Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News

3/18/2013
12:00 AM
Dave Kearns
Dave Kearns
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

With Biometrics, Can Fingers Do Password Management's Work?

Biometrics are one way end users can, literally, "give the finger," to cumbersome password management systems. But it won't be cheap.

Why haven't companies replaced clunky password management with fingerprint biometrics for mobile device authentication? Three words: fear, uncertainty, and doubt (FUD).

The vendor Sileo once claimed in a blog post:

In a worst-case-scenario, someone inside of the biometric database company could attach their fingerprint to your record — and suddenly they are you. The reverse is also true, where they put your fingerprint in their profile so that if they are convicted of a crime, the proof of criminality is attached to your finger.

Sileo was either purposely lying or extremely naïve. The fingerprint stored in the database has no possible use to law enforcement, because it isn't an image of your finger. The reader and the accompanying client software take multiple measurements (the best take many, many measurements) of the ridges and valleys on the tip of your finger. They then compute a number according to a proprietary algorithm and hash that number. That becomes the token for your fingerprint.

Because the token is salted and hashed, it's irreversible. Even if you have all the computing power in the world, you simply cannot recreate that fingerprint to implicate someone in a crime.

Another point that's frequently made is that you can easily (and frequently) replace a password, but you can't replace your finger or change your fingerprint. But you've got eight fingers and two thumbs. They have different patterns -- perhaps even more different than your last 10 passwords. How often has your password been hacked? More than nine times? And even though you should probably change the finger you use periodically, reusing a finger after a year or so really shouldn't cause a problem.

Then there are the stories that keep resurfacing about how easy it is to fool a biometric reader with a photograph. And it's true that cheap readers can be fooled. It's the equivalent of having a system that limits passwords to four lowercase letters. Just as you need to consider the strength of your password requirements, you need to consider the sophistication of your biometric readers.

This brings us to the only reason that could stop you from using biometrics: the cost. Passwords can be implemented for no cost. Even password-based single sign-on solutions can be had for less than $10 per user. But even a cheap, easily fooled biometric system will set you back $25-$50 per user. A decent system will more than likely cost more than $100 per user (unless you have tens of thousands of users, but you still likely would pay a half million for one of those systems). What happens when you go to the bean counters and say you want to spend $100 for each employee, partner, client, etc. who needs to authenticate to your system? I don't have to tell you what the answer will be.

It's not the technology that's the problem, really. It's the fear, uncertainty, doubt, and cost. Still, once you've been hacked and the crown jewels have been stolen or leaked, it'll probably be easier to convince the powers that be that a better system is needed. Just hope they don't make you the scapegoat.

This article originally appeared in The Transformed Datacenter on 5/27/2013.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.