0

Obviously biometric security is a hot-button topic. I happen to attend a university with a well known biometrics department. (Which I'm not a part of.)

My problem is, biometrics has a large caveat: it can't be changed.

Once my fingerprint has been compromised, it is no longer useful as a security measure. Realistically, we each leave fingerprints everywhere.

Now at the current time, people aren't out in droves stealing fingerprints. Arguably, however, it is not yet profitable to do so.

With advances in general technology, researchers have successfully stolen fingerprints using a high-resolution camera:PCMag Article

Theoretically that idea could be expanded to retina scans as well. (3-D printing, anyone?)

Even a heartbeat detection system would need changed if the user experienced a cardiac event.

So then, my question is: Do standalone biometrics have a place in security?

If a database is compromised with some sort of hash of my fingerprints, what am I supposed to do for every other place they are in use? It just seems like a major flaw.

Improve this question
4
  • I don't pretend to be an expert in Biometrics, but what about palm scanners? They scan the veins in your palm, which can't be "seen" without exposing the palm to intense light. I mean, if an attacker can do that, they'll probably have $5 wrenches too.
    – KnightOfNi
    Commented Jan 23, 2015 at 2:08
  • That's a good idea! I hadn't thought of that. Really, if they're scanning veins in your hand (which are unique to each person), they could simultaneously take pulse, and fingerprints. I think an interesting part about this might be that a palm is a large surface area and potentially could be divided up into different "sectors". You could store one sector as part of your credentials (marked by land marks on the hand). If a database were compromised, you could use a different "sector" as part of later authentication.
    – Ramrod
    Commented Jan 23, 2015 at 2:12
  • retina scanners fall into the same category - you can't just capture someone's retina in public
    – schroeder ♦
    Commented Jan 23, 2015 at 18:23
  • Retina scanners have been supplanted by iris scanners. Each iris is unique (even both irises on one person are different). The technology is still image based. Although, I imagine you would need to.scare someone to get their eyes to open wide enough to take an effective picture.
    – Ramrod
    Commented Jan 23, 2015 at 18:29

1 Answer 1

Reset to default
2

You've asked a lot of questions in one go.

The big factor in your question is when you only use biometrics as an authentication mechanism. Typically, the biometric data is combined with other data (e.g. a password) in order to provide authentication data. In this way, fingerprints are viable because they are not the only thing a person needs.

As for the stolen database of fingerprint hashes, you are protected in that the hashes will be unique for that system. Just as passwords are hashed and salted to be unique, so would your fingerprints. If the database was stolen, then in theory, no one would be able to recreate your fingerprints.

As for changing biology over time, the typical scenario if the biometrics of a person changes (cardiac event, amputation, etc.), is that you simply reregister the info in the system. That's not a big problem. There was one prototype system that a person wore that would characterize the person's cardiac profile constantly over time, so it would slowly adjust as the person aged.

So, yes, just as a standalone password has a place in security, so does biometrics. Yes, there are challenges, but biometrics are a convenient way to bolster authentication security.

Improve this answer
2
  • That is also what I took away from this talk at 31c3: ccc.de/en/updates/2014/ursel - never use biometics as a single means of authentication. Also consider, that in some countries there is legislation that can order you to surrender your biometric data - not so for passwords (GB excluded).
    – r_3
    Commented Jan 23, 2015 at 16:52
  • In the US, at least the last time I did any learning about case law, passwords are considered contents of the mind. Therefore, you can refuse to give them up via the 5th amendment if they're self incriminating. (Say you had a full disk encryption and they needed the password to access the case-making evidence.) They could, however, look through your paperwork to see if it's written down. You make a good point r_3.
    – Ramrod
    Commented Jan 23, 2015 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .