Falsehoods programmers believe about Biometrics

I like how the article provides examples, that's what I was always missing in the original articles; fortunately there are versions with examples now, e.g.: https://shinesolutions.com/2018/01/08/falsehoods-programmers... .

I wish there were more points though; at the moment there are only five, while the linked "Falsehoods Programmers Believe About Names" had more than 30.

One missed in the list is the seller / marketer always hyperinflates the equivalent bits strength of a biometric under the most ideal conditions etc.

In real world practice the equivalent number of bits of something like a real world iris scanner is NOT even close to the number of megapixels in the camera LOL.

Another problem alluded to was filth. The fingerprint scanner at a former employer was filthy beyond all recognition after housekeeping destroyed the first one trying to clean it (side issue, why are all biometric sensors so incredibly non-robust compared to a RFID scanner or human guard?). Anyway the thick gross layer of human grease on the fingerprint scanner made people grossed out during flu season so they would capacitive couple getting close to but not touching the sensor and relying on the last person to touch the filthy thing to have left enough fingerprint to work. It worked pretty well. The concept of a non-contact fingerprint scanner in the last century is pretty funny. I wonder if it still works. A more general filth problem is in the covid era I would not want to share eyeball juice with everyone going thru a retina scanner.

I thought this would be a great list to share, but found it quite short and wanting in certain respects.

I don't know what class of programmers this list is intended for, but I believe that anything about biometrics should start with the statement that biometrics capture and verification are all about probabilities and thresholds for false positives/false negatives. They're not deterministic.

This list doesn't comprehensively cover the falsehood that biometrics are considered by many systems to be static throughout one's life. Biometrics change with working conditions, age, health conditions, weather and environmental factors, due to accidents, surgeries, etc. The "Biometrics can’t be changed" section could do with more information.

I think most programmers are aware of these. It's lawmakers who need a refresher.

The article for me is missing the rationale behind those claims. I am not sure programmers believe those things. I would expect each of these claims to have at least one story/link backing them up.

I'm not sure any programmer claims that biometrics are the "perfect security measure", and if they did it would be nice to have a source.

How probable is it that my fingerprint matches with someone else's, given that there is some acceptable variance allowing my fingerprints to work every time?

> a family with a genetic mutation which means they have no fingerprints

I had to give ink fingerprints a few years back and the ah, Print Taker Person expressed some concern that my prints were on the border of not being visible enough (I have a heck of a time with the fingerprint doodad on my Mac). When I was recounting the incident to my grandmother, she said the same thing happened to her mother when they immigrated. It's not that I have no fingerprints, but they are very faint and partial.

> Biometrics are, at best, usernames.

He probably needs to add this to the list of falsehoods because a lot of programmers (including the author) believe this falsehood. Biometrics are different to usernames.

If you are under the impression that they are equivalent please include a copy of your fingerprint in your reply, to go with your username!

Repeat after me: Biometrics are not passwords. Biometrics are not usernames.

Pretty meh piece. This isn't so much "falsehoods programmers believe about Biometrics" as it is "strawmen and tired memes 'techies' toss around about Biometrics". And sure enough at the end, the idiotic "biometrics are usernames" thing comes out. No, they're not usernames, nor are they passwords. They're measurements, any measurements, of our bodies. Hence bioMETRICS. They can be fingerprints sure (one of the oldest ones), but they can also be anything from faces and retina to the musculature of your ass or skeletal structure, your gait as you walk or patterns in how you type. Biometrics are a rapidly advancing but still fairly primitive field, but anything about someone's body that reasonably reliable bits of entropy can be extracted from can be part of an overall biometric pattern. Like ALL security, they are part of an economic equation as well as arms race in terms of how much time/resources attackers must expend vs how much users must expend and the value of attack.

They're not silver bullets, but neither is anything else by definition. They can absolutely be an extremely useful part of a secure system for multiple reasons. Amongst them, two big ones are usability and threat model match. First, security systems are designed for and must be usable by some set of human beings at a practical level. The amount of time/resources the defenders need to expend has to be feasible and proportional. If that isn't the case then you simply end up with people working around it, the classic passwords-on-sticky-notes or add-one-each-required-rotation or whatever issues. Telling everyone they have to memorize 256 bits of entropy and then rotate it every 6 months and then having that fail to happen isn't a failure of the users, it's a failure of the security system because it's a shitty fucking system. Biometrics, properly done (like anything else), offer a significant number of bits that require a different attacker model to copy at high ease of use to the majority of users. The ratios alone make it worthy of consideration.

Second, they flat out are better against certain common threat models. Like this bit at the end:

If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism.

If you think a state actor is after you, well you're probably fucked. But that aside "just universally use passwords" is WORSE advice. We now live in an era of near perpetual over the shoulder high resolution video surveillance in many public spaces, ever cheaper drones that can offer the same anywhere outdoors, and extremely hard to detect cameras that can be quickly installed indoors. We have good enough storage and AI analysis to handle a lot of simple stuff, as China is putting into practice. From a fundamental ML standpoint, "a human entering a pin/passcode on their phone, tablet or computer" is a VERY regular pattern. The boxes or screens for entry, the result of entry (typically a bunch of dots), the patterns of input, all are highly regular in general. In turn, I'd be genuinely surprised if state actors aren't already at least testing universal wide scale automated password harvesting. Someone enters a password in view of a surveillance camera, and it automatically records their key entry in real time and matches it to their face. In contrast, good biometrics require some level of individual targeting and resource expenditure (this is a shifting target sure, but so is everything else in security).

I'd certainly never depend on biometrics everywhere, but everything in sec is about layers and matching tools to threats. I do try to use biometrics and HSMs whenever I'm out in public, along with long master passwords that I enter in more physically secure areas. It's irritating to see them get dismissed so blithely by people who should know better, rather then recognizing they're a work in progress along with other authentication.

And as far as state actors or even other lesser physical individualized threats go, frankly normal people just don't have the tools right now at all unfortunately. Dealing with attacks like that requires higher level composite tools like coercion codes or automated location/use/code based device views, all transparently implemented across major classes of devices and backed up and down the stack. Biometrics have a big role to play in that too, but they're just primitives along with other authentication factors for use in more complex applications.

Pro musicians have a big problem with their fingerprints. The scanners often have trouble picking up e.g. a pro pianist's or a guitar player's fingerprints, or even when they do, they'll fail to identify it days or weeks later.

This is a more extensive list of falsehoods i usually use.

https://github.com/kdeldycke/awesome-falsehood

Just a few weeks ago the German government introduced the requirement to upload fingerprints to national ID cards... Quite sad.