Tag Info

Hot answers tagged

20

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


18

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...


15

Biometrics can be effective as authentication or as identification, but not both at the same time. According to Wikipedia, retinal scans are accurate to approximately one in one million, meaning on the earth today there are approximately 7,000 individuals who will be identified as you in a retinal scan. Assuming no further authentication is necessary, ...


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


13

The whole point of resorting to biometrics, i.e. taking physical measures out of a body part of the human user, is that the said body part is attached to the user, and cannot be switched at will (it can, unfortunately, be removed, but not really glued back). It is true that the impossibility to revoke biometrics is an inherent problem, for which no good ...


12

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...


11

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...


10

As @Xander points out, a very similar question has been asked yesterday. Indeed: If you can derive a key from a fingerprint, then you can hash that key and get a hash value. If you can hash a fingerprint, you can use the hash value as a key. So they really are the same question. And the answer is: people are working on it, it does not work well yet, but ...


9

The many technical problems with biometrics are well canvassed above. Biometrics as a class still faces deep skepticism, and rightly so. Security professionals are conservative and cautious, and they find the following issues problematic: Very few of the technologies on the list above are commercially mature. I myself don't know why DNA, gait and smell ...


9

Put simply: cost. In this instance cost takes two forms, resource cost and monetary cost. Chances are great that if you have a computer or system of any type (desktop, server, mainframe, distributed, cloud, etc.) it has a built-in authentication mechanism: passwords. The time and money that it takes to bolt-on or integrate biometrics for average uses is too ...


8

Systems can fail, so you need a defense in depth approach. Bio-metric security systems rely upon fuzzing matching. They can suffer from whats called a type-II error, which means an attacker is successfully authenticated. Also Mythbusters has hacked it. (and they aren't the only ones.)


8

Biometrics can also be forged, such as fingerprints. By contrast forging a 1024bit rsa key on a smartcard is much more difficult than a human fingerprint. However every from of authentication you add raises the bar for the attacker (and annoys your users). This is the basis of multi-factor authentication. The most common form of two factor ...


8

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


7

A false negative is when biometric systems fail to recognize an authentic individual, which would lead to something not happening. Depending on what that something is there could be various consequences: Personal: An owner of a safe may be prevented from accessing that safe, leading to him/her being unable to access a necessary resource. Say they really ...


7

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive touch where a human finger's natural electric conductivity is ...


6

Biometrics (something you are) + password/passphrase (something you know) = 2 factor authentication. That's why they're used together. The other reason biometrics isn't used more widely is 1) biometric systems are expensive to implement and 2) biometric systems need a very, very low false positive rate. You wouldn't want the system to allow access to ...


6

Yes - both are current. Real time biometric analysis on keyboard input has been looked into by a few teams now. The guys at Pace University seem to have a strong presence in this area. Have a read of : Continual Keystroke Biometric Authentication on Short Bursts of Keyboard Input Keystroke Biometric Identification and Authentication on Long-Text Input ...


6

Reliably deriving cryptographic keys from biometric data is hard because of thresholds: biometric data is a continuum, but cryptographic keys are binary: a bit is a zero or a one, not something in between. Whenever you design a scheme to transform biometric data into keys, there will be people whose biometric data falls "on the edge" and who will get a wrong ...


6

The iPhone 5S scanner was successfully fooled with a low-tech approach that has been known for a decade. The CCC published a plastic film with the finger print of the German Minister of the Interior a couple of years ago. It was taken from a glass of beer. The thin plastic film is put on a real finger, so that body temperature and a heartbeat is detected. ...


6

If you have the user's mobile phone number (and if the user affirms during registration that this phone number can receive text messages), you can use this ability to enable 2-step authentication with SMS. Following successful authentication with a username and password, take one more step. Send the user a text message, by using the API to an SMS gateway ...


5

If your body is your password, and your account is compromised in some way, there's no way to change your password.


5

I see you as having two questions here: Is the answer provided by the study guide technically correct? Is it possible this sample question doesn't have a clear answer and is a bad question? With regards to your first question I think you have a valid argument that smart card / PIN offers at least equivalent security to a biometric authenticator. But ...


5

I think that there's an unstated assumption in the question: that the military installation will have a guard at the entry. Every attack on a biometric system I'm aware of assumes an unprotected or compromised scanner. If there's a guard standing there at the gate making sure that you're using your eyeball (not a gouged-out one, not a photograph, not a ...


4

Unfortunately, yes, they are. It's quite trivial, in fact, using a bit of scotch tape. Fingerprints are actually more akin to usernames than passwords. Fingerprints can be used to identify you, but not authenticate you. The proper operation of a fingerprint reader in a computer operating system should be to identify the user and chose their username from ...


4

Fingerprints can be viewed as a fuzzy source of data. Given the same finger, a reader might never read exactly the same print. That is why most readers require the user to scan a finger multiple times during the registration phase. During the authentication phase, the system tries to determine if the scan it just acquired is "close enough" to the trained ...


4

Let's consider the oldest biometric method - fingerprinting. Although fingerprinting has been around since the 1890s as a forensic tool, there is still no uniform international standard for recording fingerprint Minutiae or comparing them. The closest de-facto standard is ANSI/NIST-ITL 1-2011 (see section 8.9). There is also no legal rigor in fingerprint ...


4

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


4

Whether something is "more" or "less" secure depends on a lot of things including the perspective of the person designing the mechanism. In this example from the perspective of your boss, using fingerprint scans could be more secure for two reasons. One the percentage of thieves who will cut peoples appendages off is likely lower than the percentage who ...



Only top voted, non community-wiki answers of a minimum length are eligible