Beware of fingerprint reader

[thhart]

In Germany there is some excitement about cracking fingerprint readers. There is a super market chain which introduced a money less payment method via fingerprint authentication. The famous hacker group "CCC" worked together with a german public broadcast station to scan the fingerprint of a glass and transfer it with some enhancement via a graphic software to foil which was attached on a other persons finger. And the system was cracked the person was able to pay with this finger. If I think how much fingerprints are elsewhere on my laptop, you should consider how you trust your fingerprint reader. I like the fingerprint reader as well, but don't trust them too much.

Thomas

[Hackez]

In Germany there is some excitement about cracking fingerprint readers. There is a super market chain which introduced a money less payment method via fingerprint authentication. The famous hacker group "CCC" worked together with a german public broadcast station to scan the fingerprint of a glass and transfer it with some enhancement via a graphic software to foil which was attached on a other persons finger. And the system was cracked the person was able to pay with this finger. If I think how much fingerprints are elsewhere on my laptop, you should consider how you trust your fingerprint reader. I like the fingerprint reader as well, but don't trust them too much.

Thomas

It is a well known fact, at least to most that fingerprint scanners are not a good way to safeguard your information.

HOWEVER, using a password in addition to a fingerprint scanner adds an extra layer of security that is worth it in my opinion. I personally have three passwords from boot up to OS access.

[Lithus]

Fingerprint reader = types in your passwords for you.

They are for convenience, NOT safety. Can't stress that enough.

[Fignuts]

I just wished it worked better! With the default settings (midway between "more convenient" and "more secure"), I get a successful logon on the first try maybe 3 out of 5 times. About 1 out of 10 attempts, I have to try several times, or revert to simply typing the password in. With the few seconds it takes to process, succeed/fail, and reset, I found it easier just to disable it and stick with passwords. Perhaps set to "most convenient" it is much better, but I wonder how secure that is. I would agree that password + fingerprint to login is a bit more secure, though I don't think it protects you from remote attacks via the network. I would assume that people requiring that level of security are using hard disk encryption as well.

[eyecon82]

In the USA, there is a supermarket chain called Jewel-Osco, which also uses FP readers as a way to pay

[UCSCalan]

I seen the finger print reader cracked with a laser printer and house hold glue.....

I wish they introduce a Retina eye Scanner that be sooo sosooosos cool.

[Han Bao Quan]

I pretty sure the fingerprint readers on the Thinkpad are premium readers.
That means, the tissues under your fingers have to be alive !!!. You can cut off the finger of someone or whatever you want. But if there is no electric charges under the skin, no way can pass the fingerprints reader.

[eyecon82]

I pretty sure the fingerprint readers on the Thinkpad are premium readers.
That means, the tissues under your fingers have to be alive !!!. You can cut off the finger of someone or whatever you want. But if there is no electric charges under the skin, no way can pass the fingerprints reader.

that is correct...not only does it sense the fingerprint, but it senses the heat in your fingers.....try using the FP reader on a cold day when your fingers are numb

[thhart]

Of course I hope too that IBM made some investment to make their reader quite good in comparison to others, anyone has some more background information?
But what I wanted to focus was that there are a lot of fingerprints on a victims laptop which you can extract and apply it to your finger even with electrical/thermal equivalence.
But I don't want to make too much noise, the fingerprint is somewhat insecure and only a good password can protect your data.
Side note: the combination of both is not more or less secure than the strongest element in the secure chain alone.

[ickysmits]

I've never heard or read any claim that the ThinkPad scanner can detect a live finger from a dead one. I've only seen it advertized as a capacitance scanner that measures the variation in capacity between the valleys and the ridges in the fingerprint.

It doesn't matter anyway, just chop off someone's finger and slice a thin layer of skin off the tip and place it over your own. There are plenty of ways around the fingerprint reader and it doesn't seem to take a lot of skill or resources. It's more a convenience then security.