We’re rewarding the question askers & reputations are being recalculated! Read more.
129

No, not really. At least not as primary form of authentication. Biometrics in general are not good for authentication, because: You leave them all over the place, and there is no way to avoid that. They cannot be changed in case of a breach. You need to add a high error tolerance as to not cause usability problems. These tolerances lead to false positives, ...


58

It's useful as a "username" We have a name for an authentication feature that cannot be easily changed and is occasionally shown to third parties - it's your account ID, user name, etc. While you'd still want to use something else (e.g. a password) as the primary authentication feature, replacing the user ID with face recognition can make it more ...


37

A few thoughts about that: Biometric data is easy to access and should not be used as a password, only as additional authentication. As Freedom explained quite well your government already tracks you. Biometric data like fingerprints are mostly not stored as raw images but in form of hashes. An algorithm extracts certain characteristics. You cannot restore ...


35

The fingerprint does act as the sole means of authentication for accessing the device, but not for accessing secured services or sites. It therefore does not serve the same role as a password. Typically the fingerprint authentication is used as a second factor of authentication, the first factor being physical possession of the device on which the ...


28

A major problem with modern biometric authentication is the fact that it uses things like your fingerprint as a password. Unlike a real password, a fingerprint is not sufficiently secret. Biometric identities can be used for usernames, which merely need to be unique to you, but not passwords. There are a few issues with using DNA as a private key or any ...


27

Usability v/s Security Matrices isn't resolved with dependent Biometric Authorization & Authentication For example, before I start - have a look at how the basic foundation of security is built in matrices: It can be easily concluded that High Security unfortunately comes with low usability features. How Do I know This? I have been in ongoing ...


26

This will be abused and instead of password dumps we will see attackers trading voice sample dumps and building huge databases of identified voice samples from public documents and places like YouTube. There are also other issues here that make this a bad choice. There's no plausible deniability if someone didn't want to be coerced into authenticating an ...


21

Fingerprints cannot be hashed. Well, you can hash any sequence of bits, but that would not be interesting at all. Fingerprint readers, like all biometric applications, make physical measures which are never exactly reproducible. Instead, the reader must detect the positions of some "characteristic points" on the finger image (where ridges meet, mostly), and ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


19

This keeps popping up every year as the next big thing. 2016:Citi 2015:ING 2013:Barclays This 2014 paper Automatic speech recognition for under-resourced languages: A survey. Speech Communication by Besacier, L., Barnard, E., Karpov, A., & Schultz, T. (not open access) discusses the state-of-the-art of speaker recognition technologies. The survey ...


18

Biometrics can be effective as authentication or as identification, but not both at the same time. According to Wikipedia, retinal scans are accurate to approximately one in one million, meaning on the earth today there are approximately 7,000 individuals who will be identified as you in a retinal scan. Assuming no further authentication is necessary, ...


18

You tagged this with authentication, so I will answer from that perspective. (But as Aria points out in comments, it also has applications in surveillance.) For face recognition to be a cool feature on Facebook it just needs to work most of the time. For it to be useful for authentication it needs to have a fail rate close to zero. Almost no false positives ...


17

Based on the linked article, the biometrics to be used in this proposal are similar to what was used in the recent past on Georgia (US) drivers' licenses: a photo and fingerprint data. So this move would not be entirely without precedent. The linked article is a little short on details, so it is hard to assess what the risks to the individual might be ...


16

The whole point of resorting to biometrics, i.e. taking physical measures out of a body part of the human user, is that the said body part is attached to the user, and cannot be switched at will (it can, unfortunately, be removed, but not really glued back). It is true that the impossibility to revoke biometrics is an inherent problem, for which no good ...


14

You've already done enough research to see that facial recognition on android is easily circumvented. I've read (although I cannot find the link now) that researchers were able to defeat it by using picture of a similar looking person, not even the actual person. When you think about it expecting facial recognition to work on a device with limited resources, ...


