Tag Info

Passwords and biometrics have distinct characteristics. Passwords are secret data. Data is abstract: it flows quite freely across networks. Cryptography defines many algorithms which can use secret data to realize various security properties such as confidentiality and authentication. The shortcomings of passwords are due to the fact that they are meant to ...

Abstracted across a network, most biometrics implementations can still be boiled down to the category of "something you know". For a discussion of how that happens with "something you have," take a look at How is "something you have" typically defined for "two-factor" authentication?. Biometrics suffers from a problem where once a ...

There are significant problems with all of these as a primary identifier. For example: Fingerprints/Palm - What happens if I fall off my bike and scuff my hand across the ground? My fingerprints are ruined for some time - possibly permanently. DNA - have you seen how easy it is to pick up blood or other material containing DNA? Typing - this has some ...

One issue with rolling out biometrics everywhere is registration. Should I have to turn up to Facebook's office in Palo Alto with my government-issued ID so that they can fingerprint me before I can log in to their website, versus typing "correcthorsebatterystaple" into my browser? How long would that take for 650M+ users? How many staff? How expensive is it ...

Put simply: cost. In this instance cost takes two forms, resource cost and monetary cost. Chances are great that if you have a computer or system of any type (desktop, server, mainframe, distributed, cloud, etc.) it has a built-in authentication mechanism: passwords. The time and money that it takes to bolt-on or integrate biometrics for average uses is too ...

The many technical problems with biometrics are well canvassed above. Biometrics as a class still faces deep skepticism, and rightly so. Security professionals are conservative and cautious, and they find the following issues problematic: Very few of the technologies on the list above are commercially mature. I myself don't know why DNA, gait and smell ...

Systems can fail, so you need a defense in depth approach. Bio-metric security systems rely upon fuzzing matching. They can suffer from whats called a type-II error, which means an attacker is successfully authenticated. Also Mythbusters has hacked it. (and they aren't the only ones.)

A false negative is when biometric systems fail to recognize an authentic individual, which would lead to something not happening. Depending on what that something is there could be various consequences: Personal: An owner of a safe may be prevented from accessing that safe, leading to him/her being unable to access a necessary resource. Say they really ...

Yes - both are current. Real time biometric analysis on keyboard input has been looked into by a few teams now. The guys at Pace University seem to have a strong presence in this area. Have a read of : Continual Keystroke Biometric Authentication on Short Bursts of Keyboard Input Keystroke Biometric Identification and Authentication on Long-Text Input ...

Biometrics (something you are) + password/passphrase (something you know) = 2 factor authentication. That's why they're used together. The other reason biometrics isn't used more widely is 1) biometric systems are expensive to implement and 2) biometric systems need a very, very low false positive rate. You wouldn't want the system to allow access to ...

There's a few other reasons: Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics. User acceptance - still not widely trusted by users - the various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is somewhat freaky for some folks. Security best ...

Biometrics can also be forged, such as fingerprints. By contrast forging a 1024bit rsa key on a smartcard is much more difficult than a human fingerprint. However every from of authentication you add raises the bar for the attacker (and annoys your users). This is the basis of multi-factor authentication. The most common form of two factor ...

Fingerprints can be viewed as a fuzzy source of data. Given the same finger, a reader might never read exactly the same print. That is why most readers require the user to scan a finger multiple times during the registration phase. During the authentication phase, the system tries to determine if the scan it just acquired is "close enough" to the trained ...

Unfortunately, yes, they are. It's quite trivial, in fact, using a bit of scotch tape. Fingerprints are actually more akin to usernames than passwords. Fingerprints can be used to identify you, but not authenticate you. The proper operation of a fingerprint reader in a computer operating system should be to identify the user and chose their username from ...

Got to remember that many biometrics are not universally available. Some professions (hair-dressing, bricklaying...) routinely render fingerprints unreadable. And that's ignoring congenital defects which render fingers unavailable, or accidents which remove them... A proportion of the population cannot use retinal scanners, either mechanically (reaction to ...

