Re: Maybe I'm not as smart as these card tech guys...
"That's not how the card, or mobile phones work"
I'll think you'll find that he means he can get an image of your fingerprint quite easily.
And your phone fingerprint sensor can be fooled by an sufficiently good image of a fingerprint, printed onto certain surfaces. You don't even have to get very technical.
Every smartphone fingerprint sensor (and this card sensor) on the market can be fooled with nothing more than a picture of the fingerprint smudge you left on the card as you last took it out of your wallet. It just depends how many times you want to try it to refine your technique.
Last year, someone pulled the fingerprint of a German politician from a photograph of them raising a wine glass. All the "temperature/heat/light/pulse/etc." sensors in the world can't do much that isn't easily fooled, and the actual "fingerprint ID" process is still - to this day - finding the edges on a high-contrast B&W image of the fingerprint in question as it lays flat on a surface. Whether the sensor is swipe, scan, optical, or whatever.
I have a bunch of Gemalto etc. fingerprint readers in my junk box if you'd like to play. They almost all have open-source software that presents the image as a B&W TIFF from the sensors to something that edge-detects and then hashes / stores the result. How they store it is irrelevant if you can present the same image to the sensor and the sensor then hashes that to the same hash as a real fingerprint would hash. The hardware doesn't do anything fancy, but a bit of image processing and maybe a particular wavelength of light / check for colour variation for pulse (and that's an "advanced" model).
There's a reason they're all in my junk box despite being "state-of-the-art" for banking security at one point or another.
Biting the hand that feeds IT
