Mobile // Mobile Devices
News
7/30/2012
12:59 PM
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%
Repost This

Good, Bad And Ugly Of Fingerprint Scanning

Apple's recent purchase of Authentec points toward the possibility of a fingerprint-secured iPad. There are some advantages to the technology, some disadvantages, and some dangers.

While some call it merely a blocking move against Samsung and other competitors, the acquisition by Apple of Authentec increases the potential for an iPad secured by a fingerprint reader.

Such technology has some real advantages, according to security technologist Bruce Schneier. "You want it to be as fast or faster than the four-digit PIN," which is the current default security feature for iOS devices, he said. Fingerprint scanners certainly meet that requirement.

But what about security issues? Can it be faked? Are there privacy dangers? Schneier points out "Remember, what we're trying to replace here is a four-digit PIN." Such a PIN can't be considered a particularly strong security barrier, so the bar is low if all you're looking for is an improvement.

As for privacy, there is a right way and a wrong way to implement a fingerprint system. If all the device does is compare the print to a master stored locally on the device, then Schneier sees no particular privacy problem. Privacy problems do show up when you start storing prints in databases outside of the device.

It's also important to understand what such devices can and can't do. It's not that hard for a determined attacker to spoof a fingerprint that will defeat a reader, as the Mythbusters demonstrated a few years ago:

Phillip Hallam-Baker of Comodo notes that the Secret Service follow the President about breaking every glass he touches just to stop people getting fingerprints from them.

The worst-case scenario for this is where criminals cut off a finger to use it for access. There might be some urban legend around this, but it really has happened, as described in this 2005 BBC report. The companies that make the scanners claim to be able to defeat these attacks in various ways, but this doesn't satisfy Hallem-Baker: "...that is irrelevant unless they convince the bad guys not to try. If attacked, I am not going to be thinking 'oh at least they didn't get my employer's email' as I look at the bleeding stump where my finger used to be."

Like Schneier, Hallem-Baker thinks fingerprint scanners could be a valuable addition to mobile devices if properly implemented and if users have proper expectations of them. But scanners should always just be a second factor, not the only barrier to entry.

He also points out that fingerprints aren't the only technology Authentec works on. The acquisition could be about more.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Government, May 2014
NIST's cyber-security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work?
Video
Slideshows
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.