Mobile // Mobile Devices
News
7/30/2012
12:59 PM
Connect Directly
Twitter
Facebook
Google+
LinkedIn
RSS
E-Mail
50%
50%

Good, Bad And Ugly Of Fingerprint Scanning

Apple's recent purchase of Authentec points toward the possibility of a fingerprint-secured iPad. There are some advantages to the technology, some disadvantages, and some dangers.

While some call it merely a blocking move against Samsung and other competitors, the acquisition by Apple of Authentec increases the potential for an iPad secured by a fingerprint reader.

Such technology has some real advantages, according to security technologist Bruce Schneier. "You want it to be as fast or faster than the four-digit PIN," which is the current default security feature for iOS devices, he said. Fingerprint scanners certainly meet that requirement.

But what about security issues? Can it be faked? Are there privacy dangers? Schneier points out "Remember, what we're trying to replace here is a four-digit PIN." Such a PIN can't be considered a particularly strong security barrier, so the bar is low if all you're looking for is an improvement.

As for privacy, there is a right way and a wrong way to implement a fingerprint system. If all the device does is compare the print to a master stored locally on the device, then Schneier sees no particular privacy problem. Privacy problems do show up when you start storing prints in databases outside of the device.

It's also important to understand what such devices can and can't do. It's not that hard for a determined attacker to spoof a fingerprint that will defeat a reader, as the Mythbusters demonstrated a few years ago:

Phillip Hallam-Baker of Comodo notes that the Secret Service follow the President about breaking every glass he touches just to stop people getting fingerprints from them.

The worst-case scenario for this is where criminals cut off a finger to use it for access. There might be some urban legend around this, but it really has happened, as described in this 2005 BBC report. The companies that make the scanners claim to be able to defeat these attacks in various ways, but this doesn't satisfy Hallem-Baker: "...that is irrelevant unless they convince the bad guys not to try. If attacked, I am not going to be thinking 'oh at least they didn't get my employer's email' as I look at the bleeding stump where my finger used to be."

Like Schneier, Hallem-Baker thinks fingerprint scanners could be a valuable addition to mobile devices if properly implemented and if users have proper expectations of them. But scanners should always just be a second factor, not the only barrier to entry.

He also points out that fingerprints aren't the only technology Authentec works on. The acquisition could be about more.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Must Reads Oct. 21, 2014
InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and community news at InformationWeek.com.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.