Biometrics is a set of methods related to unique identification of people based on physiological or behavioural traits

learn more… | top users | synonyms

60
votes
6answers
3k views

Should I be afraid of biometric IDs?

The Israeli Minister of the Interior is pushing legislation to introduce biometric IDs. On the one hand I hear his argument that it can help to prevent identity theft. On the other hand, something ...
28
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
23
votes
14answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
19
votes
4answers
2k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
16
votes
3answers
2k views

Voice Biometrics for financial authentication

From this article: http://www.bbc.com/news/business-36762962 Apparently, it takes us 45 seconds on average just to confirm who we are. But by using computers to identify our voices, this ...
14
votes
3answers
14k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
13
votes
1answer
248 views

What are the implications of 5 million peoples fingerprints being stolen from the US Government?

The recent OPM hack has revealed more fingerprints were stolen than previously believed. One of the scariest parts of the massive cybersecurity breaches at the Office of Personnel Management just ...
12
votes
4answers
436 views

What are the risks of providing my fingerprint to a theme park?

I recently visited Epcot Center and was surprised that they asked to scan one of my fingerprints before I entered the park, even though I already had my ticket in hand. I don't believe they require a ...
11
votes
5answers
1k views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
10
votes
5answers
1k views

Is a biometric eye scan more secure than a multi-factor authentication

I have come across the following question in a Security+ exam guide You are tasked with creating a high-security authentication system for physical access control to a military installation. Which ...
9
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
9
votes
2answers
2k views

Is iPhone's fingerprint signature a one-way hash?

I've been considering the security of the iPhone 5S fingerprint feature. My main concern is, not that someone could replicate my fingerprint in the physical world and bypass the phone, however that ...
9
votes
3answers
328 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
9
votes
2answers
806 views

How to store/encrypt fingerprint?

Storing password is a no brainer : use a password hasher. But.. How do you proceed to store fingerprints securely on your server? Meaning that even if your server and all it's data is stolen, someone ...
8
votes
2answers
730 views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
7
votes
3answers
6k views

Are fingerprint scanners easy to bypass?

Thinking about adding a fingerprint based authentication layer, but then I recalled the MythBusters beat fingerprint security system episode -- is this a common issue, and if not, how do you tell if a ...
7
votes
1answer
397 views

How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
6
votes
6answers
1k views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
6
votes
1answer
741 views

What happens if biometric data is stolen?

As we move toward a future where fingerprints might possibly replace passwords, I see one issue. While passwords can be stolen, they can be changed by the owner after being notified of the security ...
6
votes
0answers
90 views

Feasibility and scalability of a large biometric system (UID Aadhaar)

Over the last five years, India has systematically advanced a biometric identification scheme, which now has an enrollment of over 800 million users. To ensure the accuracy of matching for such a ...
5
votes
8answers
819 views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
5
votes
1answer
3k views

False negative in biometrics

In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?
5
votes
1answer
124 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
5
votes
6answers
889 views

How is a biometric authentication system secure?

Imagine I have an application which uses a biometric based authentication (such as a fingerprint). It takes its hash and sends it to the server. The server has a copy of the hash and compares the two. ...
5
votes
3answers
184 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
5
votes
1answer
429 views

What are formal parameters for fingerprint scanner selection?

I would like to buy a USB fingerprint scanner. I intend to use it to log in into my Windows computer, to secure RoboForm password manager, and generally to replace password entry with a quick finger ...
5
votes
2answers
183 views

Is biometric passport safer than old-fashioned passport

Our government encourages the citizens to move to "smart passports", which contain biometric data such as fingerprints. They say it is safer for us because it prevents identity thefts. On the other ...
5
votes
2answers
271 views

Biometric device instead of password - signature security

Lets assume that there is a bio-metric algorithm for user authentication which compares fingerprints with a user's signature saved in a database (comparing function is not important here). Next, there ...
4
votes
1answer
478 views

Web-browser based biometrics?

