82

First: password is used to get access to the full disk encryption key fingerprint is used to unlock the screen (of an already "decrypted" device) Encryption key retrieval must be: accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be ...


43

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements. As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin /...


21

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


17

There is no thumbprint included in the certificate. What is included is a signature which is used to build the trust chain. The thumbprint (or fingerprint) is just a hash over the certificate to make it easier for humans to compare certificates. It is not included but computed when needed.


14

Not using a cryptographic hash - no. But you could use a Fuzzy Hash or Locality-sensitive Hashing. Fuzzy hashes are different from normal hashes in that they allow similar content to cluster together in the hash collision space*. Typically one-way means you can not infer what was hashed - but with fuzzy hashes, if you know a similar file (fingerprint image)...


13

No, this is not possible. Depending on the key exchange mechanism in use, there are (slightly) different mechanisms for proving the identity of the server. This is defined in RFC4253 where it requires "explicit server authentication." In the case of RSA (RFC 4432), the server signs a piece of data provided by the client (actually a hash of several pieces) ...


13

Reliably deriving cryptographic keys from biometric data is hard because of thresholds: biometric data is a continuum, but cryptographic keys are binary: a bit is a zero or a one, not something in between. Whenever you design a scheme to transform biometric data into keys, there will be people whose biometric data falls "on the edge" and who will get a wrong ...


9

This is what FiveThirtyEight.com has to say: What To Do With A Million Stolen Fingerprints Hint: Think bigger than iPhones. [Fingerprints] could be used to sniff out individuals operating in a foreign country under false identities. Imagine that you, an American spy, travel to Hackistan ostensibly to work as the ambassador’s dog walker. The ...


9

User agent strings are maddly complicated for historical reasons. It is a long story, but the short version is that everybody wanted to look like someone else to circumwent servers restricting access to webpages based on browsers. Yes, that used to be a thing back in the days. And now we are stuck with this sad mess. The good news is that this means that ...


9

The iPhone 5S scanner was successfully fooled with a low-tech approach that has been known for a decade. The CCC published a plastic film with the finger print of the German Minister of the Interior a couple of years ago. It was taken from a glass of beer. The thin plastic film is put on a real finger, so that body temperature and a heartbeat is detected. ...


9

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive touch where a human finger's natural electric conductivity is ...


8

The problem is that the server cannot store a hash of the fingerprint, because the fingerprint can come with slight variations that would give a completely different hash. And if your fingerprint is compromised (either by taking it on a object you have touched or directly from the server) you can hardly change it - ok you can use up to ten fingers. But a ...


8

GnuPG generally resolves subkeys to the primary key if a subkey is passed as argument. This might be especially surprising when specifying an encryption subkey: GnuPG resolves the subkey to the primary key, and might actually choose another subkey for encryption (selecting the newest encryption subkey). For listing a key, this is always performed, for some ...


7

Let's consider the oldest biometric method - fingerprinting. Although fingerprinting has been around since the 1890s as a forensic tool, there is still no uniform international standard for recording fingerprint Minutiae or comparing them. The closest de-facto standard is ANSI/NIST-ITL 1-2011 (see section 8.9). There is also no legal rigor in fingerprint ...


7

This site describes the techniques used in canvas fingerprinting: The technique is based on the fact that the same canvas image may be rendered differently in different computers. This happens for several reasons. At the image format level – web browsers uses different image processing engines, image export options, compression level, the final images may ...


6

OpenPGP Key IDs OpenPGP key IDs (and fingerprints) are used to reference keys when performing several actions like requesting and sending keys, or when verifying ownership. For example, you'd exchange the fingerprint with the key's owner on a separate, trusted channel to make sure the key really belongs to the person that claims to own the key. The OpenPGP ...


6

Tricky question! It will be hard for us to give certain answers, we may only guess that they might employ fingerprinting techniques that match in both VMs. For example, the VMs might both have have the same operating system, user agent string, set of fonts, give the same canvas fingerprint, have similar CPU performance, etc. It might also be that they found ...


