6

I would like to buy a USB fingerprint scanner. I intend to use it to log in into my Windows computer, to secure RoboForm password manager, and generally to replace password entry with a quick finger sweep in as many places as possible.

What I'm asking here is not a shopping recommendation. Instead, I would like to know what are the key technical parameters that I should use to compare different fingerprint biometric scanners available today. Quick search on eBay returns devices that cost from $7 to $200, roughly. They all look very similar to me. I suspect $100 device might perform better than $10 one, but in what respect? I suspect there are characteristics that are deemed important but usually omitted in lower quality devices specs.

Improve this question
2
  • 1
    This link has some good information of what makes a quality biometric fingerprint scan. biolab.csr.unibo.it/…
    – kobaltz
    Dec 29, 2011 at 19:38
  • I hope you are aware of the vulnerabilities of finger print readers. pacsec.jp/psj06/psj06krissler-e.pdf "conclusion: Don't use fingerprint recognition systems for security relevant applications."
    – Baarn
    Dec 29, 2011 at 21:24

1 Answer 1

Reset to default
3

First, you have to consider that each maker of fingerprint sensor uses a different technology for creating a fingerprint template (a representation created from a image captured by the fingerprint sensor) and matching the template against a reference template (created during the enrollment, when you register your finger).

In terms of technology, to compare the how secure are these different ways to authenticate a fingerprint, there are 2 main parameters:

  • rate of false negatives: the percentage of times a finger that should match the reference finger template fails to do so (this will be the rate of 'annoyance': the chance the sensor will not allow a legitimate user to login)
  • rate of false positives: the percentage of times a finger that should NOT match the reference finger template will actually match (this will be the rate of security failures: it means there is a potential for another finger to be seen as the correct finger)

However, most security problems in consumer fingerprint authentication products will actually not be in the technology itself, but in the implementation. E.g. not properly protecting the passwords that are stored behind the fingerprint authentication, so the attacker can ignore the biometrics and grab them directly, etc.

I would want to see the specific details of how the system is implemented before deciding and I would say that unless system security was a key requirement during the whole design I would not feel confident.

I think this is similar to the encrypted USB keys... most of the 'secure' consumer disks have almost null security and only the expensive ones, usually the ones designed for security (i.e. Ironkey, etc) really provide protection.

Not sure if this answers your question, hope this helps.

Improve this answer
3
  • Thank you for your answer... It did help, although I was looking for a more practical one. E.g. vendors' specs never state their rate of false positives, I was hoping it could be inferred/estimated from the technology they use, or some other data that is publicly available, etc.
    – haimg
    Jan 1, 2012 at 5:52
  • Yeah, they don't give much information. Most laptops use Authentec sensors (authentec.com/a/Production/smartsensors_pc.aspx). I think they also have software solutions for identity management that includes software (authentec.com/Products/IdentityManagement/forHome.aspx), I don't know how they work or if they are any good, but might be useful to take a look
    – flpmor
    Jan 3, 2012 at 20:21
  • "I would want to see the specific details of how the system is implemented before deciding" Agreed. Unless you are super careful, all an attacker has to do is find out what the "OK" signal is that is sent along the USB cable, and they are in!
    – NH.
    Dec 19, 2018 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .