Biometrics Are Coming & So Are Security Concerns

ronjor · Feb 20, 2019

Calling your bank? Be prepared to have your voice biometrics collected

By Melissa Locker 02.19.19
But as it turns out, doing admin on the phone isn’t just an annoyance these days. It’s also a way to prevent fraud through voice biometrics.
In Chase’s case, the biometric program was announced back in April, but there’s a good chance many customers missed the announcement. (I missed it, and I actually write about these topics for a living.) Now, when you call Chase, an automated recording informs you that your voice is being used to identify you in the hopes of preventing fraud.
Click to expand...

guest · Feb 20, 2019

Honestly, biometrics are way too convenient, i can't live without.

Of course like everything, you can't make a successful recipe at the 1st try.
Time will tell.

ronjor · Mar 6, 2019

Fingerprint and face scanners aren't as secure as we think they are

March 6, 2019 by Wencheng Yang And Song Wang
Despite what every spy movie in the past 30 years would have you think, fingerprint and face scanners used to unlock your smartphone or other devices aren't nearly as secure as they're made out to be.
Click to expand...

ronjor · Mar 11, 2019

Debit card with built-in fingerprint reader begins trial in the UK

By Jon Porter@JonPorty Mar 11, 2019
No PIN numbers, no signatures, and no payment limits
Click to expand...

guest · Mar 28, 2019

Biometrics really are (in)secure
March 27, 2019
https://blog.avira.com/biometrics-really-are-insecure/

An increasing number of companies are beginning to use biometric systems to protect sensitive areas and information from competitors and cybercriminals. Biometrics is also becoming increasingly adopted in the private sphere. But how secure are fingerprints, irises, and other unique physical characteristics actually when it comes to using them as passwords or PINs?
Weaknesses of biometrics
Despite the advanced technology, no biometric process is 100% secure. While the error rates are low (see above), the systems need to allow for measurement tolerances based on the fact that with all the different measurements involved, your finger, eye, or signature never deliver exactly the same data because your eye or finger may be at a different angle.

On top of this, biometrics relies on databases – and these are vulnerable to attack. Here’s an example: In the US a database containing the details of government workers was hacked in 2015 and over five million fingerprints stolen.
Click to expand...

Conclusion
While biometric processes are more secure and offer additional advantages over other systems such as passwords, even they can’t guarantee 100% security. As such, they shouldn’t be used as the only solution, particularly in the business sector. Ideally, they should be used to supplement existing systems.

This article is also available in: German
Click to expand...

JRViejo · Apr 7, 2019

It took 13 minutes to print up the fake
Click to expand...

Samsung’s Galaxy S10 fingerprint sensor fooled by 3D printed fingerprint by Andrew Liptak.

guest · Apr 13, 2019

JRViejo said: ↑

Samsung’s Galaxy S10 fingerprint sensor fooled by 3D printed fingerprint by Andrew Liptak.
Click to expand...

Samsung issues an urgent fingerprint reader security update for the Galaxy S10 and S10+
April 13, 2019
https://www.neowin.net/news/samsung...er-security-update-for-the-galaxy-s10-and-s10

The update, which was spotted by the folks at GSMArena, is apparently an urgent update, arriving as a pop-up notification from the Galaxy Store app. The download is quite small, coming in at 6.9MB and doesn't require a reboot.

Since the latest update is dubbed as a security update, there is always the possibility that Samsung made improvements to the sensor, making it more difficult to be fooled. Unfortunately, we do not have access to a 3D printed fingerprint to test this.
Click to expand...

ronjor · Apr 15, 2019

Brazil's Itaú rolls out facial biometrics to tackle auto loan fraud

By Angelica Mari for Brazil Tech | April 15, 2019
The country's largest private bank is introducing the technology to support claim authentication and enhance customer experience.
Click to expand...

ronjor · Apr 18, 2019

NatWest unveils biometric payment system for businesses

Anmar Frangoul Published Wed, Apr 17 2019
The biometric payment approval technology will be used by business and commercial customers.
In March NatWest launched a trial of biometric fingerprint technology for card payments.
Click to expand...

ronjor · Apr 24, 2019

Windows 10: Bank says no plans to roll out Windows Hello after pilot project

By Steve Ranger | April 24, 2019
Banking group tested out biometric authentication using Windows 10 last year.
Click to expand...

