In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world). I heard quite a few pros and cos of both of them and this got me thinking.
Why do we use password and passphrase at all instead of biometrics? I know biometrics are not the holy grail of authentication and/or identification, but (And the most popular password is... from ZDNET) at least I can be pretty sure that majority of users won't have the very same and easy to guess biometrics. Also I can't forget my finger or iris (while I can forget password / passphrase). With the era of cloud coming, the major strength of passphrases (length) might easly be ephemeral.
Like I said, I know biometrics are not perfect, but if we know that passwords / passphrases are the Achilles' heel of almost every system, why are biometrics underused? According to Tylerl (Biometric authentication in the real world from this site, second answer), biometrics is used even less than it used to be. I mean, even if fingerprints are easily forged, it's still better than having many users with password 123456 or qwertz, at least from my point of view (feel free to prove me wrong).
So, in short, what are the biggest problems / obstacles which are stalling widespread adoption of biometrics?
I won't comment each reply, but put my thoughts here. Also I would like to clarify some things.
Problem of normalization
I don't know how is it in USA, but in UK law states that you need at least 5 (or 7, I'm not sure) referent points used in matching. This means that even if you don't have perfect scan, system can still do matching against vector (which is representing fingerprint) stored in DB. System will just use different referent points. If you are using face as biometric characteristic EBGM can recognized person even if face is shifted by ~45°.
Problem of not-changeable (characteristics)
Well, you can actually change characteristics - it's called cancelable biometric. It's working similar as salting. The beauty of cancelable biometric is that you can apply transformation daily is needed (reseting password every day could result in a lot of complains).
Anyway, I feel like the most of you are only thinking about fingerprint and face recognition, while in fact there are much more characteristics which system can use for authentication. In bracket I'll mark the chances of fraudery - H for high, M for medium and L for low.
- iris (L)
- termogram (L)
- DNA (L)
- smell (L - ask dogs if you don't believe me :] )
- retina (L)
- veins [hand] (L)
- ear (M)
- walk (M)
- fingerprint (M)
- face (M)
- signature (H)
- palm (M)
- voice (H)
- typing (M)
Ok, let say biometric hardware is expensive and for simple password you have everything you need - your keyboard. Well, why there aren't systems who are using dynamic of typing to harden the password. Unfortunately, I can't link any papers as they are written in Croatian (and to be honest, I'm not sure do I even have them on this disk), however few years ago two students tested authentication based on dynamic of typing. They made simple dummy application with logon screen. They uploaded application on one forum and post the master password. At the end of this test there were 2000 unique tries to log with correct password into the application. All failed. I know this scenario is almost impossible on the webpages, but locally, this biometric characteristic without need of any additional hardware could turn 123456 password into fairly strong one.
P.S. Don't get me wrong, I'm not biometric fanboy, just would like to point out some things. There are pretty nice explanations like - cost, type 2 error, user experience,...