Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Westie
May 30, 2013



Baboon Simulator
e: i'm retarded

Adbot
ADBOT LOVES YOU

Carthag Tuek
Oct 15, 2005

Tider skal komme,
tider skal henrulle,
slægt skal følge slægters gang



hackbunny posted:

I don't understand one thing: what are minutiae? how can two scanners pick the same set (or close enough I guess) of print features to translate into minutiae?

as i understood it, they're a bunch of point+direction vectors

so since a fingerprint is a bunch of curves following each other around, if you pick near enough points, theyll have similar directions & thus if enough points+directions are similar (for some threshold), theyre a match

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av
I have difficulty visualizing it

cinci zoo sniper
Mar 15, 2013




hackbunny posted:

I have difficulty visualizing it
https://forums.somethingawful.com/showthread.php?threadid=3712267&pagenumber=262&perpage=40#post450622929

quote:

When stored digitally, fingerprints are nearly _always_ stored as a simple series of minutiae points which are just sets of 3 numbers: x/y coordinates and 'theta', which represents the angle, e.g. which direction that particular feature is facing. Some new systems include a fourth value for curvature' but almost nobody is using this.

Visualized, a minutiae field on top of a fingerprint looks like this:



In the world of digital biometrics, storing an actual image of the fingerprint is tantamount to storing a password in plain text. It's a stupid babby mistake that absolutely nobody should be making. The flashing fingerprints on computer screens you see on CSI are total bunk.

Nearly all matching is based loosely around an ancient algorithm called "Bozorth" which iterates each individual minutia point in both candidate fingerprints, compares distance and angle to all nearby points, and arrives at a cumulative distance score. Here's what it looks like for one minutia point on 2 fingerprints:



It has to be done this way because fingerprints differ significantly from one impression to the next, even when they are the same finger. Skin stretches, people get scratches or cuts, people age, etc. For 1:1 (e.g. 'verification') Matching accuracy is very good. For 1:N (e.g. identification') it can be pretty accurate, but still depends on the quality and size of the fingerprint DB. False positives are definitely possible. As mentioned before, the threshold for a distance score that qualifies as a match is basically just an arbitrary confidence level which was predetermined statistically.

Naturally the biggest concern is storing these strings of minutia securely, because they contain enough data for an attacker to reconstruct a fingerprint just from the minutia. There are some very good systems out there that can perform essentially a one-way transformation on the data, like a hash, but still retaining the ability to perform 'fuzzy' matching with new samples that are not 100% identical. I wrote my master's thesis in CS on the subject. The stuff works, but nobody is using it because so far there's no demand anywhere that biometrics be handled securely, and there probably never will be. I was working for a biometrics security startup at the time which was trying to market one of these solutions, and we predictably failed and went out of business.

Anyway that's my fingerprint derail hope you liked it

fins
May 31, 2011

Floss Finder

hackbunny posted:

I have difficulty visualizing it

some additional material here:
http://www.intechopen.com/books/biometrics/minutiae-based-fingerprint-extraction-and-recognition

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

OSI bean dip posted:

everything is plaintext http

you don't wrap a DH session in https, the whole point is that you're able to do it in the clear on an untrusted channel. their implementation is probably poo poo, though

BangersInMyKnickers fucked around with this message at 13:59 on Sep 8, 2016

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

surebet posted:



force of habit re: blanking the password, uppercase and numbers only, 7 characters long, over unencrypted email lol

at least it's case sensitive

wrt their million bit key, all that the registration process shot my way was about 96 packets of 54 bits, with only a few actual bits of content per

lol lanmanager

Thanks Ants
May 21, 2004

#essereFerrari


Westie posted:

I think I know the David Duke they're referring to in CubeiTz

such an expert at keeping his stuff secure that none of his published work has leaked out into the community

NoneMoreNegative
Jul 20, 2000
GOTH FASCISTIC
PAIN
MASTER




shit wizard dad

honestly I'm kinda surprised that there isn't a fingerprint image stored as well as the mathematical description, some lawyer must have tried a truthiness-based 'But we can't actually see a comparison of the original print and the crime scene print?' thing where the numbers could be wrong :aaa:

I mean you could reduce a suspect to a big and very accurate list of phrenology-style measurements in a vector image, but a mugshot is still a mugshot.

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

yes, but, what if a different scanner picks a completely different set of points? like, take this print:



what stops a different scanner from picking samples from entirely different coordinates? how will you match minutiae if they form completely different constellations? or this image



is misleading me?

EVGA Longoria
Dec 25, 2005

Let's go exploring!

