How Safe is Fingerprint Scanning on our Phones?

By Benedette Cuffari, M.Sc.Apr 13 2017

Image Credit: Shutterstcok.com/oatawa

Several modern smartphones are equipped with fingerprint sensors to perform various operations due to the convenience of this technology in comparison to passwords which need to be remembered and typed in numerous times daily.

Companies such as Apple and Samsung are utilizing this smartphone technology to not only unlock the phone, but to also authorize payments through mobile wallets such as Apple Pay and Samsung Pay¹.

In fact, a typical smartphone user can use this fingerprint sensing technology to perform several other operations such as downloading apps, signing into apps such as those for mobile banking purposes, as well as allowing users to transferring money various other apps¹. Even some laptops are incorporating this technology to carry out their basic operations.

In order to increase our sensitivity to touch, our fingers were evolved with swirling friction ridges that are unique to each and every one of us². Since no two human beings have the same exact set of fingerprints, fingerprints are the most common and widely used biometrics to identify a person.

However, all the ridges follow one of the three basic fingerprint patterns, of which include loop, whorl and arch patterns². The ridges in the loop pattern enter from one side of the finger to form a curve, and finally end on the same side, while the ridges form a circular pattern around a central point on the finger in the case of whorl pattern. In the arch pattern, the ridges enter from one side of the finger, rise in the center to form an arc and exit on the other side of the finger.

It is estimated that 60-65 % of people have a loop patterned finger print, while 30-35% have a whorl pattern, and the remaining 5% will have an arch pattern on their fingertips².

Fingerprint recognition, or fingerprint authentication, is an automated process of verifying a match between two human fingerprints. This validation process has been adopted into various fingerprint sensors used in several different gadgets such as smartphones and laptops. Although falsifying a full human fingerprint is difficult, it is quite possible in the case of the partial finger prints scanned by the small fingerprint sensors that are embedded into smartphones^1,2.

To compensate for their smaller size, the fingerprint sensors on the smartphone enroll multiple partial images of a single finger to ensure that at least one of the images matches the user’s fingerprint during authentication. Smart phones will also allow you to set up multiple finger prints including your thumb and all other fingers^3,4. Therefore, a typical fingerprint scanned by a sensor should match one of the several partial images of up to ten different reference fingerprints to perform several operations that can range from simply unlocking the phone, to authorizing a transfer of thousands of dollars.

Researchers at the New York University’s Department of Computer Science and Engineering have investigated the potential security risks of fingerprint sensors by generating a “MasterPrint” that could match one or more of the stored templates of a significant number of users by serendipity.

They defined MasterPrint as a synthetic or real partial fingerprint that matches at least 4% of the other prints in the randomly sampled batch. Nasir Memon’s team analyzed 8,200 partial fingerprints using commercial fingerprint verification software to validate the security concerns of the fingerprint scanners³.

The results revealed that it is possible to locate or generate partial fingerprints that could be used to impersonate the finger prints of a large number of users⁴. The researchers determined that an average of 92 potential MasterPrints exist for every randomly sampled batch of 800 partial fingerprints, while there was only one full-fingerprint MasterPrint in a sample of 800 full fingerprints³. These results suggest that there is a significantly greater chance of falsely matching a partial fingerprint, as compared to a full fingerprint.

The common attributes of human fingerprints combined with the inability of the smartphone fingerprint scanners to scan the complete fingerprints due to their smaller size while also utilizing partial images from multiple fingers of the same user to authenticate, pose a gaping security hole in such a widely used and greatly trusted technology. The researchers suggest that smartphone users can protect themselves by turning off fingerprint authentication for their most sensitive apps, such as mobile payments.

References:

1. Goel, Vindu. "That Fingerprint Sensor on Your Phone Is Not as Safe as You Think." The New York Times. The New York Times, 10 Apr. 2017. Web. https://www.nytimes.com/2017/04/10/technology/fingerprint-security-smartphones-apple-google-samsung.html.
2. Dunne, Daisy. "Why Fingerprint Sensors Are Not as Secure as You Think: Researchers Create 'MasterPrints' That Can Unlock ANY Phone." Daily Mail Online. Associated Newspapers, 11 Apr. 2017. Web. http://www.dailymail.co.uk/sciencetech/article-4400726/Fingerprint-sensors-fooled-new-Masterprints.html.
3. "So You Think You Can Secure Your Mobile Phone With a Fingerprint?" NYU Tandon School of Engineering. 10 Apr. 2017. Web. http://engineering.nyu.edu/press-releases/2017/04/10/so-you-think-you-can-secure-your-mobile-phone-fingerprint.
4. "MasterPrint: Exploring the Vulnerability of Partial Fingerprint-based Authentication Systems." IEE Explore Digital Library. Web. http://ieeexplore.ieee.org/document/7893784.

Disclaimer: The views expressed here are those of the author expressed in their private capacity and do not necessarily represent the views of AZoM.com Limited T/A AZoNetwork the owner and operator of this website. This disclaimer forms part of the Terms and conditions of use of this website.