{"id":83413,"date":"2017-04-15T17:27:29","date_gmt":"2017-04-15T21:27:29","guid":{"rendered":"http:\/\/rbachnet.wwwmi3-ss40.a2hosted.com\/index.php\/"},"modified":"2022-08-19T15:06:32","modified_gmt":"2022-08-19T19:06:32","slug":"open-a-new-galaxy-crack-with-a-pix","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/open-a-new-galaxy-crack-with-a-pix\/","title":{"rendered":"Open a New Galaxy Crack with a Pix"},"content":{"rendered":"

\"Open<\/a>Followers of the Bach Seat<\/a> know biometrics<\/a><\/strong> have a limited value<\/strong> in replacing passwords. Despite the technical flaws another round of biometric hype<\/a><\/strong> is running across the intertubes. The latest round of biometric hype is coming from Samsung<\/a><\/strong> (005930<\/a>). In the hope to revive their brand<\/a>, they are on the verge of releasing the Galaxy S8<\/a>. The Samsung Galaxy S8<\/strong> includes the ability to use facial recognition<\/strong> software to unlock your brand new phone. CNet<\/em><\/a> says that this idea \u201csounds awesome<\/a>.\u201d<\/p>\n

\"Samsung<\/a>However, this awesome will lower the bar<\/strong> for your security. CNet<\/em> reports that the video blogger MarcianoTech demonstrated<\/a> a pre-release version of the Galaxy S8 is seen being unlocked using just a photo<\/strong> (at the 1:09 mark). To their credit Samsung has acknowledged that the Face Unlock<\/a> feature is more for convenience than for security, and it cannot be used for mobile payments. Weak facial recognition software is a convenience for the user, it could also be very convenient for others, too.<\/p>\n

The troubles with Face Unlock<\/strong> date back to 2011 when SlashGear<\/em><\/a> reported<\/a> that Google admitted<\/strong> the security system can be fooled by a picture of you and not the real thing. CNet<\/em> reports<\/a> that a\u00a0Carnegie Mellon University<\/a> spin-off in Pittsburgh, PittPatt<\/a>, developed\u00a0 that Face Unlock which was later acquired by Google<\/a> (GOOG<\/a>).<\/p>\n

\"photographs<\/a>Just to make Face Unlock and similar facial recognition systems more dangerous, the Guardian<\/em><\/a> reports<\/a> during recent testimony<\/a> before congress the FBI<\/strong> admitted that they store about half of all adult Americans\u2019 photographs in a facial recognition databases<\/strong> that can be accessed by the FBI. About 80% of photos in the FBI\u2019s network are non-criminal entries<\/strong>, including driver\u2019s licenses<\/strong> pictures<\/strong> from 18 states including Michigan<\/a> (pdf) and passports<\/strong>.<\/p>\n

The FBI first launched its advanced biometric database, Next Generation Identification, in 2010<\/strong>, augmenting the old fingerprint database with further capabilities including facial recognition. The bureau did not tell the public<\/strong> about its newfound capabilities nor did it publish a privacy impact assessment, required by law, for five years.<\/p>\n

Unlike with the collection of fingerprints and DNA, which is done following an arrest, photos of innocent civilians are being collected proactively<\/strong>. The FBI made arrangements with 18 different states to gain access to their databases of driver\u2019s license photos.\"States<\/a><\/p>\n

 <\/p>\n

\u201cI\u2019m frankly appalled,<\/em>\u201d said Paul Mitchell, a congressman for Michigan. \u201cI wasn\u2019t informed when my driver\u2019s license was renewed my photograph was going to be in a repository that could be searched by law enforcement across the country<\/em>.\u201d So anyone with a photo of you, or maybe even just access to your Facebook photos, could potentially access your phone<\/strong>.<\/p>\n

rb-<\/strong><\/em><\/p>\n

There are two important reasons why biometrics don’t work<\/strong>, and why the old-fashioned password is still a better option<\/strong>: a person’s biometrics can’t be kept secret and they can’t be revoked.<\/em><\/p>\n

\"There's<\/a>People expose their biometrics everywhere – they leave fingerprints behind at bars and restaurants, their faces and eyes are captured in photos and film, etc. There’s no real way to conceal your eyes, face, or fingerprints from the world<\/strong>. As far back as 2002, research<\/a> led by Japanese cryptographer Tsutomu Matsumoto. Matsumoto and his team used clear gelatin to make artificial fingers that they then used to fool fingerprint scanners<\/strong>. The gelatin-based finger was successful in fooling all 11 devices tested. I wrote<\/a> about spoofing fingerprints in 2016.<\/em><\/p>\n

However, it’s the second problem with biometrics that is the really big one: once a person’s biometrics<\/strong> have been compromised, they will always be compromised<\/strong>. Since a person can’t change their fingerprint or whatever biometric is being relied upon, it’s ‘once owned, forever owned.’ That is biometrics’ major failing and the one that will be hardest to overcome.<\/em><\/p>\n

Part of the reason is that it’s silly to only have 10 possible passwords<\/strong> your whole life (20, if you count toes) but unlike a password, once a biometric is compromised, it is permanent. Today, if your Twitter account gets hacked, you just change the password – but if you are using a biometric, you will be stuck with that hacked password for the rest of your life.<\/em><\/p>\n

With the release of Windows 10<\/a>, Microsoft<\/a><\/strong> (MSFT<\/a>) stepped up their biometrics game. CNet reports<\/a> that with the recent improvements in Windows 10 biometric security includes facial recognition software<\/strong>. Besides facial recognition, Windows Hello also supports fingerprint and iris recognition<\/strong> to secure your PC. For facial recognition though, Microsoft has partnered with chipmaker Intel<\/a> (INTC<\/a>) for its RealSense 3D camera tech to get the job done. RealSense uses depth-sensing infrared cameras to track the location and positions of objects, which Microsoft then uses to scan a person’s face or iris before unlocking the device in question.<\/em><\/p>\n

To further push the biometrics agenda, more than 200 companies including Microsoft, Lenovo, Alibaba, and MasterCard have already come together to form a partnership known as the FIDO<\/strong> (Fast Identity Online<\/a>) Alliance. Founded in 2013, FIDO<\/a> was set up to address issues such as a worldwide adoption of standards for authentication processes over the Web to help reduce reliance on passwords.<\/em><\/p>\n

 <\/p>\n

Ralph Bach<\/a>\u00a0has been in IT long enough to know better and has blogged from his\u00a0Bach Seat<\/a> about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn<\/a>,\u00a0Facebook<\/a>,\u00a0and\u00a0Twitter<\/a>. Email the Bach Seat\u00a0here<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Samsung Galaxy S8 uses facial recognition biometrics may allow access to your new phone with a picture<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[2885,2990,1452,2227,1041,2767,1807,536,92,476,93,82,421,2541,2892,2891,393,4,445],"class_list":["post-83413","post","type-post","status-publish","format-standard","hentry","category-security","tag-2885","tag-2990","tag-biometrics","tag-facial-recognition","tag-fbi","tag-fido","tag-galaxy","tag-goog","tag-google","tag-intc","tag-intel","tag-microsoft","tag-msft","tag-passwords","tag-realsense","tag-s8","tag-samsung","tag-security","tag-windows"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t