Welcome to the MacNN Forums.

turtle777 · Jan 19, 2007, 08:59 PM

Using finger prints instead of ATM cards and PINs.

Wired News: Thumb-Print Banking Takes India

Ok, so, if this gets popular in the US, I'm scared.

Next time you get mugged, it's not "Give me your wallet", but "Give me your thumb".

-t

Dakar² · Jan 19, 2007, 09:01 PM

If this is on digg, RR will find it. Then you.

turtle777 · Jan 19, 2007, 09:03 PM

Originally Posted by Dakar²

If this is on digg, RR will find it. Then you.

Well, maybe it is. I dunno. I don't do Digg. I found it directly on Wired.

-t

Dakar² · Jan 19, 2007, 09:05 PM

I tease. Good mag.

But it wouldn't be a complete surprise. I remembering hearing of a guy who couldn't/wouldn't take off a Rolex, so the thieves took his entire hand.

Sounds like it could be an urban legend, though.

Rumor · Jan 19, 2007, 09:10 PM

Couldn't someone use something like tape to get your thumbprint?

turtle777 · Jan 19, 2007, 09:12 PM

Originally Posted by Rumor

Couldn't someone use something like tape to get your thumbprint?

I think the latest thumbprint readers are quite sophisticated and can not easily be fooled.

-t

Rumor · Jan 19, 2007, 09:14 PM

Perhaps. If someone put something over the reader that couldn't be seen, the person using the ATM could just think it's broken, walk away and then the thief could take the thing that had the thumbprint.

If that makes any sense.

GSixZero · Jan 19, 2007, 09:31 PM

Did you see the mythbusters where they had the fingerprint door lock which the manufacturer claimed had never been scammed? They beat it on the first try.

I'm sure you'll still need a pin code to access your account. All good security is based on something you have, and something you know.

Railroader · Jan 19, 2007, 09:34 PM

Originally Posted by Dakar²

If this is on digg, RR will find it. Then you.

Only if he does a dozen or so.

Alas, I don't remember this on digg, but mythbusters did a treatment of it. Easy to defeat.

Kerrigan · Jan 19, 2007, 09:40 PM

Is it really such a hassle to press 1234 and then hit "enter"?

Railroader · Jan 19, 2007, 09:48 PM

Originally Posted by Kerrigan

Is it really such a hassle to press 1234 and then hit "enter"?

"number nine... number nine... number nine... number nine..."

Dakar² · Jan 19, 2007, 10:18 PM

Originally Posted by Railroader

Only if he does a dozen or so.

Alas, I don't remember this on digg, but mythbusters did a treatment of it. Easy to defeat.

Damn, I missed that one.

macroy · Jan 20, 2007, 01:16 AM

Originally Posted by Kerrigan

Is it really such a hassle to press 1234 and then hit "enter"?

I imagine its for security, not convenience. But I agree with you, ATM's already use MFA. So by just using a different factor isn't really making it more secure. In fact, if they only use biometrics and nothing else, one can argue that it would actually make it LESS secure than card and pin.

Marketing ploy - I think.

Railroader · Jan 20, 2007, 01:16 AM

I [HEART] Mythbusters.

Eug · Jan 20, 2007, 01:20 AM

Originally Posted by GSixZero

Did you see the mythbusters where they had the fingerprint door lock which the manufacturer claimed had never been scammed? They beat it on the first try.

Well, they beat it with more than one method, but IIRC, some took several tries.

I was still shocked at how easy it was to overcome this "security", nonetheless.

BTW, I live in Canada. I'd hate to have to take off my gloves in -20C weather to use an ATM.

Doofy · Jan 20, 2007, 01:28 AM

There's another problem with all this biometric stuff:

How, exactly, do you know that the guy who used the thing before you wasn't scratching his itchy backside just before he was asked for his print?

Screw that.

Eug · Jan 20, 2007, 01:36 AM

Originally Posted by Doofy

There's another problem with all this biometric stuff:

How, exactly, do you know that the guy who used the thing before you wasn't scratching his itchy backside just before he was asked for his print?

Screw that.

Yeah, but the same could be said for any ATM, since you have to press the buttons anyway. Or are you going to put on gloves in the summer when you use the ATM?

Gossamer · Jan 20, 2007, 01:37 AM

Originally Posted by Doofy

There's another problem with all this biometric stuff:

How, exactly, do you know that the guy who used the thing before you wasn't scratching his itchy backside just before he was asked for his print?

Screw that.

Well what's the difference between a fingerprint reader and a basic keypad, a doorknob, basically anything that people touch?

macroy · Jan 20, 2007, 01:44 AM

With your ATM card.. you also get ....

Peter · Jan 20, 2007, 03:18 AM

I'd rather just enter a PIN number...

Doofy · Jan 20, 2007, 04:26 AM

Originally Posted by Eug

Yeah, but the same could be said for any ATM, since you have to press the buttons anyway. Or are you going to put on gloves in the summer when you use the ATM?

Originally Posted by Gossamer

Well what's the difference between a fingerprint reader and a basic keypad, a doorknob, basically anything that people touch?

Exactly. Bring on the voice recognition. And the Trek doors in the bathroom.

ShotgunEd · Jan 21, 2007, 03:49 PM

Bring it all on.

I'm just back from Rome where I had my card skimmed. Don't ask me where or how, I only used it at two cash machines and I always shield my pin.

Luckily, I had no more cash in my account so all the fraudulent uses were declined. I noticed before I got paid and stopped the card. Very lucky was I.

The thumbprint thing sounds like a good idea but I agree that any thumbprint scanners I've ever read about have been easily fooled.

I say retina scan, DNA test, 5 security questions and a PIN. Then we'll be safe.

Railroader · Jan 21, 2007, 04:30 PM

Originally Posted by ShotgunEd

Bring it all on.

I'm just back from Rome where I had my card skimmed. Don't ask me where or how, I only used it at two cash machines and I always shield my pin.

Luckily, I had no more cash in my account so all the fraudulent uses were declined. I noticed before I got paid and stopped the card. Very lucky was I.

The thumbprint thing sounds like a good idea but I agree that any thumbprint scanners I've ever read about have been easily fooled.

I say retina scan, DNA test, 5 security questions and a PIN. Then we'll be safe.

The only time I had my account skimmed was the last time I left the US. What is it with getting jacked on vacation?

turtle777 · Jan 21, 2007, 04:50 PM

Originally Posted by Railroader

The only time I had my account skimmed was the last time I left the US. What is it with getting jacked on vacation?

ATM scams are more popular in Europe than in the US.

Why ? Because in the US, it's easier to scam someone using stolen identities and and using counterfeit checks.

-t

Railroader · Jan 21, 2007, 09:17 PM

Originally Posted by turtle777

ATM scams are more popular in Europe than in the US.

Why ? Because in the US, it's easier to scam someone using stolen identities and and using counterfeit checks.

-t

Good to know.

I think mine was stolen when I ate at a French restaurant in Montreal. That's the only place I remember using it in the city and the Michigan State police located the thief there.

Uncle Skeleton · Jan 21, 2007, 09:56 PM

Originally Posted by GSixZero

Did you see the mythbusters where they had the fingerprint door lock which the manufacturer claimed had never been scammed? They beat it on the first try.

I'm sure you'll still need a pin code to access your account. All good security is based on something you have, and something you know.

The problem with MythBusters is that you go away thinking "that settles it, thumbprint scanners are crap," but the tests they did weren't realistic. All their exploits invovled the cooperation of the person whose print was scanned. The infamous first try that succeeded was a xerox of the guy's print. It wasn't someone else's print and it wasn't a dummy. That's the equivalent of saying that traditional key locks are crap because you can get in if you've copied the legit key. No one has a xerox of my fingerprint, and they're not getting one, even if they knew which finger to use, which they don't. Same with lifting the prints, even if they get more than a partial, and they know which finger you used, it would take ages to line it up the same way you do on the scanner. Just have the machine reject you after 5 failures or something and it's not reasonable to break it.

One style of lock combines PIN and print by making you scan 4 or 5 of your prints in the correct order. I think this would be a more secure system than anything in use now, including voice recognition (put a voice recorder on top of the ATM?) or DNA (you leave DNA everywhere, ever seen GATTACA?). Maybe retina, maybe not, I'm not sure if those even work in the first place.

Anyway, it's hardly as vulnerable as the mythbusters episode made it seem.

Cadaver · Jan 21, 2007, 11:01 PM

And what of the people who own less than 10 fingers?

(not referring specifically to me, as I'm currently intact, but you never know).

Doofy · Jan 22, 2007, 12:22 AM

Originally Posted by Cadaver

And what of the people who own less than 10 fingers?

(not referring specifically to me, as I'm currently intact, but you never know).

Valid point. The local guitar shredder dude, Yngwie Van Vai, has no fingerprints on his right hand from a childhood burn accident and no fingerprints on his left hand from playing guitar (he's literally worn them off).

turtle777 · Jan 22, 2007, 12:23 AM

Originally Posted by Doofy

Valid point. The local guitar shredder dude, Yngwie Van Vai, has no fingerprints on his right hand from a childhood burn accident and no fingerprints on his left hand from playing guitar (he's literally worn them off).

Well, I know it's gonna be inconvenient, but he still has his toes

-t