Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to buy a USB fingerprint scanner. I intend to use it to log in into my Windows computer, to secure RoboForm password manager, and generally to replace password entry with a quick finger sweep in as many places as possible.

What I'm asking here is not a shopping recommendation. Instead, I would like to know what are the key technical parameters that I should use to compare different fingerprint biometric scanners available today. Quick search on eBay returns devices that cost from $7 to $200, roughly. They all look very similar to me. I suspect $100 device might perform better than $10 one, but in what respect? I suspect there are characteristics that are deemed important but usually omitted in lower quality devices specs.

share|improve this question

migrated from superuser.com Dec 29 '11 at 20:19

This question came from our site for computer enthusiasts and power users.

1  
This link has some good information of what makes a quality biometric fingerprint scan. biolab.csr.unibo.it/…; –  kobaltz Dec 29 '11 at 19:38
    
I hope you are aware of the vulnerabilities of finger print readers. pacsec.jp/psj06/psj06krissler-e.pdf "conclusion: Don't use fingerprint recognition systems for security relevant applications." –  Baarn Dec 29 '11 at 21:24

1 Answer 1

up vote 2 down vote accepted

First, you have to consider that each maker of fingerprint sensor uses a different technology for creating a fingerprint template (a representation created from a image captured by the fingerprint sensor) and matching the template against a reference template (created during the enrollment, when you register your finger).

In terms of technology, to compare the how secure are these different ways to authenticate a fingerprint, there are 2 main parameters:

  • rate of false negatives: the percentage of times a finger that should match the reference finger template fails to do so (this will be the rate of 'annoyance': the chance the sensor will not allow a legitimate user to login)
  • rate of false positives: the percentage of times a finger that should NOT match the reference finger template will actually match (this will be the rate of security failures: it means there is a potential for another finger to be seen as the correct finger)

However, most security problems in consumer fingerprint authentication products will actually not be in the technology itself, but in the implementation. E.g. not properly protecting the passwords that are stored behind the fingerprint authentication, so the attacker can ignore the biometrics and grab them directly, etc.

I would want to see the specific details of how the system is implemented before deciding and I would say that unless system security was a key requirement during the whole design I would not feel confident.

I think this is similar to the encrypted USB keys... most of the 'secure' consumer disks have almost null security and only the expensive ones, usually the ones designed for security (i.e. Ironkey, etc) really provide protection.

Not sure if this answers your question, hope this helps.

share|improve this answer
    
Thank you for your answer... It did help, although I was looking for a more practical one. E.g. vendors' specs never state their rate of false positives, I was hoping it could be inferred/estimated from the technology they use, or some other data that is publicly available, etc. –  haimg Jan 1 '12 at 5:52
    
Yeah, they don't give much information. Most laptops use Authentec sensors (authentec.com/a/Production/smartsensors_pc.aspx). I think they also have software solutions for identity management that includes software (authentec.com/Products/IdentityManagement/forHome.aspx), I don't know how they work or if they are any good, but might be useful to take a look –  flpmor Jan 3 '12 at 20:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.