Tag Info

Hot answers tagged

20

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...


17

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...


15

Biometrics can be effective as authentication or as identification, but not both at the same time. According to Wikipedia, retinal scans are accurate to approximately one in one million, meaning on the earth today there are approximately 7,000 individuals who will be identified as you in a retinal scan. Assuming no further authentication is necessary, ...


13

The whole point of resorting to biometrics, i.e. taking physical measures out of a body part of the human user, is that the said body part is attached to the user, and cannot be switched at will (it can, unfortunately, be removed, but not really glued back). It is true that the impossibility to revoke biometrics is an inherent problem, for which no good ...


12

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...


10

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...


10

As @Xander points out, a very similar question has been asked yesterday. Indeed: If you can derive a key from a fingerprint, then you can hash that key and get a hash value. If you can hash a fingerprint, you can use the hash value as a key. So they really are the same question. And the answer is: people are working on it, it does not work well yet, but ...


9

Put simply: cost. In this instance cost takes two forms, resource cost and monetary cost. Chances are great that if you have a computer or system of any type (desktop, server, mainframe, distributed, cloud, etc.) it has a built-in authentication mechanism: passwords. The time and money that it takes to bolt-on or integrate biometrics for average uses is too ...


8

The many technical problems with biometrics are well canvassed above. Biometrics as a class still faces deep skepticism, and rightly so. Security professionals are conservative and cautious, and they find the following issues problematic: Very few of the technologies on the list above are commercially mature. I myself don't know why DNA, gait and smell ...


8

Systems can fail, so you need a defense in depth approach. Bio-metric security systems rely upon fuzzing matching. They can suffer from whats called a type-II error, which means an attacker is successfully authenticated. Also Mythbusters has hacked it. (and they aren't the only ones.)


8

Biometrics can also be forged, such as fingerprints. By contrast forging a 1024bit rsa key on a smartcard is much more difficult than a human fingerprint. However every from of authentication you add raises the bar for the attacker (and annoys your users). This is the basis of multi-factor authentication. The most common form of two factor ...


7

A false negative is when biometric systems fail to recognize an authentic individual, which would lead to something not happening. Depending on what that something is there could be various consequences: Personal: An owner of a safe may be prevented from accessing that safe, leading to him/her being unable to access a necessary resource. Say they really ...


7

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive touch where a human finger's natural electric conductivity is ...


6

Biometrics (something you are) + password/passphrase (something you know) = 2 factor authentication. That's why they're used together. The other reason biometrics isn't used more widely is 1) biometric systems are expensive to implement and 2) biometric systems need a very, very low false positive rate. You wouldn't want the system to allow access to ...


6

Yes - both are current. Real time biometric analysis on keyboard input has been looked into by a few teams now. The guys at Pace University seem to have a strong presence in this area. Have a read of : Continual Keystroke Biometric Authentication on Short Bursts of Keyboard Input Keystroke Biometric Identification and Authentication on Long-Text Input ...


6

Reliably deriving cryptographic keys from biometric data is hard because of thresholds: biometric data is a continuum, but cryptographic keys are binary: a bit is a zero or a one, not something in between. Whenever you design a scheme to transform biometric data into keys, there will be people whose biometric data falls "on the edge" and who will get a wrong ...


6

The iPhone 5S scanner was successfully fooled with a low-tech approach that has been known for a decade. The CCC published a plastic film with the finger print of the German Minister of the Interior a couple of years ago. It was taken from a glass of beer. The thin plastic film is put on a real finger, so that body temperature and a heartbeat is detected. ...


5

If your body is your password, and your account is compromised in some way, there's no way to change your password.


5

I see you as having two questions here: Is the answer provided by the study guide technically correct? Is it possible this sample question doesn't have a clear answer and is a bad question? With regards to your first question I think you have a valid argument that smart card / PIN offers at least equivalent security to a biometric authenticator. But ...


4

Unfortunately, yes, they are. It's quite trivial, in fact, using a bit of scotch tape. Fingerprints are actually more akin to usernames than passwords. Fingerprints can be used to identify you, but not authenticate you. The proper operation of a fingerprint reader in a computer operating system should be to identify the user and chose their username from ...


4

Fingerprints can be viewed as a fuzzy source of data. Given the same finger, a reader might never read exactly the same print. That is why most readers require the user to scan a finger multiple times during the registration phase. During the authentication phase, the system tries to determine if the scan it just acquired is "close enough" to the trained ...


4

Let's consider the oldest biometric method - fingerprinting. Although fingerprinting has been around since the 1890s as a forensic tool, there is still no uniform international standard for recording fingerprint Minutiae or comparing them. The closest de-facto standard is ANSI/NIST-ITL 1-2011 (see section 8.9). There is also no legal rigor in fingerprint ...


4

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


4

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


4

Whether something is "more" or "less" secure depends on a lot of things including the perspective of the person designing the mechanism. In this example from the perspective of your boss, using fingerprint scans could be more secure for two reasons. One the percentage of thieves who will cut peoples appendages off is likely lower than the percentage who ...


3

As I'm sure I posted in one of the other biometric questions, the only places I see it a lot are datacentres. And more specifically, datacentres protecting high value root certs. For this type of environment it is the norm, rather than the exception. Update to say - it is only ever used in addition to all the other controls, not instead of! Elsewhere, it's ...


3

The biggest problem is implementation. Imagine, for a moment, that Facebook decided passwords were too insecure and determined to go with biometric identification instead. How would they do it? The hardware just isn't there; it's not standard, it's not ubiquitous, it's not well-understood. Bad example? Ok, then what would be a good example? Your bank? Same ...


3

Got to remember that many biometrics are not universally available. Some professions (hair-dressing, bricklaying...) routinely render fingerprints unreadable. And that's ignoring congenital defects which render fingers unavailable, or accidents which remove them... A proportion of the population cannot use retinal scanners, either mechanically (reaction to ...


3

The Exchange ActiveSync Policy Engine gives administrators the option to allow biometrics. See http://technet.microsoft.com/en-us/library/dn282287.aspx for details. In addition, it seems almost certain that using a PIN code or passphrase instead of biometrics will remain an option. It turns out that you must set at least a PIN when using TouchID. When you ...



Only top voted, non community-wiki answers of a minimum length are eligible