• Fingerprint recognition is trivial relatively easy to defeat. For example, it is already possible to fool Apple's TouchID using nothing more than an image of the authenticated user's fingerprint (and their fingerprints are generally all over the phone's glass!). In this video I watched recently, some guys manage successful authentication of a fake fingerprint on their first attempt (although they make a mold from the finger directly). With slightly better techniques, it is possible to create a detailed mold from an image of the fingerprint (that is, the mark left by the finger, not the actual finger itself), and make a fake fingerprint that way. You only need to acquire an image of the target's fingerprint (how exactly I'll leave up to you). Note that their specific technique (using graphite-impregnated silicone rubber) is only required for the iPhone's capacitive fingerprint sensor. For your more typical image-based sensor you only need a shape-accurate mold.

• Modern iris recognition typically works by taking an image of the iris in visible or near-infrared light and comparing it to a database. (Some implement additional live-tissue verification by changing illumination conditions to test whether the pupil contracts and dilates, but this is not typical.) A typical system could be fooled by presenting it with a high-resolution image (scaled 1:1) of the target's eye. Actually creating the image is not a problem: I've gotten very good images of my own eyes with Nikon's base-level DSLR (D3300) and cheapest macro lens (f/2.8 40 mm MICRO-NIKKOR) (the only difficulty was not being able to see the camera while lining up the shot!). The problems are in printing the image with the requisite resolution (a photographic reduction on either film or photographic paper should work), and actually getting access to your target's eye. (You might have to c-a-r-e-f-u-l-l-y open his/her eyes while they're sleeping, perhaps after slipping them a sedative.)

• Face recognition could conceivably be fooled using modern technology to create a face-mask. In Mission: Impossible III (starting at around 47 minutes in, if you happen to own the film) the heros take several images of their target's face, using them to create a 3d model, which is then turned into a physical mask. Again, I've had success with such a technique: using an online service to make a 3d model out of images of my own face (still frames from a video of me turning slowly on an office chair), and then 3d-printing the model in plastic (alebit at a reduced size). With access to the proper software and a large-format, high quality 3d printer, you could definitely recreate someone's face from photographs. Of course, you could always just show one of the pictures to the camera, it would probably work.

• Side note: in the same sequence from M:i:III, the heros use a magic voice-changer sticker on the throat (under the facemask) to imitate the target's voice. While the depicted technology is probably not realistic, you could probably fool a voice-recognition system with a high-fidelity recording. Pose as a reporter and interview your target, in the process asking his/her name. (If the lock requires a voice password, you'll have to figure out what it is and reconstruct it from numerous audio clips.)

• Since DNA identification is not done in real life, I won't spend a lot of thought on this. However, you might look to the movie Gattaca for inspiration. The hero uses several methods to fool the movie's omnipresent DNA scanners, including blood-filled false fingertips for , and at one point secretly injecting himself with blood while a sample is being drawn (it's a great movie, but at times can be a little uncomfortable to watch for someone as squeamish as me). [This clip]9https://www.youtube.com/watch?v=Ou3j3CGcPPo) shows some others methods. However, these all require a cooperative target who can give as much material as necessary. Your Red Cross idea is a good one, but your target may not give blood, like me (did I mention I was squeamish?). DNA can also be harvested from saliva, hair follicles, skin cells and other sources, so you might just need to dig through their trash. And if you target is male and the promiscuous type, you may be able to acquire some of their, uh, "genetic material."

Finally, note that (depending on your definition of "biometric") there may be some credentials that are not possible to duplicate. See this very cool paper, which describes how a "password" consisting of a learned task (playing certain sequences of notes in Guitar Hero), subconciously trained into a user, cannot be conciously or unconciously disclosed by the user (meaning that it is impossible to communicate your credential to someone else, even if you want to). The system used by the researchers is impractical, but in the far future uncopyable passwords may be possible.

• Fingerprint recognition is trivial relatively easy to defeat. For example, it is already possible to fool Apple's TouchID using nothing more than an image of the authenticated user's fingerprint (and their fingerprints are generally all over the phone's glass!). In this video I watched recently, some guys manage successful authentication of a fake fingerprint on their first attempt (although they make a mold from the finger directly). With slightly better techniques, it is possible to create a detailed mold from an image of the fingerprint (that is, the mark left by the finger, not the actual finger itself), and make a fake fingerprint that way. You only need to acquire an image of the target's fingerprint (how exactly I'll leave up to you). Note that their specific technique (using graphite-impregnated silicone rubber) is only required for the iPhone's capacitive fingerprint sensor. For your more typical image-based sensor you only need a shape-accurate mold.

• Modern iris recognition typically works by taking an image of the iris in visible or near-infrared light and comparing it to a database. (Some implement additional live-tissue verification by changing illumination conditions to test whether the pupil contracts and dilates, but this is not typical.) A typical system could be fooled by presenting it with a high-resolution image (scaled 1:1) of the target's eye. Actually creating the image is not a problem: I've gotten very good images of my own eyes with Nikon's base-level DSLR (D3300) and cheapest macro lens (f/2.8 40 mm MICRO-NIKKOR) (the only difficulty was not being able to see the camera while lining up the shot!). The problems are in printing the image with the requisite resolution (a photographic reduction on either film or photographic paper should work), and actually getting access to your target's eye. (You might have to c-a-r-e-f-u-l-l-y open his/her eyes while they're sleeping, perhaps after slipping them a sedative.)

• Face recognition could conceivably be fooled using modern technology to create a face-mask. In Mission: Impossible III (starting at around 47 minutes in, if you happen to own the film) the heroes take several images of their target's face, using them to create a 3d model, which is then turned into a physical mask. Again, I've had success with such a technique: using an online service to make a 3d model out of images of my own face (still frames from a video of me turning slowly on an office chair), and then 3d-printing the model in plastic (albeit at a reduced size). With access to the proper software and a large-format, high quality 3d printer, you could definitely recreate someone's face from photographs. Of course, you could always just show one of the pictures to the camera, it would probably work.

• Side note: in the same sequence from M:i:III, the heroes use a magic voice-changer sticker on the throat (under the facemask) to imitate the target's voice. While the depicted technology is probably not realistic, you could probably fool a voice-recognition system with a high-fidelity recording. Pose as a reporter and interview your target, in the process asking his/her name. (If the lock requires a voice password, you'll have to figure out what it is and reconstruct it from numerous audio clips.)

• Since DNA identification is not done in real life, I won't spend a lot of thought on this. However, you might look to the movie Gattaca for inspiration. The hero uses several methods to fool the movie's omnipresent DNA scanners, including blood-filled false fingertips for , and at one point secretly injecting himself with blood while a sample is being drawn (it's a great movie, but at times can be a little uncomfortable to watch for someone as squeamish as me). This clip shows some others methods. However, these all require a cooperative target who can give as much material as necessary. Your Red Cross idea is a good one, but your target may not give blood, like me (did I mention I was squeamish?). DNA can also be harvested from saliva, hair follicles, skin cells and other sources, so you might just need to dig through their trash. And if you target is male and the promiscuous type, you may be able to acquire some of their, uh, "genetic material."

Finally, note that (depending on your definition of "biometric") there may be some credentials that are not possible to duplicate. See this very cool paper, which describes how a "password" consisting of a learned task (playing certain sequences of notes in Guitar Hero), subconsciously trained into a user, cannot be consciously or unconsciously disclosed by the user (meaning that it is impossible to communicate your credential to someone else, even if you want to). The system used by the researchers is impractical, but in the far future uncopyable passwords may be possible.