As I'm sure I posted in one of the other biometric questions, the only places I see it a lot are datacentres. And more specifically, datacentres protecting high value root certs. For this type of environment it is the norm, rather than the exception. Update to say - it is only ever used in addition to all the other controls, not instead of! Elsewhere, it's ...

I work in the biometrics security field for a government contractor. I can't get into specifics of who uses our products and services for security and non-disclosure reasons; but it's used by a wide variety of government, military, law enforcement and private organizations. We can provide SDKs so people can develop their own applications which interface via ...

Over the years I've seen commercial organisations evaluating biometrics (e.g. voice) and limited deployments (e.g. fingerprint readers on pcs), but it's very rare in my experience (which is mainly with financial and large asset management organisations). I think the main reasons biometrics have not got very far are: Flaky implementations (e.g. simply ...

Fingerprint scanners have become more common since they became so cheap. Several years ago they were included in nearly every laptop on the market. They're not so common anymore, though, presumably because people never used them. Most of the top-tier datacenters I've visited have had some sort of biometric scanner at the door -- usually hand geometry -- ...

The answer depends upon, among other things: the specifics of the situation where usage of biometric controls is being considered, the type of biometric control being considered and how invasive it is, the target population for the control. Administrative staff having to submit to a retina scan every morning to gain computer access would likely invoke ...

First, you have to consider that each maker of fingerprint sensor uses a different technology for creating a fingerprint template (a representation created from a image captured by the fingerprint sensor) and matching the template against a reference template (created during the enrollment, when you register your finger). In terms of technology, to compare ...

The biggest problem is implementation. Imagine, for a moment, that Facebook decided passwords were too insecure and determined to go with biometric identification instead. How would they do it? The hardware just isn't there; it's not standard, it's not ubiquitous, it's not well-understood. Bad example? Ok, then what would be a good example? Your bank? Same ...

In the beginning, there is mild push-back because of the 'Big Brother' image biometrics have, but that resistance fades at the same rate that any other hardware change experiences (1-2 weeks for something used daily). All of the lasting complaints I have experienced have all been centered around usability. In practice (in my experience) they are harder to ...

No, If a device sequenced the user's genome from a skin cell, the results would be the same each time. Assuming the skin cells have replicated without errors. But it seems what you are asking is impossible, since you have to have a database somewhere that stores the answer to your key.

I used to work for an employer who required you to clock in and out of their timeclock using your finger prints. Some people complained but in the companies response it's easier for the password challenged users, which lets face it there's a ton of them out there :-) The users that complained were basically told to comply or look for employment elsewhere. ...

The most consistent biometrics implementation that i see is for datacenters. Aside from a smaller lab, all the datacenters that I have dealt with require some level of biometrics, mostly hand scanners. Again, this is purely my experience. Other than that, biometrics seem to be underutilized in the corporate environment. I think it would be amusing to see ...

If you are asking about "how many different technics, such as fingerprint scanning, retina scanning, hand scanning, ear scanning etc.", then I think I named them all. If you are asking, how widespread the use of biometrics is, then I'd say "not much" mainly due to lack of uniform APIs that would work as a bridge between user applications and hardware. Each ...

I'm not sure that any single person could answer this one - I get the sense that we all work in different industries, so there's probably no one right answer. I'd bet that if you hit the right niche, the answer is "of course, we use it everywhere" but many other industries would say "it's an interesting idea, but we don't use it." I'm certainly in the ...

Here's an open source project on facial recognition: http://code.google.com/p/pam-face-authentication/ It doesn't look like there's a big market for regular users needing two-factor authentication software on standalone machines. Looking at some of the products out there look like an enterprise solution is more common. At one time I eve developed my own ...

There's a pam module which certainly supports fingerprint scanning, and its trivial to configure pam to use n-factor authentication. Of course, pam (only?) works on Linux, Solaris, BSD, most flavours of Unix but I beleive that there's at least one port to a MSWindows Gina floating about somewhere.