News
3/18/2013
00:00 AM
Dave Kearns
Dave Kearns
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

With Biometrics, Can Fingers Do Password Management's Work?

Biometrics are one way end users can, literally, "give the finger," to cumbersome password management systems. But it won't be cheap.

Why haven't companies replaced clunky password management with fingerprint biometrics for mobile device authentication? Three words: fear, uncertainty, and doubt (FUD).

The vendor Sileo once claimed in a blog post:

In a worst-case-scenario, someone inside of the biometric database company could attach their fingerprint to your record — and suddenly they are you. The reverse is also true, where they put your fingerprint in their profile so that if they are convicted of a crime, the proof of criminality is attached to your finger.

Sileo was either purposely lying or extremely naïve. The fingerprint stored in the database has no possible use to law enforcement, because it isn't an image of your finger. The reader and the accompanying client software take multiple measurements (the best take many, many measurements) of the ridges and valleys on the tip of your finger. They then compute a number according to a proprietary algorithm and hash that number. That becomes the token for your fingerprint.

Because the token is salted and hashed, it's irreversible. Even if you have all the computing power in the world, you simply cannot recreate that fingerprint to implicate someone in a crime.

Another point that's frequently made is that you can easily (and frequently) replace a password, but you can't replace your finger or change your fingerprint. But you've got eight fingers and two thumbs. They have different patterns -- perhaps even more different than your last 10 passwords. How often has your password been hacked? More than nine times? And even though you should probably change the finger you use periodically, reusing a finger after a year or so really shouldn't cause a problem.

Then there are the stories that keep resurfacing about how easy it is to fool a biometric reader with a photograph. And it's true that cheap readers can be fooled. It's the equivalent of having a system that limits passwords to four lowercase letters. Just as you need to consider the strength of your password requirements, you need to consider the sophistication of your biometric readers.

This brings us to the only reason that could stop you from using biometrics: the cost. Passwords can be implemented for no cost. Even password-based single sign-on solutions can be had for less than $10 per user. But even a cheap, easily fooled biometric system will set you back $25-$50 per user. A decent system will more than likely cost more than $100 per user (unless you have tens of thousands of users, but you still likely would pay a half million for one of those systems). What happens when you go to the bean counters and say you want to spend $100 for each employee, partner, client, etc. who needs to authenticate to your system? I don't have to tell you what the answer will be.

It's not the technology that's the problem, really. It's the fear, uncertainty, doubt, and cost. Still, once you've been hacked and the crown jewels have been stolen or leaked, it'll probably be easier to convince the powers that be that a better system is needed. Just hope they don't make you the scapegoat.

This article originally appeared in The Transformed Datacenter on 5/27/2013.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Title Partnerís Role in Perimeter Security
Title Partnerís Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3090
Published: 2014-09-23
IBM Rational ClearCase 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3101
Published: 2014-09-23
The login form in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not insert a delay after a failed authentication attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.

CVE-2014-3103
Published: 2014-09-23
The Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http...

CVE-2014-3104
Published: 2014-09-23
IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.

CVE-2014-3105
Published: 2014-09-23
The OSLC integration feature in the Web component in IBM Rational ClearQuest 7.1 before 7.1.2.15, 8.0.0 before 8.0.0.12, and 8.0.1 before 8.0.1.5 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account n...

Best of the Web
Dark Reading Radio