ronjor · Apr 28, 2019

Skip the Surveillance By Opting Out of Face Recognition At Airports

By Jason Kelley April 24, 2019
Government agencies and airlines have ignored years of warnings from privacy groups and Senators that using face recognition technology on travelers would massively violate their privacy. Now, the passengers are in revolt as well, and they’re demanding answers.
Last week, a lengthy exchange on Twitter between a traveler who was concerned about her privacy and a spokesperson for the airline JetBlue went viral, and many of the questions asked by the traveler and others were the same ones that we’ve posed to Customs and Border Protection (CBP) officials: Where did you get my data? How is it protected? Which airports will use this? Where in the airports will it be used? Most importantly, how do I opt-out?
Click to expand...

ronjor · May 3, 2019

HMRC to delete five million biometric voice records

By Steve Ranger | May 3, 2019
'Biggest ever' deletion of biometric data by government, say privacy campaigners.
Click to expand...

guest · May 28, 2019

OnePlus 7 Pro Fingerprint Scanner Hacked In Minutes Using a Fake Fingerprint
May 28, 2019
https://gbhackers.com/oneplus-7-pro-fingerprint-scanner-hacked/

OnePlus 7 Pro Fingerprint Scanner hacked within minutes using Fake Fingerprint that can be created using hot-glue due to inadequate security that is implemented in the OnePlus 7 Pro Fingerprinting unlock Feature.

The process is little hard in practical since you need to get the target phone owners fingerprint, but it’s possible to grab the fingerprint while victim sleeping and you could just use their own finger again.
If you’re concern about security, then you make sure to implement an alternative extra layer of protection such as password unlock.
Click to expand...

guest · Jun 3, 2019

UK consumers are still worried about biometric security
Consumers prefer passwords to biometrics due to fear of identity fraud
June 3, 2019
https://www.techradar.com/news/uk-consumers-are-still-worried-about-biometric-security

Despite the fact that more businesses are using biometrics as a means of authentication, over half of consumers (56%) are worried that the shift to biometrics to authenticate online payments will lead to an increase in the amount of identity fraud.
The firm's new report, Lost in Transaction: The end of risk?, was compiled using data from its annual study which tracks changing views on payments across the UK, US, Canada, Germany, Austria and for the first time this year, Bulgaria.

Paysafe's research also revealed that nearly half (45%) of consumers do not want companies having access to their personal biometric details, 35 percent did now know enough about biometrics to trust it, 31 percent were concerned their fingerprint could easily be cloned and used to commit fraud and 28 percent said that biometrics did not seem safe.

“Biometrics are a huge opportunity for the payments industry to combat the increasing risk of card not present fraud. However, it’s not surprising that there is reluctance among consumers to use biometrics as a form of payment authentication when passwords and PINs have been the central pillar of financial data security for at least 20 years. [...]"
Click to expand...

guest · Jun 22, 2019

Making the Grade: Biometrics in K-12 is a dangerous path to take
June 22, 2019
https://9to5mac.com/2019/06/22/biometrics-in-k-12/

We are used to using tools like Face ID and Touch ID to unlock our devices. In K–12 schools, companies are looking to take it even further, though. I recently read an article in EdTech Magazine that looked further at the use of biometrics in K-12 schools.

Biometric technology is already part of the K–12 ecosystem, where administrators are using iris scans and “facial fingerprints” to grant access to buildings and computer labs, track attendance, manage lunch payments, loan library materials and ensure students get on the right buses.
“We wanted to use it for younger children to log in to launch pads for their resources,” says Serena E. Sacks, CIO of Fulton County Schools in Georgia, describing the school system’s exploration of facial recognition scans. “This is something that would make it easier for students to access digital resources without using anonymous or generic logins.”

Schools will be able to talk about their information security policies all they want, but it’s not a matter of if there are breaches, but a matter of when. Five-year-olds will have their fingerprints loaded into school databases, and have no control over what happens to that data in the future.
Click to expand...

guest · Aug 2, 2019

Is Biometrics ID Security Good Enough?
August 2, 2019
https://www.technewsworld.com/story/86166.html

There now are at least 53 biometric systems used just by the aviation industry, and dozens more by other industries, according to the World Travel & Tourism Council. Most don't see eye-to-eye, in that their respective databases aren't shared.

"The main advantage of the biometric authentication is its ease of use for the end user," said Leigh-Anne Galloway cybersecurity resilience lead at Positive Technologies.
Biometric Advantages
The advantages of using digital biometrics -- including fingerprints, iris scans or facial recognition -- to manage access to applications and devices include fast and reliable access to information tied to a specific person, as well as relatively high accuracy, suggested Tulane's Russo.
Privacy and Security Concerns
Assembly Bill 1215, known as the Body Camera Accountability Act, has proposed a ban on facial recognition software in police body cameras due to privacy concerns. Similar concerns are being echoed regarding the use of fingerprints as a method of identification.
Even travelers who see the benefits with the Clear or similar biometric screening systems may want to consider if the cons may outweigh the pros.
Click to expand...

