<story><title>Major breach found in biometrics system used by banks, police and defence firms</title><url>https://www.theguardian.com/technology/2019/aug/14/major-breach-found-in-biometrics-system-used-by-banks-uk-police-and-defence-firms</url></story><parent_chain></parent_chain><comment><author>e12e</author><text>Upstream post:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.vpnmentor.com&amp;#x2F;blog&amp;#x2F;report-biostar2-leak&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.vpnmentor.com&amp;#x2F;blog&amp;#x2F;report-biostar2-leak&amp;#x2F;&lt;/a&gt;&lt;p&gt;Quote :&lt;p&gt;Our team was able to access over 27.8 million records, a total of 23 gigabytes of data, which included the following information:&lt;p&gt;- Access to client admin panels, dashboards, back end controls, and permissions&lt;p&gt;- Fingerprint data&lt;p&gt;- Facial recognition information and images of users&lt;p&gt;- Unencrypted usernames, passwords, and user IDs&lt;p&gt;- Records of entry and exit to secure areas&lt;p&gt;- Employee records including start dates&lt;p&gt;- Employee security levels and clearances&lt;p&gt;- Personal details, including employee home address and emails&lt;p&gt;- Businesses’ employee structures and hierarchies&lt;p&gt;- Mobile device and OS information&lt;p&gt;One of the more surprising aspects of this leak was how unsecured the account passwords we accessed were. Plenty of accounts had ridiculously simple passwords, like “Password” and “abcd1234”. It’s difficult to imagine that people still don’t realize how easy this makes it for a hacker to access their account.</text></comment>
<story><title>Major breach found in biometrics system used by banks, police and defence firms</title><url>https://www.theguardian.com/technology/2019/aug/14/major-breach-found-in-biometrics-system-used-by-banks-uk-police-and-defence-firms</url></story><parent_chain></parent_chain><comment><author>Phemist</author><text>Biometrics as an authentication factor suffers from a &amp;quot;weakest-link&amp;quot; problem. The strength of authentication of _every_ system using biometric factors can only be as strong as the weakest, least secure implementation out of those systems.&lt;p&gt;Passwords suffer from the same &amp;quot;weakest-link&amp;quot; problem to a degree, but at least we can choose to have more than 1 or 2 and even more than 10 different passwords. Also, they can be changed after a leak. In biometric authentication, once your raw biometric data has been leaked, you are basically left to rely on the strength of the PAD (Presentation Attack Detection) and the (lack of) propagation of the leaked information.</text></comment>