14

Not using a cryptographic hash - no. But you could use a Fuzzy Hash or Locality-sensitive Hashing. Fuzzy hashes are different from normal hashes in that they allow similar content to cluster together in the hash collision space*. Typically one-way means you can not infer what was hashed - but with fuzzy hashes, if you know a similar file (fingerprint image)...


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


14

short: I'd go for the Hardware token. Long version: First things first: People have proven that it is possible to tamper with fingerprints in multiple ways. Probably the most common way is to recreate it from a fingerprint with a printer, but there are more options. You can see some of them in the article 7 ways to beat fingerprint biometrics. There is a ...


13

Reliably deriving cryptographic keys from biometric data is hard because of thresholds: biometric data is a continuum, but cryptographic keys are binary: a bit is a zero or a one, not something in between. Whenever you design a scheme to transform biometric data into keys, there will be people whose biometric data falls "on the edge" and who will get a wrong ...


12

Disclaimer: I've never used these terminals before and the only knowledge I have of the system you're describing is the description itself. How the authentication works So here's what you're actually doing -- You log in to the website. You provide biometric data to a fingerprint reader The website provides some "challenge" value for the fingerprint reader ...


11

As @Xander points out, a very similar question has been asked yesterday. Indeed: If you can derive a key from a fingerprint, then you can hash that key and get a hash value. If you can hash a fingerprint, you can use the hash value as a key. So they really are the same question. And the answer is: people are working on it, it does not work well yet, but ...


11

The government already has your photos, your fingerprints, your birth certificate, it knows where you live and what you have by taxes and the bills or otherwise you wouldn't officially exist. They can track you in public places using facial recognition with cameras, snoop in your internet traffic, listen to your calls, read your SMS... after all that do you ...


11

A fingerprint should never be used as a password. It might be used as a identifier. You cannot change your fingerprint. If it is your password and your account has been compromised, no way to set a new 'password' because you can't get new fingerprints. But it might not be ideal as a identifier either. I didn't know, but apparently fingerprints aren't that ...


10

No, theres no specific security reason to limit the number of fingerprints stored. However, given that these fingerprint modules normally is a HSM, like a smart card, storing fingerprints, the number of, and the size of the secrets such a fingerprint module can store, is limited. Note that a fingerprint template can also become quite a large, because ...


9

The iPhone 5S scanner was successfully fooled with a low-tech approach that has been known for a decade. The CCC published a plastic film with the finger print of the German Minister of the Interior a couple of years ago. It was taken from a glass of beer. The thin plastic film is put on a real finger, so that body temperature and a heartbeat is detected. ...


9

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive touch where a human finger's natural electric conductivity is ...


9

This is what FiveThirtyEight.com has to say: What To Do With A Million Stolen Fingerprints Hint: Think bigger than iPhones. [Fingerprints] could be used to sniff out individuals operating in a foreign country under false identities. Imagine that you, an American spy, travel to Hackistan ostensibly to work as the ambassador’s dog walker. The ...


9

You may want to blur it out. Fingerprint readers are pretty aggressive at picking up partial prints, and the way fingerprints can be easily forged there's no reason to post them publicly. However; you need to be aware that fingerprints are not secret. You leave usable prints on every glossy surface you touch, and duplicating them and fooling readers has ...


8

Fingerprints can be viewed as a fuzzy source of data. Given the same finger, a reader might never read exactly the same print. That is why most readers require the user to scan a finger multiple times during the registration phase. During the authentication phase, the system tries to determine if the scan it just acquired is "close enough" to the trained ...


8

A false negative is when biometric systems fail to recognize an authentic individual, which would lead to something not happening. Depending on what that something is there could be various consequences: Personal: An owner of a safe may be prevented from accessing that safe, leading to him/her being unable to access a necessary resource. Say they really ...


Only top voted, non community-wiki answers of a minimum length are eligible