Are Fingerprints a Good Authentication Factor?
Posted on November 24, 2004
Good article from Bill Can at Microsoft. Some very interesting comments too:
# re: Are Fingerprints a Good Authentication Factor? 11/23/2004 10:04 AM Peter da SilvaThe problem with fingerprints as an authentication factor is that you can’t change ‘em and you can’t hide ‘em. Why would you want to change the token you use to authenticate? Well, the suthentication software isn’t actually using your fingerprints to authenticate against… they’re using a stream of digital signals derived from them. If someone can get a copy of that stream, and a compromised scanner, they can use them in a replay attack. If someone can get a picture of your fingerprints, they can scan it and try and reproduce that stream.
If you’re giving them a revokable password, you can change your password, but how do you change your fingerprints?
The idea of a personal input device is a good one, but rather than using the biometric information as the authentication token, keep your certificates and other cryptographic keys in that device, and use your fingerprint as a mechanism for unlocking it. That way you can revoke a compromised certificate while still have biometric security for the “keychain” device.
Unlike a conventional smartcard, the “keychain” device would not be the token itself: you would load keys into it at an appropriate station (for example, you could copy your bank keys at an ATM, or the ones to unlock your computer at the computer itself). You could copy your keys into one for your purse, one for your glovebox, one in your desk at work, so you wouldn’t have to worry about losing it, or having stacks of cards to carry around, or worry about your keys being compromised if someone got the card…
» Filed Under Blogger Posts
Comments
Leave a Reply