A number of major banks are allowing users to log in to their bank accounts with only fingerprints. It was occurring to me, though: how many fingerprints does the average person leave per day? How difficult would it be to use one of them to access someone's bank account?

Have there been studies done on how often people leave high-quality fingerprints? Has such an attack been attempted (or succeeded) yet?

One counterargument I can see in favor of the security of this scheme is that, if you register the device in advance, this is actually two-factor authentication (because you have the device, and you're using your fingerprint - it's using something you have and something you are). But, cellphones are easy to steal too.

So, my original question still stands: have there been any studies, threat modeling, cases of successful attacks, etc. that indicate how serious this threat is?


Yes, there are a lot of researches, and the last is the most impressive:

Researchers have shown for years that the popular fingerprint sensors used to guard smartphones can be tricked sometimes, using a lifted print or a person's digitized fingerprint data. But new findings from computer scientists at New York University's Tandon School of Engineering could raise the stakes significantly. The group has developed machine learning methods for generating fake fingerprints — called DeepMasterPrints — that not only dupe smartphone sensors, but can successfully masquerade as prints from numerous different people. Think of it as a skeleton key for fingerprint-protected devices.

So, of course, banks can't rely on fingerprints only, and their threat model should include such cases as well to build defence in depth.

  • Good to know... So I'm not crazy about this being a potential threat? Now I'm wondering if the banks have implemented any countermeasures. – EJoshuaS Dec 25 '18 at 17:41
  • Link to fill article cited: wired.com/story/… – EJoshuaS Dec 25 '18 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.