"Although it can shave a few minutes off of travel times, we'd recommend that travelers spend the extra few minutes in line to maintain sovereignty over their personal data," said Sean McGrath, privacy advocate at ProPrivacy.
Another concern is that once a fingerprint or eye scan is in the system it isn't easy to get it back out again.
Protecting the Biometrics
"The biggest danger is the impossibility to change your biometric data," warned Galloway.

"If your password is hacked, you can always create a new one, but if biometric data is stolen you couldn't realistically change your fingerprints, face or irises, so that data could be used to attempt to fool devices and allow unauthorized access," said Russo.
"However, this is not as easy to do as one might think, and while people have successfully replicated fingerprints and voice prints to fool systems, face ID secured systems are much harder to fool," Russo added.
Click to expand...

guest · Aug 10, 2019

Apple's Face ID can be fooled by an altered pair of glasses, but there's a weird catch
August 9, 2019
https://mashable.com/article/researchers-fool-apple-face-id-with-glasses/?europe=true

Skeptical about the security of Apple's Face ID? This news won't help.
As Threatpost reports, researchers from Chinese tech giant Tencent showed at the Black Hat USA conference on Wednesday how they used a pair of glasses with tape placed on the lenses to fool facial recognition software, including Face ID. The catch: the victim has to be unconscious for the hack to work.

Researchers specifically honed in on how liveness detection scans a user’s eyes. They discovered that the abstraction of the eye for liveness detection renders a black area (the eye) with a white point on it (the iris). And, they discovered that if a user is wearing glasses, the way that liveness detection scans the eyes changes.
“After our research we found weak points in FaceID… it allows users to unlock while wearing glasses… if you are wearing glasses, it won’t extract 3D information from the eye area when it recognizes the glasses.”
This is hardly the first time Face ID has been fooled; people have been getting around italmost since it rolled out.
Click to expand...

ronjor · Aug 12, 2019

Report: Consumers Say Biometrics Makes Paying with Credit or Debit Easier and Safer

August 12, 2019
SmartMetric, Inc. reports the top benefits associated with using biometric authentication for payments in the mind of consumers are that it eliminates the need to remember multiple passwords/PINs (50%) and perceptions that it is more secure than passwords/PINs (46%).
Nearly half of credit and debit card users say in a survey conducted by AYTM of active payments users, they perceive biometrics used in the payment process is more secure than passwords. Even more think that using biometrics to make a payment is beneficial because it does away with the need to remember multiple passwords or PINs.
Click to expand...

guest · Aug 12, 2019

Hey Google, lend me a tenner? NatWest trials voice banking
August 12, 2019
https://www.theguardian.com/busines...lend-me-a-tenner-natwest-trials-voice-banking

Get ready to say: “Hey Google. How much do I have in my bank account?” NatWest is to begin voice-only banking that will give customers direct access to their accounts by talking to the Google Home smart speakers now in millions of British homes.
Google devices will answer verbally, and also flash the answers up on the customer’s smartphone.

While only basic account information will be available under the trial, NatWest said the technology may in future allow customers to instantly transfer money and pay bills simply by talking to Google devices.
To access their account, NatWest customers will have to say out loud two digits from a new four-digit password, in a move that will inevitably raise fresh fears about security and privacy.

The bank admitted some customers may be put off by the prospect of their account information being broadcast across a room. “Other people in the area will be able to hear your balance, which is something you will want to take into consideration,” said a spokesman.
Click to expand...

Internet security specialists immediately raised concerns about voice banking.
David Emm of Kaspersky said: “If people are able to carry out banking transactions using a smart speaker, it not only raises the issue of someone recording your voice and spoofing a transaction, but also the risk that recordings stored by the vendor of the device could be stolen by cybercriminals.

He said that it was difficult to see what problem was solved by voice banking. “If every transaction requires a pin from the customer, to verify their identity, it rather negates the convenience of banking in this way.”
Click to expand...

guest · Aug 12, 2019

Would be a bit more secure if it is activated via voice fingerprinting plus pin.

guest · Aug 14, 2019

ronjor said: ↑

[...] collecting biometric data is risky
Click to expand...

Major breach found in biometrics system used by banks, UK police and defence firms
August 14, 2019
https://www.theguardian.com/technol...tem-used-by-banks-uk-police-and-defence-firms

The fingerprints of over 1 million people, as well as facial recognition information, unencrypted usernames and passwords, and personal information of employees, was discovered on a publicly accessible database for a company used by the likes of the UK Metropolitan police, defence contractors and banks.

