Iris security bypassed

[donm527]

That was interesting. Doesn't seem to need to grab a real close up pic either.

https://www.sammobile.com/2017/05/23/the-ccc-finds-a-way-to-trick-the-galaxy-s8s-iris-scanner/

 

[uncreativeartist]

We are all doomed!!!! I can understand there are people who need their phones protected from whatever dangers their lives or jobs have. But for the average user, I don't think someone is going to try and get a picture of someone's iris, print it, get a contact lens, steal that person's phone to unlock it.

I have tried the iris scanner and have tried friends and family try and unlock the phone with it and it did not work. I typically just have just swipe or a code to put in to unlock the phone. I have nothing important on my phone, ok so they can steal my identity, if someone wants it they can have it. I have had it a long time and it's terrible, maybe they can pay off my debt and help get back on my feet.

 

[billsterjito]

If someone wants to go through all that trouble to get at my almost entirely un-important Information... they can have it.
I use iris scanner all the time and news like this changes nothing from my perspective.

 

[Frozen Corpse]

If someone wants to go through all that trouble to get at my almost entirely un-important Information... they can have it.
I use iris scanner all the time and news like this changes nothing from my perspective.

Well said.

 

[blaine07]

If someone wants to go through all that trouble to get at my almost entirely un-important Information... they can have it.
I use iris scanner all the time and news like this changes nothing from my perspective.

Maybe if they get into mine they can do some work for me?

 

[Ecm]

Considering the method described in the article requires a hi-res close-up of someones eye, plus direct access to the device, I'm not too worried. The first thing I would do if my S8+ were lost or stolen is to wipe it remotely. Problem solved. That way, no one would be able to determine just how much time I spend on the Mobile Nations forums...

 

[GRUNT11B]

Oh no! people carry around night mode infrared photos of your Iris with contact lenses attached to it to steal your device and unlock it. Not the least bit worried...

 

[donm527]

Actually after reading it and Googling a bit, I've found articles as far back as 2012 that showed this method already done reversed engineered. Funny how touted as so secure and more so than face recognition and how it may be implemented for Samsung pay(?) but seems even easier than face recognition. People are always posting close up selfies so I imagine you have a better chance of a usable eye shot over face shot.

Guess nothing faster and out of those other options more secure than a good FPS.

 

[erasat]

Actually after reading it and Googling a bit, I've found articles as far back as 2012 that showed this method already done reversed engineered. Funny how touted as so secure and more so than face recognition and how it may be implemented for Samsung pay(?) but seems even easier than face recognition. People are always posting close up selfies so I imagine you have a better chance of a usable eye shot over face shot.

Guess nothing faster and out of those other options more secure than a good FPS.

Well I don't know about that as it was proved when the Apple TouchID was released that it could be fooled too, and even after further improvements to it and other Fingerprint sensors, there are a lot of security companies that say that the FP are not as secured as they seem.

It seems that the most secured way is still a long password or PIN but again, if somebody, somehow manages to get a glance at what you are typing on your phone and if you are a regular guy that use the phone a lot so need to enter it every time, the chances of somebody that is with you all the time manage to get your security code is higher that we would like. So for me there is no perfect Security solution, so if all of them have their flaws, i'll still continue using the one that is more convenient for me without worrying what could happen if somebody somehow gets a picture of my Iris and then manage to get a perfect hi-res photo of it and then somehow steal my phone so he/she can hack into my phone.

Here a couple of recent articles about the topic.

http://www.telegraph.co.uk/technology/2017/04/11/smartphone-fingerprint-scanners-could-easily-fooled-fake-prints/

http://www.electronicproducts.com/Mobile/Devices/How_to_fool_a_fingerprint_sensor.aspx

 

[erasat]

Actually after reading it and Googling a bit, I've found articles as far back as 2012 that showed this method already done reversed engineered. Funny how touted as so secure and more so than face recognition and how it may be implemented for Samsung pay(?) but seems even easier than face recognition. People are always posting close up selfies so I imagine you have a better chance of a usable eye shot over face shot.

Guess nothing faster and out of those other options more secure than a good FPS.

Actually after reading it and Googling a bit, I've found articles as far back as 2012 that showed this method already done reversed engineered. Funny how touted as so secure and more so than face recognition and how it may be implemented for Samsung pay(?) but seems even easier than face recognition. People are always posting close up selfies so I imagine you have a better chance of a usable eye shot over face shot.

Guess nothing faster and out of those other options more secure than a good FPS.

