Post
Topic
Board Bitcoin Discussion
Re: Fingerprint private key
by
shorena
on 07/04/2015, 21:52:16 UTC
I would be worried not only about creating it online, but the inherent security of finger print scanners. I bought one to experiment with security for my laptop. It was cool. But once it was working properly the hacker in me set out to defeat it. Unfortunately it was easy. I lifted my print from a drinking glass with Scotch tape and pencil lead dust (not even superglue vapor). I placed the tape on a different finger and scanned it. It was far too easy.  Undecided

Starbug only needs a picture of your finger[1][2]. Its incredible that this is still a "security" mechanism in passports.

I don't see how could this be useful. I only see fingerprints useful to access funds, and we already have that (things like TouchID).

For key generation it would probably be more useful to use things that aren't easily accessible, such as a retina scan. Now that would be nice, either for generation or accessing funds Smiley

See above or here[3], thats no better.

I doubt there is any serious work beeing done in that direction. The main problem with fingerprints is that you leave them literally everywhere. Every glass you use could be used to gather your fingerprints. You would end up with a private key which is only protected by a password. We already got that, its called a brainwallet.

That makes sense, it definitely isnt a safe way to store a private key. I was trying to think about someway to store a private key without the need of writing things somewhere(that can get lost) or of remembering long paraphrases.
I don't think that people realize that this is actually a very bad idea. You could get amnesia, some form of dementia e.g. early onset Alzheimer's.
As for OP using a fingerprint is not safe. You leave so many fingerprints everywhere. One could easily follow you and extract one (if you live in a crowded city) without you noticing it.

I think the point was to find something that can not be lost and not be forgotten easily. Both is true for the finger, even though you might lose the prints you still have the original finger as long as you dont burn or cut yourself. I think OPs idea was the reduce the strength of the passphrase (e.g. a HD wallet seed) and make up for the loss of security with the finger print. Thus its easier to remember than a seed alone, but still as secure.


[1] sorry german -> http://media.ccc.de/browse/congress/2014/31c3_-_6450_-_de_-_saal_1_-_201412272030_-_ich_sehe_also_bin_ich_du_-_starbug.html#video
[2] english article -> http://arstechnica.com/security/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/
[3] http://www.forbes.com/sites/thomasbrewster/2015/03/05/clone-putins-eyes-using-google-images/