Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have to think of this everyday when I close the doors of the shop I work in, a year ago we used to close the shop and arm the alarm using a key fob this means the worst case scenario was that I get robbed. few months ago my boss decided that we a password to set the alarm this means thugs will kidnap me and beat me till I tell them my password

Yesterday he was thinking about investing in locking with finger prints sensor, great this means I'll lose my fingers if I ever got kidnapped

How is more secure than single-factor authentication?

share|improve this question
1  
Ultimately if someone wants in... he gets in. You're just the obstacle he has to go through. –  ekaj Dec 15 '13 at 23:15

3 Answers 3

Whether something is "more" or "less" secure depends on a lot of things including the perspective of the person designing the mechanism.

In this example from the perspective of your boss, using fingerprint scans could be more secure for two reasons. One the percentage of thieves who will cut peoples appendages off is likely lower than the percentage who would steal something from your pocket. Two, with a fingerprint system if there is a risk of insider collaboration with thieves a fingerprint scanner means that it can be proven (assuming they haven't had that finger removed) which employee was present at the time of the theft.

None of that means that this is better from your perspective of course in fact as you say, losing an appendage is way worse than being pick-pocketed or beaten up for a password.

Also in all this I'm assuming that there's no way to bypass the fingerprint sensor. If I was you, you could point out to your boss that most fingerprint sensors are bypassable by people lifting prints from things like a glass in a bar and once you've lost control of the print, these systems can be worse than useless (e.g. if a criminal has all 10 prints, they can always get access past the system and there's nothing you can do to change your prints)

share|improve this answer

The 'security' of biometric authentication is different to regular on a couple of major points.

Firstly, it is much more convenient than regular authentication methods. If 'who you are' is your password, you can never really lose it. A keyfob or pin code can be easily lost, stolen or forgotten, but your iris pattern or facial geometry are very difficult to separate from you (barring major accidents or extreme malicious intent).

Secondly, it offers a greater guarantee of non-repudiation. Say the security system were to open a safe containing money. If the money were stolen, and were protected by just a keyfob, it would be easy to assert that someone had stolen the authentication method from you from you rather than you stole the money yourself. A passcode gives slightly more protection, but could still be easily shown that the passcode had been stolen and used without your knowledge. If the authentication is your fingerprint, and you still have all of your fingers intact, it is quite difficult to prove that you didn't in fact steal the money yourself.

This second point is the cause of a real issue in authentication. If your personal authentication method is in fact stolen, how would one prove that you didn't steal the money? More to the point, if the authentication method is duplicated, how do you change your 'password'?

In terms of the security, it is arguably the exact same security using a fingerprint as a keyfob. Both would need a single item to be stolen to gain access. Same with a passcode. In terms of effort a robber would have to go to to gain access, a passcode would require the most effort (torture you to get the passcode), whereas a keyfob or fingerprint would require the exact same effort (steal something). Although the stealing of a fingerprint would be much more grisly (stealing your finger as opposed to stealing an item on your person), it's the same effort an attacker would need, therefore the same security.

Biometrics are generally best suited to continued authentication as opposed to initial authentication. Some item of data other than yourself is used to initially state who you are, then yourself is used to maintain access. This has been used in laptops with facial recognition software on the webcam. You use a password to initially log in, then the webcam looks at your face as you sit in front of it. When you get up, it detects that the biometric authentication is no longer in place, and locks the computer.

The situation you have described is still single-factor authentication, albeit using biometric authentication rather than 'standard' authentication. If using a single-factor authentication only, a passcode is a better option. If using multi-factor authentication, a keyfob and a passcode or a passcode and biometrics are better options.

What also needs to be looked at in your situation is the cost - both human and monetary. Any business should have insurance against robbery. Would you prefer that your store be robbed and your staff have a keyfob stolen, or that your staff have their finger/eye stolen? Also, is it really worth the money to fit fingerprint scanners when a passcode is just as secure as a password?

So, in answer to your question, on their own biometrics are arguably less secure than passcode authentication, more dangerous (to the owner of the biometric signature) if an attacker really, really wants to gain access, but slightly better at proving someone has accessed something if they say they haven't - until those biometrics actually get stolen, then they are better at proving you have accessed something when in fact you haven't.

share|improve this answer

Ask boss to get a system with a keypad and also a duress code that silently alarms. Maybe your existing system supports this.

share|improve this answer
    
I think this is a really good suggestion - but it doesn't actually answer what OP asks. Try to tie it into how it is more secure than single-factor auth. –  ekaj Dec 15 '13 at 23:16
    
OP seems to believe the bad guys would torture him or cut off his finger to defeat the system, which suggests he works in the diamond district or something. If what the biometric is protecting is sufficiently valuable that the authorized users are at risk of mayhem, maybe biometrics alone isn't the preferred solution. Maybe no single or multiple-factor auth short of video identification to a remote guard station would be sufficient. –  user35648 Dec 16 '13 at 8:36
    
(edit your answer to reflect those details) –  ekaj Dec 16 '13 at 21:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.