which contains fingerprints and is supposed to be absolutely safe. And the CCC has shown ways to make a fake fingerprint [youtube.com] with some glue in less than an hour.
Re: (Score:2)
1) print fingerprint on laser printer
2) hold over sensor.
Seriously, as sloppy as those guys usually are, after that episode, I don't see why anyone who speaks English or has access to a translation would seriously consider fingerprint-based authentication for anything.
Re:T-shirt (Score:5, Interesting)
I was amused to see that the technology's weaknesses had made it to the Scooby-Doo level already. I don't know if that exact combination would work, but I've heard of similar successful attacks.
No better thant he status quo? (Score:5, Interesting)
I'd hate to see people get proficient at faking fingerprints, because that leads to all sorts of interesting results in the realm of law. If fingerprint fraud becomes widespread, for example, will fingerprints at a crime scene still be valid evidence in court?
Re:No better thant he status quo? (Score:4, Insightful)
I mean, since fingerprints cannot be conclusive anymore, I foresee our politicians with moral fibers of steel pushing for more surveillance. I mean, if we cannot really tell whose fingerprints they are, we certainly need video proof! And since we do not know where a crime may happen, the policy makers (who typically have about as much morality as a pea) have decided that the way around this is to have cameras everywhere. Public restrooms and your house included.
I mean, think of the children!
Re:No better thant he status quo? (Score:4, Funny)
Re: (Score:2)
Major flaw of biometrics (Score:5, Insightful)
This event highlights one of the major flaw of biometrics. This official had his fingerprint copied. There is nothing he can do. He can't change it. He can't prevent people from using it. No fingerprint reader will ever be able to determine with 100% certainty whether a particular fingerprint is real or fake. Bottom line: when one of your biometric traits gets stolen, you get screwed. For life.
I hope this convinces governments that using biometrics for anything is a bad idea (other than perhaps criminal investigations, although what if this german official's fingerprint was found on a murder scene ?).
Re: (Score:2)
This is like how any lock can be picked, eventually. The value is not in a lock that can't be picked, as that is an impossibility, but one that makes the level of entry significantly high so as to ward off any amateur attempts and possibly raise the suspicions of those watching -- i.e. some guy deciding the lock is too hard
Re:Major flaw of biometrics (Score:4, Insightful)
Biometric data may put some entry barriers higher, so what? The problem is that you just can't get a new iris scan, like you get a new passport once your gets stolen.
The worst of the situation is that we have all these politicians deciding --without the least form public debate about the real privacy implications-- that biometric data is now to be collected, and used, and kept by the government.
Re: (Score:2)
It significantly lowers the barrier of entry. Compared to figuring out someones password or stealing a key duplicating biometric data is trivial.
Re: (Score:3, Funny)
Senior public officials could slide their penis into the reader at checkpoints and a reading quickly and easily taken.
Females could be fitted with a custom made prosthetic of some kind.
Re: (Score:2)
Please see the dominatrix down the corridor for your corrective treatment.
Re: (Score:2)
I guess the name Bobbitt doesn't ring a bell?
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
Re:Major flaw of biometrics (Score:5, Insightful)
The point being that my biometric data is mine. It is private. It is not the government's business to have my blood samples, or DNA, or finger print. I am not a criminal, and therefore I expect to be entitled to some privacy from the BigBrother.
Once some retarded government bureaucrat decides to leave a laptop inside a taxi or something, my private data is lost, and I can never get a new fingerprint, or iris scan. I can get a new social security number, I can get a new passport, a new bank account number, but I **cannot** get a new DNA.
Re: (Score:3, Insightful)
But I suppose you wear a tinfoil mask to guard against those face recognition systems tied to cameras because your face data is yours and only yours.
You are confusing the ethics, legality and technology behind biometrics in a bad way.
official's fingerprint was found on a murder scene (Score:2)
Well, duh! The police and judicial system would treat him exactly the same as someone without any political clout or friends in high places, because there is no corruption in the ruling class.
Re: (Score:2)
No, no no NO! You guys are looking at this all wrong! Don't you see?
He can now GET AWAY WITH MURDER. If this fingerprint is found at the scene? So what? It's the perfect alibi. He could commit a crime and INTENTIONALLY leave this fingerprint at the scene.
In fact, how do we know he didn't arrange for it to be released in the first place? We could be dealing with a truly devious mind here. Does anyone know if he happens to own a w
Re:Major flaw of biometrics (Score:4, Funny)
He tells the cops to RTFA.
rj
"The" finger print? (Score:2, Interesting)
Re: (Score:2, Insightful)
Legal action? (Score:5, Insightful)
To what ends? You can't deter it as it's already happened, and you can't suppress it, as even the method for tricking the security system is widely known. If the security system is broken, you can't legalize it into working again. The security system was built in order to keep things safe, and now we have to keep other things safe from the security system itself.
DMCA (Score:2, Interesting)
It would by interesting to try to tell the cops that they can not have your finger prints because it violates the DMCA.
A perfect demonstration to the perfect person (Score:4, Insightful)
Bravo!
even worse (Score:4, Informative)
Has anyone tried this on a fingerprint reader? (Score:4, Interesting)
Do you really get a good enough copy? How hard is it? (After all, any security can be broken somehow. So an essential aspect is the "cost" of breaking the security)
Re: (Score:2, Informative)
Re:Has anyone tried this on a fingerprint reader? (Score:5, Informative)
As a matter of fact, Yes. [slashdot.org]
Yes, fingerprint readers are easily screwed. (Score:4, Informative)
Re:Has anyone tried this on a fingerprint reader? (Score:5, Informative)
The high-end, ridicilously expensive fingerprint readers are a lot harder to crack though; But I wouldn't say uncrackable.
Re:Has anyone tried this on a fingerprint reader? (Score:4, Insightful)
In the end you have to be realistic with your expectations for any security system. We lock our front door when we leave our house but we all know that someone that wants to get in can still get in if they want to try hard enough. When you lay in bed at night you have no way to be sure that a stranger hasn't secretly entered your home and is waiting to cut your throat in the dark. Yet we make a bigger deal over how secure access to your bank account and other sensitive information is. At some point you just have to say enough and go on with your life.
Re:Has anyone tried this on a fingerprint reader? (Score:4, Informative)
Do you really get a good enough copy? How hard is it? (After all, any security can be broken somehow. So an essential aspect is the "cost" of breaking the security)
Re: (Score:2)
now if only there wer a place using biometrics.. (Score:2)
I can't recall if disney's biometrics use just the thumb or the whole hand.. but i know people who get the year long pass have to use biometrics to get into disneyland... this is to cut down on fraud of say a person renting or selling the pass to other people, so obviously disneyland was the first place I'd even seen biometrics in public.
very cool, using this technology people can sell their biometric fake palms along with the pass to use the year round p
isn't biometric authentication a good thing? (Score:4, Interesting)
So in addition to needing to know a pin or password, someone also needs to have stolen my fingerprint in order to take money out of my bank account. Isn't this what is called two factor authentication? Isn't that a good thing that makes it that much more difficult to steal an identity?
According to this article Germany's new passports:
http://www.itsmig.de/best_practices/ePass_en.php [itsmig.de]
they contain both fingerprint data, and a picture of the person. Thus, to steal your identity, a person would have to steal your passport, look like you, and also steal your fingerprint. This actually seems like a pretty good system that would prevent someone from using a stolen passport to steal the rightful owners identity. Without the fingerprint data, an identity theft doesn't need to do as much work.
That said, I'm not from germany, so maybe there additional nuances about this thing that I'm missing.
Re: (Score:3, Insightful)
Except that with most types of biometric data (eg. fingerprints), they suffer two faults: you leave copies of them everywhere, and once compromised they can't be changed. The first makes it easy for someone to compromise the authentication, as this club demonstrated. I'll bet the minister left his fingerprints on a lot more than just a single plastic cup at a panel, and lifting a fingerprint from a hard surface is relatively easy to do. And the second means that compromises are 100% absolutely fatal for the
Re: (Score:2)
1. You leave it everywhere. You leave your finger prints all over your desk at work. Just look how this guys finger print was stolen from a glass.
2. You can't change it.
Two factor auth is about something you know and something you have. I would much rather the later was a usb eToken or similar and not my fingerprint!
Re:isn't biometric authentication a good thing? (Score:4, Interesting)
Part of the problem is that you (and many other people) seem to think authentication is the same as identification. It's not. Biometrics are awesome as part of two-factor authentication, but they're horrible as a means of identifying yourself.
Identification is the problem of determining, on your own, the identity of a given person.
Authentication is the problem of determining whether or not a given identity corresponds to a given person.
The difference is that, in authentication, you are given both a single person and a single identity, and your job is to answer true or false as to whether they match. Authentication is a yes/no question: your answer is either yes or no. In identification, you are given only a person, and your job is to produce a matching identity. Identification is not usually a yes/no question, although in some cases it can be disguised as one -- for example: to answer "Is this person a terrorist?" you typically have to determine a person's true identity (which a terrorist is not likely to offer to you) and then check that identity against known terrorist databases.
National governments are fully aware of this distinction, and they exploit public confusion to further their agenda. Biometrics are being advertised as authentication tools (does this passport accurately identify this person?), for which they work pretty well, but in reality governments are using biometrics for identification (is this person a terrorist?), an approach which has fail written all over it.
Even for authorization, biometrics are not a panacea, but they are at least a useful tool capable of contributing some benefits when employed properly. For identification, biometrics are an unmitigated disaster, for many reasons, chief among them the base rate fallacy [wikipedia.org], which says that the accuracy of an identity test drops precipitiously when the test is presented with large databases of identities.
Perfect alibi (Score:5, Interesting)
The only thing dumb thing he could get caught with is when he leaves wheelchair tracks [wordpress.com] at the scene of the crime.
There actually *are* things to like about Germany (Score:5, Interesting)
post an image (Score:2)