Is there any practice of using biometric mechanisms online - for example, for visual identification via webcam to identify audio-visually the person speaking, or, performing biometric analysis on ...
4
votes
1answer
83 views

Security vulnerability of voice authentication in phone services

Having been asked if I want to opt for voice authentication when using a phone service, I was wondering about the security vulnerabilities of an authentication method which is relatively new to me. ...
4
votes
2answers
330 views

Is there a standard, storage algorithm or protocol for fingerprints?

What are the generic conventions and standards for storing and identifying biometric fingerprints out there? Are there some RFC documents for that? As a sub-question: suppose I want to preserve my ...
4
votes
2answers
103 views

Can biometric photos / finger prints be forged when they are taken by a human?

Imagine a scenario, where you have a person p online which has a very good profile. For example, you want to hire them. This person is identified by a public key and has some information I about him ...
3
votes
4answers
602 views

Biometric non revocable major flaw

The major problem with biometric methods of identification is that they are impossible to revoke. Once my fingerprint, under whichever form, is stolen, I can't put it on a worldwide revocation list, ...
3
votes
2answers
431 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
3
votes
3answers
136 views

Can identification imply authentication in biometric systems?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
3
votes
3answers
260 views

How important is user acceptance when deciding whether to deploy biometric authentication?

I've been browsing through several studies on user acceptance of biometrics, and I've been noticing that they all focus on attitudes and beliefs about biometrics. While it's important to know a ...
3
votes
2answers
61 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the voice-...
3
votes
1answer
103 views

False Match vs False Acceptance

Studying up on biometric security terms, can someone clarify the difference between 'Match'/'Non-Match' and 'Rejection'/'Acceptance'?
2
votes
2answers
141 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
2
votes
3answers
3k views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
2
votes
1answer
4k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
2answers
188 views

Threshold for biometric authentication

I would like to ask, what are appropriate ways to adjust thresholds for a biometric system when we have only training and testing data of a single user? I am using Speaker, face and gait recognition ...
2
votes
1answer
2k views

False acceptance rate in biometric authentication system

False acceptance refers to an unauthorized user given access to a system which he is not allowed to access. Therefore a false acceptance rate of 1% means the system will incorrectly allow access to ...
2
votes
0answers
45 views

Is FAR (False Accept Rate) a property of algorithm or a property of the system?

As known in biometrics: https://en.wikipedia.org/wiki/Biometrics#Performance False match rate (FMR, also called FAR = False Accept Rate): the probability that the system incorrectly matches the ...
2
votes
1answer
708 views

Biometrics: false rejection rate vs Hamming distance in iris scan

In biometrics, most people talk about False Acceptance Rate (FAR) (i.e. what is the chance that two samples of different individuals match). DNA and iris biometrics, for example, have a very low FAR....
1
vote
3answers
82 views

Securely verifying a user based on bio metrics [duplicate]

So we all have cameras on our phone, and we all have faces on our bodies(hopefully). We all also have a want to keep our data safe and secure. To that end many companies have tried to make secure ...
1
vote
1answer
67 views

Getting started with biometric locks?

I am not sure if this is the place to ask this question and if it is not, i would really appreciate it if you could direct me to the right place. I wanted to understand the functionality and the ...
1
vote
2answers
173 views

Can a biometric device serve as a user based entropy source?

I am wondering if a biometric device can be used to generate some entropy or key material that would be stable across each authentication. The contrary would be for biometric devices to act like an ...
1
vote
2answers
426 views

Securing fingerprint templates stored on web authentication server

I have a multi-factor web authentication server, that in addition to regular passwords uses fingerprints for user authentication. Can anyone think of a security flaw in the following scenario: I ...
1
vote
0answers
32 views

Develop Biometric Kerberos Server using C [closed]

How possible is it for me to develop a Kerberos Server that supports fingerprint, mobile device IMEI and phone number as the Kerberos Principal's identity using C/C++?