Biometric authentication in the real world

Question

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?

Answer 1

As I'm sure I posted in one of the other biometric questions, the only places I see it a lot are datacentres. And more specifically, datacentres protecting high value root certs. For this type of environment it is the norm, rather than the exception. Update to say - it is only ever used in addition to all the other controls, not instead of!

Elsewhere, it's patchy - people are starting to use fingerprint scanners on laptops etc., but I get the impression that is just because they are there so might as well be used:-)

Answer 2

Fingerprint scanners have become more common since they became so cheap. Several years ago they were included in nearly every laptop on the market. They're not so common anymore, though, presumably because people never used them.

Most of the top-tier datacenters I've visited have had some sort of biometric scanner at the door -- usually hand geometry -- though I rarely see biometrics entering any other type of building. As a rule, facilities built or upgraded from around 2000 to about 2007 will often implement biometric security. Some new places still do, but it's not as in vogue as it used to be.

There's an important point about biometric authentication that many of the commercial installations respect, but which is not immediately obvious: you should never rely on biometrics to supply both authentication and identification. Biometric measurements are useful, but they're in no wise unique. Two people may not have the exact same fingerprint, hand geometry, or iris patterns, but the measurements are often lossy enough to allow for collisions. Biometrics need to be just one part in a multi-factor authentication system.

Answer 3

Over the years I've seen commercial organisations evaluating biometrics (e.g. voice) and limited deployments (e.g. fingerprint readers on pcs), but it's very rare in my experience (which is mainly with financial and large asset management organisations).

I think the main reasons biometrics have not got very far are:

1. Flaky implementations (e.g. simply don't work very well, and often prevent the real users from getting in!)
2. The actual security achievable in practice is far less than the initial impression given by the James Bond style tech. Because of this biometrics are generally preferred in organisations which either have very special environments (e.g. data centres) and/or organisations that are given to security theatre.

The reason for (2) is that any biometric system digitises some human characteristics, and the resulting bunch of bits is by definition not secret and eminently replayable. Thus one must trust the sensor and all the communications with it. This is almost impossible to achieve outside of a physically secure environment, and actually impossible to achieve without physically secure sensors.

Furthermore even given a physically secure sensor one has to be sure that the sensor is reliable against errors and impersonation attacks. For example a fingerprint sensor must be able to tell that the fingerprint it is reading is actually alive and attached to the person, and also not a fabricated replica :-)

Answer 4

I work in the biometrics security field for a government contractor. I can't get into specifics of who uses our products and services for security and non-disclosure reasons; but it's used by a wide variety of government, military, law enforcement and private organizations.

We can provide SDKs so people can develop their own applications which interface via drivers to the hardware; or they can use our solutions for software along with the hardware.

There's many different forms of biometrics in both portable and stationary forms, all which range from iris/retina scanning and fingerprinting to much more. (Again, sorry I can't go into details.)

PS - Ubuntu has biometric support built into it, but none of our customers ude that, to my knowledge.

Answer 5

I'm not sure that any single person could answer this one - I get the sense that we all work in different industries, so there's probably no one right answer. I'd bet that if you hit the right niche, the answer is "of course, we use it everywhere" but many other industries would say "it's an interesting idea, but we don't use it."

I'm certainly in the "it's an interesting idea, but we don't use it" camp. I do a lot with PKI, but then that's my career. I've been in several cases where I've heard of biometric access controls in some other system that someone I knew used, but it always seems rare and far away.

Answer 6

If you are asking about "how many different technics, such as fingerprint scanning, retina scanning, hand scanning, ear scanning etc.", then I think I named them all.

If you are asking, how widespread the use of biometrics is, then I'd say "not much" mainly due to lack of uniform APIs that would work as a bridge between user applications and hardware. Each hardware vendor has it's own set of APIs. There exists BioAPI, but it lacks some important (for programming) things such as lack of encryption mechanisms (simply answering "this person is 99,99% the one he claimed to be" is not enough in many scenarios).

However, with growth in demand for two-factor authentication, biometric solutions should gain more important role, maybe via some scanners built into smart devices. But that's I'd say 2-3 years away from now (at least).

Answer 7

The most consistent biometrics implementation that i see is for datacenters. Aside from a smaller lab, all the datacenters that I have dealt with require some level of biometrics, mostly hand scanners.

Again, this is purely my experience. Other than that, biometrics seem to be underutilized in the corporate environment. I think it would be amusing to see how many people jump on the biometric bandwagon if there was some integration into LDAP or AD (wait... is there?).

Answer 8

One thing I didn't see mentioned is using fingerprint scanners to prevent time-clock fraud. This has significant takeup with some of the largest players in retail and timekeeping adopting it. I'm not sure the actual percentage but I've seen them all over the States. The vendors' argument is that they prevent thousands to tens of thousands in time-clock fraud a year vs what they cost. Work reliably enough in practice so I'd say it's one of few success stories for biometrics.