Fingerprints.
Like snowflakes, they’re all unique.
And there was palpable excitement and enthusiasm when Apple — and later Samsung and Motorola started using fingerprints (them) instead of passwords to let us unlock our smartphones a few years ago. One less thing to remember, and totally safe and secure!
Well, it turns out, yes, it is one less thing to remember, but the totally safe and secure part? Not so much. Fingerprints, it turns out, can be ‘spoofed’ (or faked) in a similar manner to emails, where a hacker impersonates someone else (or at least their email address) to elicit information, or access, from his or her intended victim.
It turns out if you’ve got access to someone’s finger (!) and you can press it (or convince them to press it) into a substance like dental putty, once that hardens, you can then use play-doh — or a similar material — to turn the ‘negative’ putty impression back into a ‘positive’ one. While the process is hardly foolproof, the play-doh will often yield a clear enough “fingerprint” to fool many phones into granting access.
Similarly, just as a forensic team might lift a fingerprint from a wine glass or a wallet (or even a phone!) hackers can do the same thing with certain kinds of ink that will make a good enough likeness of the fingerprint to also fool a phone’s fingerprint sensor. In this case the initial impression is the negative and the ink version is the positive.
And while it’s reasonably unlikely you’d let someone casually take an impression of your finger in dental putty (that would have to be SOME party), passive fingerprints (the kind we leave thousands of each day when we touch or pick items up) are much harder to control, unless you’re a white-gloved butler, say, from another era.
And as with many security breaches or uncovered vulnerabilities, developers are already working on a fix, such as using a camera to take a picture of the ‘finger’ being scanned, or another sensor to monitor heat or blood flow to help the phone’s fingerprint sensor be sure that the item it’s scanning is, in fact, an actual fingerprint.
But until that day comes, beware what you touch — and where — or have your butler hold your items for you.