Have we talked about the mubix login credentials thing yet? http://arstechnica.com/security/2016/09/stealing-login-credentials-from-a-locked-pc-or-mac-just-got-easier/

I swear to god, every day convinces me that movie hackers are more right than they ever knew

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

yes, this was helpful. alright, they aren't picked randomly

quote:

The two most prominent local ridge characteristics are: 1) ridge ending and, 2) ridge bifurcation. A ridge ending is defined as the point where a ridge ends abruptly. A ridge bifurcation is defined as the point where a ridge forks or diverges into branch ridges. Collectively, these features are called minutiae.

they are specific features of fingerprint ridges. it's expected that different scanners will pick roughly the same "constellations"

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av

EVGA Longoria posted:

Have we talked about the mubix login credentials thing yet? http://arstechnica.com/security/2016/09/stealing-login-credentials-from-a-locked-pc-or-mac-just-got-easier/

I swear to god, every day convinces me that movie hackers are more right than they ever knew

now all he needs to do is emulate a usb keyboard too and automatically punch in the cracked password

fins
May 31, 2011

Floss Finder
http://blog.cyren.com/articles/windows-media-player-drm-feature-used-for-malware-delivery-again.html

quote:

Movie and TV watchers who download pirated content have long been warned of the potential for malware that might accompany their chosen media. Now use is again being made of Digital Rights Management (DRM) functionality — designed to prevent piracy — to distribute malware.

The new attack, brought to Cyren’s attention by security researcher Amitay Dan, abuses a DRM popup message function that is built into Windows Media Player.

Shame Boy
Mar 2, 2010

hackbunny posted:

yes, this was helpful. alright, they aren't picked randomly


they are specific features of fingerprint ridges. it's expected that different scanners will pick roughly the same "constellations"

yeah i was gonna say from my understanding the idea is the points are picked to maximally describe the fingerprint itself rather than just "computer saw a line here"

Shame Boy
Mar 2, 2010


did windows media player ever not deliver malware? like i got one of the only viruses i ever got back when i was an awkward teen trying to score porn that opened in windows media player and tried to acquire rights and then virus

Shaggar
Apr 26, 2006
its not a new issue and it requires the user to install the malware manually. its the same as if you clicked a link to funspyware.ru and clicked a download now link and ran what it downloaded.

hackbunny
Jul 22, 2007

I haven't been on SA for years but the person who gave me my previous av as a joke felt guilty for doing so and decided to get me a non-shitty av
yeah a big yawn. the drm url thing has always been used for malware

Powerful Two-Hander
Mar 10, 2004

Mods please change my name to "Tooter Skeleton" TIA.


EVGA Longoria posted:

Have we talked about the mubix login credentials thing yet? http://arstechnica.com/security/2016/09/stealing-login-credentials-from-a-locked-pc-or-mac-just-got-easier/

I swear to god, every day convinces me that movie hackers are more right than they ever knew

ntlmao

YO MAMA HEAD
Sep 11, 2007

Bhodi posted:

yep, 100℅ shitshow and of course jeff is still there and in fact got promoted twice since the start of it

did you use a "care of" symbol instead of a percent sign? how does that even happen

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

YO MAMA HEAD posted:

did you use a "care of" symbol instead of a percent sign? how does that even happen

loving lol

ate shit on live tv
Feb 15, 2004

by Azathoth

I assume it's a different David Duke, but who knows.

ate shit on live tv fucked around with this message at 15:27 on Sep 8, 2016

ate shit on live tv
Feb 15, 2004

by Azathoth

NoneMoreNegative posted:

honestly I'm kinda surprised that there isn't a fingerprint image stored as well as the mathematical description, some lawyer must have tried a truthiness-based 'But we can't actually see a comparison of the original print and the crime scene print?' thing where the numbers could be wrong :aaa:

I mean you could reduce a suspect to a big and very accurate list of phrenology-style measurements in a vector image, but a mugshot is still a mugshot.

Forensic's like fingerprints, video, photos, even DNA have long been the subject of attack by defense attorney's . It doesn't help that fingerprints were notoriously unreliable such that you could get a "fingerprinting expert" to match pretty much any fingerprint to any person's finger you wanted to. I assume it's gotten better but I really don't think fingerprint's are a slam dunk for a prosecutor.

