I Replaced My Fingerprints With Prosthetics to Avoid Surveillance

With face recognition on the rise and fingerprint readers on our phones, it's no secret that biometrics are quickly becoming the keys to our digital devices, cars, bank accounts, and so much else.

There are some good reasons for biometric authentication. It's still too easy for hackers to access someone's account by fooling a customer service rep, and many people tend to reuse the same weak passwords for seemingly everything. But biometrics can still be leaked, and unlike the infinitely-changeable PINs and passwords of yore, we're pretty much stuck with them forever.

So in preparation for this brave new world, I decided to replace my fingerprints. And remarkably, it was as easy and painless as applying a Band-Aid.

My substitute prints were provided by Mian Wei, a third-year industrial design student at the Rhode Island School of Design. Using his IDENTITY kit, anyone can cover their real fingerprint with a fake one that's fully-functional, replaceable, and practically impossible to copy.

"Many people believe we are all cyborgs now, connected to the internet 24 hours," Wei told me when we met recently at a cafe near Harvard Square in Cambridge. "When we set our own piece of skin as the passcode, it is a solid and definite connection. You can [Photoshop] your face now, but you can't really change your fingerprints, and you [lose] them on everything you touch."

To fully grasp how much a biometric future might suck, consider the 5.6 million US government employees and contractors whose fingerprints were stolen last year in a massive breach at the Office of Personnel Management. Using those prints, researchers have shown that a savvy criminal or government spook could create functional copies of their owners' fingers. Given how many consumer devices have fingerprint readers these days, that means a leaked fingerprint could grant access to all kinds of private data, and there would be virtually nothing the victim could do about it.

Created for a prosthetics design class, Wei said the goal of his project was to make a biometric privacy product that people might actually use in the real world. IDENTITY's packaging is designed to look like something you'd find on a shelf at your local drug store, and each fingerprint-spoofing strip is individually wrapped—like bandages in some kind of counter-surveillance first aid kit.

The sticky black prosthetics are made from a mixture of conductive silicone and contain a random mess of fibers, which replace the tiny ridges that sensors normally look for on a real fingerprint. Once wrapped around my index finger, I could assign the false fingerprint to unlock my phone just like I would with my actual finger.

Now, even if someone managed to make a mold of my real fingerprint—as a member of the Chaos Computer Club did in 2013 to spoof the iPhone's TouchID sensor—they still wouldn't be able to unlock my phone.

Even further, the print created by the false finger when it touches objects isn't really a "pattern" so much as a bunch of random lines; the fibers that form those lines are simply mixed into the silicone material, then cured and sliced into small strips. That means the prosthetic's impression would be virtually impossible to recognize as a fingerprint, let alone duplicate, Wei says.

So would anyone in their right mind actually use a replaceable fingerprint? After two weeks of wearing one of Wei's IDENTITY prosthetics, my general feeling was: probably, under the right circumstances.

The good news is it definitely works. Once I had assigned the fake finger to unlock my phone, the prosthetic was just as dependable as my real finger. (I was using an iPhone 6S and a Nexus 5X, but you'd theoretically get the same results on any device with a fingerprint reader.)

The only time I removed the band was before going to sleep. Ideally I would have left it on constantly, but I didn't want to risk losing it in the shower or under my bedsheets.

Putting the prosthetic back on each morning wasn't such a big chore though; it was no more laborious than putting in contact lenses, and fit naturally into my morning rituals. This did present a small problem though: Since I had enrolled only a certain segment of the silicone band with my phone when I first put it on, I'd have to remember to put it back on in exactly the same way each time.

Luckily, I developed a workaround that made things easier: Each time I put the prosthetic back on, I would go back into my phone's settings and enroll a new fingerprint. I eventually did this enough times that most sections of the band were able to unlock the phone, and I didn't have to worry as much about wearing it "correctly."

Much like a band-aid, I was always conscious of the fake fingerprint while wearing it, especially during the first few days. The prosthetic is slightly elastic and sticky and needed to be wrapped carefully around my finger to prevent it from falling off. Washing my hands, cooking, and other quotidian feats of manual dexterity had to be done cautiously to avoid losing the band. Typing—which I do quite a lot of—was also super annoying at first, but got slightly easier as time went on.

Granted, wearing a single prosthetic near-constantly for so long is probably not what its creator had in mind. While my fake fingerprint still worked perfectly after two weeks, Wei designed the prosthetic to be disposable. Right now, IDENTITY is mostly a showpiece, but if he does wind up mass-producing and selling them (which he's currently talking to a manufacturing firm about doing), Wei says you could theoretically replace the band as often as you want.

I ultimately found that the best use cases for fake fingerprints are situational. One prime example: If you're attending a political protest, a fake fingerprint could prevent police from forcing you to unlock your phone if you're arrested.

In the US, courts have recently ruled that unlike a PIN or password, the 5th Amendment's protections against self-incrimination don't apply to fingerprints, since they're technically a body part and not "information" stored in your head. That means if you're ever arrested, a cop could legally compel you to unlock a device using your fingerprint, without a warrant.

But a protester wearing one of Wei's IDENTITY strips could avoid being compelled by discreetely discarding the prosthetic.

Government spooks also wouldn't be able to unlock the phone by replicating the owner's fingerprint from one stored in a biometric database. A new report from the US Government Accountability Office revealed that the FBI's Next Generation Identification database has collected hundreds of millions of fingerprints and face recognition photos, a majority of which belong to Americans who have never even been suspected of a crime.

Still, for most people with iPhones, their device's built-in security features are probably more than sufficient to deter most intruders. Apple has engineered its most recent models to automatically disable fingerprint unlock and require the user's passcode after five unsuccessful attempts, among other conditions. (Android, with its fragmented security ecosystem, is another story entirely.)

At the end of the day, IDENTITY is a provocation—and a very good one, at that. Rather than create a be-all, end-all solution, Wei has made a functional prototype that imagines a future in which we can reap the benefits of biometrics while also preserving our privacy and autonomy. Even if consumers don't rush to replace their fingerprints now, using IDENTITY made a compelling case for how we might one day take back control.