Fingerprint forgery training: Easy to learn, hard to perform

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F23%3A00131644" target="_blank" >RIV/00216224:14330/23:00131644 - isvavai.cz</a>

Result on the web

<a href="http://dx.doi.org/10.1145/3600160.3604990" target="_blank" >http://dx.doi.org/10.1145/3600160.3604990</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1145/3600160.3604990" target="_blank" >10.1145/3600160.3604990</a>

Result language

angličtina

Original language name

Fingerprint forgery training: Easy to learn, hard to perform

Original language description

Many services offer fingerprint authentication, including sensitive services such as mobile banking. This broad adoption could make an impression to the end-users that fingerprint authentication is secure. However, fingerprint authentication is vulnerable to various attacks performed even by not-very-sophisticated attackers, e.g., fingerprint forgery. Will participants perceive fingerprint authentication differently after relevant theory education and the creation of their fingerprint counterfeit to overcome misunderstandings, especially regarding security? How will they perceive the fingerprint forgery process? We prepared a hands-on seminar with fingerprint forgery simulation. We focused on the difference in perception before and after the theoretical lecture on biometrics and a practical seminar on forgery creation. We applied an uncommon approach, reconstructing the fingerprint from a photo of the actual finger rather than its print on some surface – to illustrate the case of an attack based merely on a “thumb-up” photograph. Our results show that 19% of participants (out of 221) were successful in spoofing, according to the NIST Biometric Image Software, and 27% of participants could register their counterfeit into the smartphone. Participants perceived fingerprint authentication as less secure after the simulation and reported their intention to use it less for mobile banking operations. They also perceived the forgery attack as easier to learn than before the simulation – but harder to perform. Our study implies that participants intend to change their behaviour based on their experience from our seminar, however, they did not consider two-factor authentication as an option.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10200 - Computer and information sciences

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2023

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Proceedings of the 18th International Conference on Availability, Reliability and Security

ISBN

9798400707728

ISSN

—

e-ISSN

—

Number of pages

7

Pages from-to

1307-1313

Publisher name

Association for Computing Machinery

Place of publication

Benevento, Italy

Event location

Benevento, Italy

Event date

Jan 1, 2023

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

001122662500136