Suprema is the security company responsible for the web-based Biostar 2 biometrics lock system that allows centralised control for access to secure facilities like warehouses or office buildings. Biostar 2 uses fingerprints and facial recognition as part of its means of identifying people attempting to gain access to buildings.
The researchers had access to over 27.8m records, and 23 gigabytes-worth of data including admin panels, dashboards, fingerprint data, facial recognition data, face photos of users, unencrypted usernames and passwords, logs of facility access, security levels and clearance, and personal details of staff.

“The access allows first of all seeing millions of users are using this system to access different locations and see in real time which user enters which facility or which room in each facility, even.”
“We [were] able to change data and add new users,” he said.
Click to expand...

deBoetie · Aug 14, 2019

mood said: ↑

Major breach found in biometrics system used by banks, UK police and defence firms
August 14, 2019
https://www.theguardian.com/technol...tem-used-by-banks-uk-police-and-defence-firms
Click to expand...

Woops - just posted this on a separate thread in privacy problems. Reconcile as needed, thanks.

The Guardian is reporting the "outing" of a database run by Suprema for an access control system called Biostar2 containing plaintext passwords and biometric data by a security research company. It's used by the Met Police, banks and defence contractors.

If the report is accurate, the controls are pathetic and non-existent, and the response of the company insouciant. The report also contains the assertion that this kind of open database is common.

Apart from hoping these people get caned soundly, I trust it will confirm to readers here the dangers of biometrics and face recognition - you cannot trust the holders of the information to keep it safe, and it's obviously non-repudiatable.

Minimalist · Aug 14, 2019

''Atrocious' security practice caused fingerprint hack

Following news that a database of millions of fingerprints and biometric data used by banks and UK police was left publicly accessible, one cybersecurity expert has pinned the blame on atrocious security practices.
Click to expand...

https://www.businesscloud.co.uk/news/atrocious-security-practice-caused-fingerprint-hack

guest · Aug 17, 2019

mood said: ↑

Major breach found in biometrics system used by banks, UK police and defence firms
August 14, 2019
https://www.theguardian.com/technol...tem-used-by-banks-uk-police-and-defence-firms
Click to expand...

What Can a Hacker Do With Your Stolen Fingerprints?
August 15, 2019
https://slate.com/technology/2019/08/how-criminals-might-use-stolen-fingerprints.html

But the fingerprint data in the Suprema database is slightly different. Hackers could use a stolen fingerprint to break into a fairly rudimentary security system. A more advanced system might be possible, too, if they have lots of time and money at their disposal.

There are multiple ways to fool fingerprint readers, according to Anil Jain, who heads the Biometrics Research Group at Michigan State University. “This particular data breach is serious, because not only were the fingerprints of the individuals exposed, but also the metadata”—that is, the associated identities and login information.
Stolen fingerprints are more helpful to hackers if they also have that info, since two-factor security systems often require both conventional passwords and fingerprint scans.

The amount of effort that a hacker would need to actually break into a building or account using a stolen fingerprint depends on the sophistication of the security system. Some of the less advanced scanners will actually accept a picture of a fingerprint that’s been printed out.
Click to expand...

“It’s a cat-and-mouse game,” says Jain. “The vendors are trying to make their fingerprint readers more resistant to different types of spoofs. At the same time, the hackers are also getting smarter and trying to think of new ways to hack a fingerprint reader. You can never make any security mechanism foolproof.”
Click to expand...

Minimalist · Aug 20, 2019

Treat facial biometrics with ‘extreme caution’

We should treat facial recognition technology with ‘extreme caution’, says Dr Bill Mitchell, Director of Policy at BCS, the Chartered Institute for IT. Dr Bill Mitchell, Director of Policy at BCS warns of an unprecedented danger of the misuse of biometric data, including identity theft, because of flawed technology and a lack of ethical and rigorous safeguards around how that data is captured, stored and processed.
Click to expand...

https://www.professionalsecurity.co.uk/news/interviews/treat-facial-biometrics-with-extreme-caution/

Log in or Sign up

Biometrics Are Coming & So Are Security Concerns

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

JRViejo Super Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

deBoetie Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Log in or Sign up

Biometrics Are Coming & So Are Security Concerns

ronjor Global Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

guest Guest

JRViejo Super Moderator

guest Guest

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

guest Guest

deBoetie Registered Member

Minimalist Registered Member

guest Guest

Minimalist Registered Member

Useful Searches