4

If a database full of passwords is leaked, a user can just make another password. Today biometric security checks like fingerprint scanners and face recognition are often promoted as good security measures, but let’s say that a database of face scans is stolen. People can’t get a new face. Is Face ID now unusable for all those affected, or is there some additional security measures that make Face ID usable as a login method?

Note: I understand that information like passwords is (hopefully) stored in secured hashes, with salt, and so on, to make stealing of databases less of an impact on security. My question is about security mechanisms that exist to allow reusability of biometric login tokens, not about security measures that secure data in database theft scenarios.

Improve this question
4
  • 4
    Did you read the Face ID Security Guide? It should address your questions. For example, there is no central database of face data. The data stays on the device and is encrypted with keys stored in the Secure Enclave subsystem. For using Face ID as an authentication method, there are separate keys which can be unlocked with Face ID -- so the biometric data is only used indirectly, not sent to a server like in the case of password authentication.
    – Ja1024
    Commented Oct 20 at 10:18
  • 3
    That is how Apple does it; it does not apply to a number of other systems I know of (f.e. physical access control systems)
    – Ljm Dullaart
    Commented Oct 20 at 10:41
  • it's not the tokens really... it's about the source. I think what you are getting at is that you can't easily change your face or fingerprints, so if that's the only thing securing an account, someone who can present that face or fingerprint (or facsimile) will always be able to login to that account.
    – browsermator
    Commented Oct 21 at 22:54
  • Possible duplicate: security.stackexchange.com/questions/216833/…
    – schroeder ♦
    Commented Oct 22 at 22:53

2 Answers 2

Reset to default
1

The point in fact is the securing of the database.

The data in the biometric database can be used to verify identity, but it cannot be used to create an identification. The database does not store JPEGs or the likes. You cannot create a fingerprint or face from the data in the database.

Improve this answer
3
  • couldn't a brute-force be done in same manner as password hash? Meaning you present millions of digital facsimiles to the algorithm and see if one matches a stored value. While it's not technically reversing the data, it is same effect as brute-forcing password hashes. The entropy would be equivalent to how unique someone's face or fingerprint is when scanned.
    – browsermator
    Commented Oct 23 at 17:05
  • so if you know what someone looks like (take a picture), or you have their fingerprint, and you get access to the database, it should be fairly easy to find the match, no? I believe it's all 2-D input. (or would you also need the input device/hardware?)
    – browsermator
    Commented Oct 23 at 17:21
  • There are brute force attacks to the complete system of fingerprint authentication, f.e. Kasperski, but they do not try to create a fingerprint from the database.If you have someone's fingerprint, you can make a copy using agar-agar, but you cannot create a fingerprint from a leaked database.
    – Ljm Dullaart
    Commented Oct 25 at 9:27
0

A biometric check isn't supposed to be a thing you know; it's a thing you have. The security of is limited by the implementation's ability to confirm you actually have that face/fingerprint/whatever — and aren't just showing it knowledge, like a photograph, fingerprint impression, etc.

No one should consider a face to be a secret. Photos of many people are easily found online, and anyone who knows you probably has at least a few photos of you. There no doubt exist thousands of pictures of you on random security cameras. Anyone around you can likely covertly scan your face. Secrecy of the biometrics should not be part of the design.

(Of course, databases should be secured and biometrics are ideally stored in some non-reversible form as Ljm's answer mentions.)

Improve this answer
1
  • I'm not sure how this answers the question. This appears to be a tangental discussion. If you are trying to say that it doesn't matter if the database is leaked, then your lat line contradicts your premise.
    – schroeder ♦
    Commented Oct 22 at 22:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .