Good, Bad And Ugly Of Fingerprint Scanning - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile // Mobile Devices
12:59 PM
Connect Directly

Good, Bad And Ugly Of Fingerprint Scanning

Apple's recent purchase of Authentec points toward the possibility of a fingerprint-secured iPad. There are some advantages to the technology, some disadvantages, and some dangers.

While some call it merely a blocking move against Samsung and other competitors, the acquisition by Apple of Authentec increases the potential for an iPad secured by a fingerprint reader.

Such technology has some real advantages, according to security technologist Bruce Schneier. "You want it to be as fast or faster than the four-digit PIN," which is the current default security feature for iOS devices, he said. Fingerprint scanners certainly meet that requirement.

But what about security issues? Can it be faked? Are there privacy dangers? Schneier points out "Remember, what we're trying to replace here is a four-digit PIN." Such a PIN can't be considered a particularly strong security barrier, so the bar is low if all you're looking for is an improvement.

As for privacy, there is a right way and a wrong way to implement a fingerprint system. If all the device does is compare the print to a master stored locally on the device, then Schneier sees no particular privacy problem. Privacy problems do show up when you start storing prints in databases outside of the device.

It's also important to understand what such devices can and can't do. It's not that hard for a determined attacker to spoof a fingerprint that will defeat a reader, as the Mythbusters demonstrated a few years ago:

Phillip Hallam-Baker of Comodo notes that the Secret Service follow the President about breaking every glass he touches just to stop people getting fingerprints from them.

The worst-case scenario for this is where criminals cut off a finger to use it for access. There might be some urban legend around this, but it really has happened, as described in this 2005 BBC report. The companies that make the scanners claim to be able to defeat these attacks in various ways, but this doesn't satisfy Hallem-Baker: "...that is irrelevant unless they convince the bad guys not to try. If attacked, I am not going to be thinking 'oh at least they didn't get my employer's email' as I look at the bleeding stump where my finger used to be."

Like Schneier, Hallem-Baker thinks fingerprint scanners could be a valuable addition to mobile devices if properly implemented and if users have proper expectations of them. But scanners should always just be a second factor, not the only barrier to entry.

He also points out that fingerprints aren't the only technology Authentec works on. The acquisition could be about more.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

New Storage Trends Promise to Help Enterprises Handle a Data Avalanche
John Edwards, Technology Journalist & Author,  4/1/2021
11 Things IT Professionals Wish They Knew Earlier in Their Careers
Lisa Morgan, Freelance Writer,  4/6/2021
How to Submit a Column to InformationWeek
InformationWeek Staff 4/9/2021
White Papers
Register for InformationWeek Newsletters
Current Issue
Successful Strategies for Digital Transformation
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
Flash Poll