
Fingerprint Extraction Using Smartphone Camera - lainon
https://arxiv.org/abs/1708.00884
======
benjaminjackman
This is a good brief post by Bruce Schneier to read when the subject of
biometrics come up:

[https://www.schneier.com/blog/archives/2009/01/biometrics.ht...](https://www.schneier.com/blog/archives/2009/01/biometrics.html)

The thrust of his argument in this post is:

> The lesson is that biometrics work best if the system can verify that the
> biometric came from the person at the time of verification. The biometric
> identification system at the gates of the CIA headquarters works because
> there's a guard with a large gun making sure no one is trying to fool the
> system.

Which may be a good thing to keep in mind if you are using fingerprints to id
someone using their phone's camera.

~~~
unkown-unknowns
"Hey could you hold my phone for a sec? Thanks. No wait, not like that, here,
hold it like this." :p

------
oleks
Ironically, this looks like another excellent argument against the use of
fingerprint authentication. It makes it easier to capture someone's
fingerprints without their consent - "Hey, could you hold my phone for a sec?"
\- "Thanks!"

Oh, and it is easy enough to break TouchID[1], so what makes using the
smartphone camera any more sensible?

[1]: [https://www.ccc.de/en/updates/2013/ccc-breaks-apple-
touchid](https://www.ccc.de/en/updates/2013/ccc-breaks-apple-touchid)

~~~
userbinator
_It makes it easier to capture someone 's fingerprints without their consent_

You can already observe someone and take the prints from whatever was touched
last... no need to interact with the person directly.

------
draugadrotten
Can anyone say if this camera method includes detection if the finger is alive
or a static image?

Early fingerprint detectors could be spoofed by static images (on paper,
plastic or other materials) while modern detectors use various methods for
liveness detection. It should be obvious that few commercial implementations
would like to use something that can be fooled by a static image.

~~~
yorwba
It's possible to detect the minute changes in skin color caused by the pulse,
so you could distinguish a live finger from a fake (unless it has a pulsing
light...)

This paper doesn't mention anything about verifying liveness, though.

~~~
readams
Liveness sensors in fingerprint sensors have not historically proved difficult
to defeat.

