7

Way back in 2016, our government's Commission on Election database was hacked. I am one of those 55 million people whose personal data was leaked and exposed including our fingerprints.

We are now at the age where smartphone apps are moving into using your biometrics/fingerprint so you can authenticate yourself faster and "safer". For example, major banks have a feature on their mobile app where you can authorise your payment request by putting in your biometrics. There are also some apps in which the 2FA confirmation is a fingerprint. There are even some smartphones that you can unlock if you put your finger on the sides.

I am deeply worried that since our personal data are already leaked, isn't it easy for hackers to authenticate/impersonate us by simply supplying the fingerprint signature they obtained from the hack?

7
  • 1
    They have to get hold of your phone and your personal data. Which is unlikely. What's most valuable at the moment is medical data. Perhaps, don't keep it on the phone. I seem to recall that the probability of someone else having the same fingerprints as you is 1 to 2 billion. So, statistically, there are 3 other people on the planet with your fingerprints. Feb 17, 2023 at 4:16
  • 4
    FYI: today it's possible to take a photo of you hand from 10-20 meters away and use that to create a mold of your fingers that will unlock phones or other devices using fingerprints. Multiple groups have already displayed that this is possible. And it's even easier if someone can get a hold of something you touched... I believe in MythBusters one episode was about reconstructing a fingerprint from a glass and it worked.
    – GACy20
    Feb 17, 2023 at 8:23
  • 2
    Fingerprints (and faceID etc) provide only mild security but they are incredibly convenient. Most people have passwords/pins like 123 password1 etc, for them fingerprints increases security a thousand fold. If you are using 20 character long password with big alphabet swapping those for fingerprints will reduce security (unless they are used as 2FA)
    – GACy20
    Feb 17, 2023 at 8:24
  • 2
    You expose your fingerprints every time you touch anything. If someone is after you, he can reconstruct your fingerprint without obtaining it from the breached data. That breach doesn't increase your threat model but it does provide minor convenience to the attacker.
    – defalt
    Feb 17, 2023 at 10:54
  • noted re convenience and the fact they are almost always retrievable. So, in theory, they can still use those leaked fingerprint data and impersonate us? I guess the question is, If you guys are me/us would you still use the fingerprint/biometric recording features of the mobile apps?
    – arvil
    Feb 17, 2023 at 19:03

1 Answer 1

4

Yes, you should be worried, but not as much as you think.

Your data being available digitally means that it is a lot easier for a possible attacker to abuse it than the many other attack paths, which usually require closer physical proximity (e.g. lifting your fingerprint off something you touched) or additional data to associate you with (e.g. high-resolution photographs of your hands/fingers).

That said, someone using your fingerprint data on your smartphone is not something that became considerably more likely due to this leak. Smartphones with fingerprint tech store the fingerprint data locally (e.g. Apple in the Secure Enclave). So someone would have to have access to your smartphone and the leaked data and know which fingerprint of those 55 mio. belongs to the owner of that particular smartphone. That is a pretty targeted attack. An adversary who can conduct such an attack is likely to have other and possibly easier attacks available to him.

So you should have the possibility that someone abuses your fingerprints in mind whenever something strange happens like bills for things you didn't order, etc. But it's not something you need to constantly think about, and definitely shouldn't stop you from using biometric authentication on your phone, because that's still better than having 1234 as your PIN.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .