Identity and Authentication are Separate Things: Why Fingerprints Shouldn't be Passwords | Hacker News Reader

Identity and Authentication are Separate Things: Why Fingerprints Shouldn't be Passwords

technet.microsoft.com

40 pointsmdasen27 comments

I worked for a fingerprint recognition startup in the early 90's and then later on my own in the early 00's. My quick summary: Fingerprints are effectively useless for security.

Technology reasons: Some systems are better than others but none is perfect. False positives and false negatives are part of the system. The worst part is not that everyone is affected .001% of the time but that a few people (usually older people or people who work with their hands) are affected most of the time.

Security reasons: As mentioned in the article, fingerprints need to be treated as public information. You leave them everywhere and are not that tricky to copy. Mythbusters did a nice episode on this. Also, you can't change them once they've been compromised. For a while I worked in a Top-Secret environment and we didn't use fingerprints exactly because they weren't secure and, worse, could give a false sense of security.

Convenience reasons: Given that you shouldn't use them for high security systems what about low security systems. I hacked a fingerprint reader onto my car and thought it was so cool. I took it to a local car dealer to get his impression. He showed me a new BMW that used a proximity card to unlock the car - blew my system away for convenience.

Societal reasons: There are a lot of people who will just never feel comfortable giving their fingerprint to a computer. The stigma is that's what criminals do. Most common lame joke when doing a fingerprint demo: "You gonna give that to the FBI?, ha ha ha".

Now one of you may come up with a way around all these issues. I know you can get a fingerprint reader on your laptop. I used to think it was pretty impressive when I had one of the first. Eventually the novelty wore off and the inconvenience factors led me to stop using it. I'd like to hear if someone has had more success than I did.

What is wrong with combining diverse metrics (fingerprint, iris, retina, height, weight, pulse, body-temp, voiceprint, gait, etc.)?

Nothing is "wrong" with doing that. What advantage to you hope to get by combining metrics?

>>> False positives and false negatives are part of the system.

>> What is wrong with combining diverse metrics

> What advantage to you hope to get by combining metrics?

Reduction of false positives and false negatives, i.e. increased recognition-accuracy.

Ok, but I think that would just make the other issues worse. Mind you, I'm an old cynic who couldn't get it to work, and you should never listen to old cynics. If you think there's something there I'd like to see what you come up with.

The problem with using biometrics at all is that you're conflating authorization with authentication. Those are fundamentally different (at least in the society we live in).

Biometrics are used for authentication - proving who you are (whether it works and can be duplicated is a different issue).Useful for a passport or driver's license.

Car keys, passwords, ATM pin numbers are a form of authorization.

For example, you may want to let your daughter withdraw money with your card or use your car. Biometrics can't be used for that purpose.

For example, you may want to let your daughter withdraw money with your card

That would be an example of a generic (unpersonalized) key. It's a poor example because:

1. People don't lend out ATM cards.

2. Why wouldn't I simply transfer funds into her account?

3. Physical cash is unlikely to exist for much longer.

or use your car.

The generic (unpersonalized) key, again. Why wouldn't I simply tell my car to let my daughter use it?

1) Not even to their own family?

2) Because I had to go to shop to pick up some Foo and meanwhile wanted her to get some money from the machine that was next door..?

3) um, ok. If you say so.

There are tons of reasons. I'm talking about how the world works right now. Not a hypothetical world that may or may not exist in the future.

Where did you get the idea that people lend ATM cards? http://www.google.com/search?q=%22lend+your+atm+card%22

http://www.google.com/search?q=%22lent+my+atm+card%22

Because I had to go to shop to pick up some Foo and meanwhile wanted her to get some money from the machine that was next door

If you were buying something from a physical shop, you wouldn't need money from a machine next door, because shops can give cash at the register from the customer's bank account. http://www.google.com/search?q=%22would+you+like+cash+with+t...

Man, you're really reaching. Forget it, you win.

To put it another way, biometrics can support ACL-based authorization, but not capability-based authorization. However, since the entire world is using ACL-based authorization anyway, it's not a practical limitation.

Early in the article, the author says that a card is something you have, a public identifying token, and, since it can be stolen, it should require something to unlock it. Later, in the hospital example, he suggests that a private key stored on a smartcard works as an authentication token. Seems to me that a card with a private key can be stolen just as easily as an ATM card.

Yes. But they are used in different contexts.

Finger print should not be password for a simple reason, it's going to be easier with technology to steal finger print; unlike password you can't change it : (. I saw and read document on technology available to transfer finger print into glove like molds. Finger print will eventually become Identity theft next biggest challenge.

Agreed. Unless phishing somehow becomes a solved problem which I don't see happening, then biometric authentication should never become mainstream. As it stands now, successful phishing attacks range in severity from mild annoyances to somewhat harmful. In all cases, though, they can ultimately be contained so that people can move on with their life. Biometric id, on the other hand, can't be readily changed.

Has anything other than biometric authentication been used as ultimate identification for the past 100,000 years? What would you replace this presently-ubiquitous identity system with?

What humans do to recognize each other is totally different from "biometric authentication" as the term is used in computer security.

What humans do to recognize each other is totally different from "biometric authentication" as the term is used in computer security.

How is it different? Your acquaintances do not sense general factors of Wmfness based on your height, build, voice, accent, verbal expressions, face, hair-color, hair-style, hair-length, facial hair, clothes, accessories, gait, hand-size, foot-size, body odor, etc.?

Because fooling an electronic device (which has to eventually encode your identity as a stream of 1s and 0s anyway) is a lot different from fooling another human.

In some cases, it might be more difficult to dupe a machine, but in many cases, it would also be easier.

Your acquaintances do not sense general factors of Wmfness based on your height, build, voice, accent, verbal expressions, face, hair-color, hair-style, hair-length, facial hair, clothes, accessories, gait, hand-size, foot-size, body odor, etc.?

Thank you; that's exactly my point. Biometric authentication products on the market look at only one or two aspects, not the whole person. Heck, most fingerprint readers don't even care whether there's a person attached to the finger.

The difference is the ability to duplicate that information. For normal face to face recognition, it is reliable because it is impossible to totally duplicate another person even if you are given complete knowledge of every identifiable feature of that person.

Electronic biometric identification, on the other hand, can be flawlessly duplicated provided that you have accurate information on the aspect of the person being used to id them, as well as the method of transmitting the data.

This might begin a useful discussion of the identity-authentication distinction and how it should inform web development projects. I'm voting it up in the hopes that people more in the know will update this Microsoft perspective (the article is dated February 2006). I'm a noob on such issues. Maybe some YHackers would like to link to some 2009-ish offerings about it?

The way you might implement these abstract concepts in an application might have changed over the past 3 years, but the concepts themselves are still pretty applicable.

I continue to be amazed that physical credit cards don't require any authentication. Losing one is like losing (someone else's) cash. Why don't the stores or banks require a PIN number when using a credit card?

Because (rightly or wrongly), the stores have concluded that the gain from making it so easy to buy something with a credit card is more than the loss they face from the fraud that you describe.

Well, they do over here on this side of the world (UK & Ireland). Chip & Pin cards here were introduced in 2004 and most stores must carry them or Visa / Mastercard will not indemnify the stores against fraud.

See http://en.wikipedia.org/wiki/Chip_and_PIN for more info

Reply on news.ycombinator.com