Well I don't know about that as it was proved when the Apple TouchID was released that it could be fooled too, and even after further improvements to it and other Fingerprint sensors there are a lot of security companies that say that they are not as secured as they seem. It seems that the most secured way is still a long password or PIN but again, if somehow somebody manage to get a glance at what you are typing on your phone and if you are a regular guy that use the phone a lot so need to enter it every time, the chances of somebody that is with you all the time manage to get your security code is higher that we would like. So for me there is no perfect Security solution, so if all of them have their flaws, i'll still continue using the one that is more convenient for me without worrying what could happen if somebody somehow gets a picture of my Iris and then manage to get a perfect hi-res photo of it and then somehow steal my phone so he/she can hack into my phone.

Here a couple of recent articles about the topic.

http://www.telegraph.co.uk/technology/2017/04/11/smartphone-fingerprint-scanners-could-easily-fooled-fake-prints/

How to fool a fingerprint sensor - Electronic Products

 

[erasat]

Actually after reading it and Googling a bit, I've found articles as far back as 2012 that showed this method already done reversed engineered. Funny how touted as so secure and more so than face recognition and how it may be implemented for Samsung pay(?) but seems even easier than face recognition. People are always posting close up selfies so I imagine you have a better chance of a usable eye shot over face shot.

Guess nothing faster and out of those other options more secure than a good FPS.

Well I don't know about that as it was proved when the Apple TouchID was released that it could be fooled too, and even after further improvements to it and other Fingerprint sensors there are a lot of security companies that say that they are not as secured as they seem. It seems that the most secured way is still a long password or PIN but again, if somehow somebody manage to get a glance at what you are typing on your phone and if you are a regular guy that use the phone a lot so need to enter it every time, the chances of somebody that is with you all the time manage to get your security code is higher that we would like. So for me there is no perfect Security solution, so if all of them have their flaws, i'll still continue using the one that is more convenient for me without worrying what could happen if somebody somehow gets a picture of my Iris and then manage to get a perfect hi-res photo of it and then somehow steal my phone so he/she can hack into my phone.

Here a couple of recent articles about the topic.

http://www.telegraph.co.uk/technology/2017/04/11/smartphone-fingerprint-scanners-could-easily-fooled-fake-prints/

How to fool a fingerprint sensor - Electronic Products

 

[Almeuit]

I only use Fingerprint scanners so -- no worries for me ¯\_(ツ)_/¯.

 

[dejanh]

Biometrics are inherently insecure. If compromised, they cannot be changed. They are all a convenience feature only.

 

[anon(7901790)]

Take this with a grain of salt. Just because somebody found a way to do something doesn't mean it is practical. There are number things that a person needs to have and do.

1. A high resolution IR camera such as the Sony, or a camera with the IR filter removed.
2. Take a high resolution of your eyes. Which means that person needs to be with a few feet of you, close enough for you to notice.
3. Printed out to the right scale.
4. Contact lenses to put on the photo

and last but most important.

Have YOUR phone in his or her possession.

Like I said, it's possible just not practical. There are easier ways to compromise your phone and the person doesn't need to even touch it.

 

[zyad]

I ordered medieval armour metal gloves in case anyone wants to randomly attack me, chop off my index finger, and use it to get into my phone in order to see my latest work emails and do work on my behalf.

 

[L0n3N1nja]

Couldn't care less, my phone goes missing I'll just remotely wipe it before they have time to get into it.

 

[N4Newbie]

A few years ago, the Mythbusters TV program got past an "unbeatable" fingerprint sensor door lock with nothing more than a simple photocopy of an actual fingerprint taken from a surface. Google it.

The generally accepted high security standard is to use "something you are plus something you know" - for example, a fingerprint plus a pin/password.

 

[D13H4RD2L1V3]

I can't say I'm overly surprised.

Even the best method of biometric security isn't foolproof.

Now, a lot of websites are clamoring over how "easy" it is to spoof it. Well, it's easy once you get that photo. However, getting that photo is really difficult.

One would need a camera that is capable of an extremely high resolution along with a tack-sharp zoom/telephoto lens that can extend far without losing focus. Not to mention that they would need to know where that person is. The equipment needed to even do this in the first place is probably enough to deter most thieves.

Overall, what I'm going to say is to not be afraid of using biometric security. While they aren't foolproof and can be spoofed provided someone goes through the effort, the likelihood that it will happen is very low. However, do keep a good password/PIN in handy.

 

[Whiskey619]

I'm not really concerned. If it was relying on the low res picture shown on my screen while it scans my eyes, then I'd be really worried though. That kinda freaked me out until I realized it was only there to help line up the other camera doing the work.

 

[ThrottleJohnny]

I only use Fingerprint scanners so -- no worries for me ¯\_(ツ)_/¯.

Yep. FPS all the way for me. I tried the Iris Scanner for about 10 minutes and hated it.