Jan Krissler

Jan Krissler, widely known by his hacker handle Starbug, is a German security researcher affiliated with the Chaos Computer Club (CCC) who has become one of the most prominent public demonstrators of weaknesses in biometric authentication technology. Over roughly a decade, he repeatedly showed that fingerprint and iris sensors marketed as strong security features could be defeated with photography and inexpensive materials.

Krissler worked as a researcher affiliated with Technische Universität Berlin's T-Labs and has long been active within CCC's biometrics team. As early as 2008 he and CCC colleagues published a lifted fingerprint of then-German Interior Minister Wolfgang Schäuble, obtained by photographing a glass he had used, as a protest against biometric passports.

Defeating Apple's Touch ID (2013)

On September 22, 2013, just two days after Apple launched the iPhone 5S with its Touch ID fingerprint sensor, Krissler and the CCC biometrics team announced they had bypassed it. The team photographed a fingerprint left on a glass surface, cleaned and inverted the image, laser-printed it onto transparent film, and applied a layer of latex or wood glue to create a fake finger that unlocked the device.

Reconstructing a Minister's Fingerprint from Photographs (2014)

At the 31st Chaos Communication Congress (31C3) in December 2014, Krissler went further, showing that physical access to a print was not even necessary. Using a photograph of German Defense Minister Ursula von der Leyen's thumb taken from about three meters away, along with close-up shots released by her own press office, he used commercial fingerprint-reconstruction software to extract a usable fingerprint image. At the same talk he described how iris patterns could similarly be captured from a distance.

Bypassing the Samsung Galaxy S8 Iris Scanner (2017)

In May 2017, shortly after Samsung introduced iris recognition on the Galaxy S8, Krissler and the CCC demonstrated a bypass using a photograph of a subject's eye and a contact lens placed over the printout to mimic the curvature of a real eye.

Legacy

Across these demonstrations, Krissler's methodology combined high-resolution photography, image-processing tools, and low-cost physical fabrication techniques to produce spoofs capable of fooling sensors. His work has been widely cited in discussions of the limits of biometric authentication, reinforcing the argument that biometric traits should be treated as identifiers rather than secrets.

Timeline

• 2008Krissler and CCC colleagues published German Interior Minister Wolfgang Schäuble's fingerprint, lifted from a glass.
• 2013-09-22Defeated Apple's Touch ID fingerprint sensor, days after the iPhone 5S launch.
• 2014-12-28At 31C3, demonstrated reconstructing German Defense Minister Ursula von der Leyen's fingerprint from photographs.
• 2017-05-23Demonstrated bypassing the Samsung Galaxy S8's iris scanner using a photographed iris and a contact lens.