4

Not sure if you mean manually or automatically. Manually -- yes -- you can view the thumbprint of the certificate that reaches your browser, e.g. in Chrome you would right-click the part of the address bar to the left of the address, choose Details, View Certificate, and click on the details tab. The thumbprint is at or near the bottom. Automatically -- ...


4

There are two questions here I think. The first, is it so serious that the best course of action would be to block the device altogether? Well, let me start by asking a question. How much do you value your fingerprint data? What about your Apple Pay data? As you are a non-Apple user, Apple uses this "secure enclave" to store this data. When you enroll in ...


4

Short answer: No. The attacker needs the private key too. The SSH protocol uses encryption to secure the transmission. So, it will employ a public and private key. It's possible to someone to send you a spoofed public key, but without the corresponding private key, they will not be able to decrypt the communication, the handshake will fail and your client ...


4

I'm afraid I do not have a good answer, but I do have some thoughts to consider that might help others to find a good answer. You leave your fingerprint behind everywhere already. However if someone wants to get your fingerprint, they currently have to spend the time and energy to get physically close to you and find a spot where they can lift a good ...


4

Here's a relevant section of Apple's "iOS Security" document: The fingerprint sensor is active only when the capacitive steel ring that surrounds the Home button detects the touch of a finger, which triggers the advanced imaging array to scan the finger and send the scan to the Secure Enclave. The raster scan is temporarily stored in encrypted ...


4

I'm not sure you'd need a special hash function for this. You'd just use the output of the biometric as the salt. The bigger problem is how you would normalize the biometric for use in such a strict way. Normally, biometric analysis allows for some small variation. If you just pumped the biometric output directly to salt, then the user would have to get ...


4

The risk greatly depends on the type of fingerprints reader you have on your phone/laptop, on top of any software consideration. http://www.androidauthority.com/how-fingerprint-scanners-work-670934/ According to that article, the most basic fingerprint scanner can be fooled just with an image of your fingerprints, the most advanced requiring something like ...


4

For TouchID, the fingerprint doesn't leave the phone (as stated by Apple when they introduced touchID). The API called LocalAuthentication and is relatively straightforward: https://developer.apple.com/documentation/localauthentication This tutorial is also well explained: http://www.appcoda.com/touch-id-api-ios8/ As stated by the others, the issue ...


4

You've missed a key word in the download page: You can verify the signing certificate on the APK matches this SHA256 fingerprint (emphasis mine) APK files are just ZIP files in reality, so open it up with whatever archive tool you want (I use 7zip) and extract META-INF\CERT.RSA from it. You can then verify that the certificate fingerprint matches what ...


4

That probably depends on the banking application and how the bank allows you to recover a lost PIN. I would normally say "you should enable PIN or fingerprint authentication", but in fact you might not be required to. PIN/fingerprint is breakfast for security-aware individuals. Let's analyse the few information you provided. That you are enabled to pay by ...


3

A couple of possibilities: Backup and restore the keys. I use a script to backup both public and private keys in an encrypted archive (tar.bz2) file to a local server over rsync. Use a set of private keys and reuse them across systems - probably not a good idea unless the area is secure and the chances of MITM are slim. Use keys signed by a trusted ...


3

Well, If you may believe what their policy says, you shouldn't be that worried. In fact, even if they'd store your fingerprints and their database would be leaked doesn't mean that everyone can copy your fingerprint in the wild. Because a biometric device scans a part of your body (e.g finger) but the software used in that device must convert that image to ...


3

Well I can only provide anecdotal evidence for this, but I have seen a site that I was reviewing make use of Panopticlick style functionality for tracking, so it definitely does occur. It appeared to be part of their overall user tracking / analytics set-up


Only top voted, non community-wiki answers of a minimum length are eligible