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

YO MAMA HEAD posted:

did you use a "care of" symbol instead of a percent sign? how does that even happen
phone postin', blame the android and my terrible eyesight

didn't even notice until you pointed it out, lmao

Jimmy Carter
Nov 3, 2005

THIS MOTHERDUCKER
FLIES IN STYLE

Parallel Paraplegic posted:

did windows media player ever not deliver malware? like i got one of the only viruses i ever got back when i was an awkward teen trying to score porn that opened in windows media player and tried to acquire rights and then virus

pretty much every person I've ever seen install malware on their mac was because they clicked an INSTALL ADOBE FLASH TO VIEW THIS CONTENT popup and they just double-clicked the hyper-generic installer icon

ultramiraculous
Nov 12, 2003

"No..."
Grimey Drawer

Bhodi posted:

phone postin', blame the android and my terrible eyesight

didn't even notice until you pointed it out, lmao

i'm still not sure how this answers the "how did this happen?" question

YO MAMA HEAD
Sep 11, 2007

100↉ weird

Bhodi
Dec 9, 2007

Oh, it's just a cat.
Pillbug

ultramiraculous posted:

i'm still not sure how this answers the "how did this happen?" question
well you see i hit one button instead of the other button

The MUMPSorceress
Jan 6, 2012


^SHTPSTS

Gary’s Answer

Parallel Paraplegic posted:

did windows media player ever not deliver malware? like i got one of the only viruses i ever got back when i was an awkward teen trying to score porn that opened in windows media player and tried to acquire rights and then virus

this is why i always configure wmp to never try to acquire rights or additional data about files from the internet. if the file wont play without getting some mysterious extra data from the internet, i need to scrub that poo poo immediately.

burning swine
May 26, 2004



hackbunny posted:

I don't understand one thing: what are minutiae? how can two scanners pick the same set (or close enough I guess) of print features to translate into minutiae?

The book has it right, they're specific kinds of formations like ridge endings, ridge bifurcations, "islands", the swirly bit in the middle (called a 'whorl'), etc. There's less than a dozen kinds of minutiae but scanners are all very good at picking them up. It _is_ the case that sometimes different scanners will produce differing results, but usually the bulk of the points are the same, and since the entire matching process is inherently tolerant of minor differences, it isn't really an issue.

burning swine
May 26, 2004



NoneMoreNegative posted:

honestly I'm kinda surprised that there isn't a fingerprint image stored as well as the mathematical description, some lawyer must have tried a truthiness-based 'But we can't actually see a comparison of the original print and the crime scene print?' thing where the numbers could be wrong :aaa:

I mean you could reduce a suspect to a big and very accurate list of phrenology-style measurements in a vector image, but a mugshot is still a mugshot.

As far as I know, fingerprints used as evidence of a crime still require manual comparison by a human being. You could search AFIS for matching prints using a latent print found at a crime scene and non-image copy stored in the database, but if you get a match you're going to end up arresting the dude and re-fingerprinting him with ink and paper to do the verification.

Also, governments aren't necessarily doing biometrics "right", in many cases we know they're storing a full image. See also: OPM leak

NoneMoreNegative
Jul 20, 2000
GOTH FASCISTIC
PAIN
MASTER




shit wizard dad

^^ah that makes more sense

I read this on my teabreak, interesting stuff

http://issues.org/20-1/mnookin/

Wiggly Wayne DDS
Sep 11, 2010



i didn't realise amazon didn't notify you of review comments by default

https://www.amazon.co.uk/review/R361O173FGIW4O/

i guess i should get ready to film if they insist on their poo poo being any good

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender

Wiggly Wayne DDS posted:

i didn't realise amazon didn't notify you of review comments by default

https://www.amazon.co.uk/review/R361O173FGIW4O/

i guess i should get ready to film if they insist on their poo poo being any good

lmao

bicycle
Oct 23, 2013
https://motherboard.vice.com/read/fbi-arrests-two-alleged-members-of-group-that-hacked-the-cia-director

Two more CWA arrests - some sad opsec fails including chat logs and accessing twitter accounts using parents internet connection and a really disappointing description of goatse

Westie
May 30, 2013



Baboon Simulator

Westie posted:

I think I know the David Duke they're referring to in CubeiTz

yes, i've just checked, he's the dad of someone i knew from school

oh god this is hilarious

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender

Westie posted:

yes, i've just checked, he's the dad of someone i knew from school

oh god this is hilarious

lmao

Thanks Ants
May 21, 2004

#essereFerrari


i guess it goes without saying that they are in fact not an internationally renowned infosec expert?

Deep Dish Fuckfest
Sep 6, 2006

Advanced
Computer Touching


Toilet Rascal

Westie posted:

yes, i've just checked, he's the dad of someone i knew from school

oh god this is hilarious

dadsec

Adbot
ADBOT LOVES YOU

neutral milf hotel
Oct 9, 2001

by Fluffdaddy

dadsec joke

hey Phil, can you make me an account on the Dev server?

Phil: *taps you on the head* now you're an account on the Dev server! :haw:

  • Locked thread