Some sources out there will disagree with the following statement but it has to be said.
Biometrics are NOT authentication. Biometrics are IDENTIFICATION.
Do NOT use biometric for authentication, but you can use them for identification just fine!
There is 3 important concepts for security :
- Identification : Who you are
- Authentication : How you prove who you are
- Authorization : What access you get based on who you are
The big problem with biometric is that you are not able to change them. If you are not able to change them, what happen when they get stolen?
For identification, you can reuse the same username or biometric everywhere. It doesn't matter that you reuse the same thing since it's who you are. It's also not a problem if it cannot change since who you are will never change.
For authentication on the other hand, you need to be able to change things in case they get stolen. You are able to change what you know, passwords, and you are able to change what you have, phone/token device/email address. But, you are not able to change what you are, bimotric.
Hence, biometric is the worst pick for authentication as it's really identification.
The good part
This does not mean that biometrics are useless. In fact, they can provide very good identification as it will be harder for an attacker to steal the biometric of one person than to simply write his public user name.
But, it's just identication. You still need authentication and yes multi-factor authentication is better than single authentication.
There are 3 things you can use for identication / authentication.
- Something you know : password
- Something you have : phone, token device, email address
- Something you are : biometrics, username
If you want the best security, you need to combine them this way :
- Identification : Something you are + Something you have
- Authentication : Something you know + Something you have
Something you have is the only thing that can be use as both identification and authentication since it's assumed that you are the only one with it.
Something you are cannot be used as authentication as it cannot change
Something you know cannot be used as identification as you cannot reveal it
If you really have to pick only one then #3 (smart card + pin) should be the answer.
If you can pick more than one then #1 (iris scan) + #3 (smart card + pin) provide the best security
http://technet.microsoft.com/en-us/library/cc512578.aspx (great article on the subject)
Proper biometrics are identity only and will be accompanied, like all
good identifiers, by a secret of some kind -- a PIN, a private key on
a smart card, or, yes, even a password.