Good, Bad And Ugly Of Fingerprint Scanning - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Mobile // Mobile Devices
News
7/30/2012
12:59 PM
Connect Directly
Twitter
Facebook
Google+
LinkedIn
RSS
E-Mail
50%
50%

Good, Bad And Ugly Of Fingerprint Scanning

Apple's recent purchase of Authentec points toward the possibility of a fingerprint-secured iPad. There are some advantages to the technology, some disadvantages, and some dangers.

While some call it merely a blocking move against Samsung and other competitors, the acquisition by Apple of Authentec increases the potential for an iPad secured by a fingerprint reader.

Such technology has some real advantages, according to security technologist Bruce Schneier. "You want it to be as fast or faster than the four-digit PIN," which is the current default security feature for iOS devices, he said. Fingerprint scanners certainly meet that requirement.

But what about security issues? Can it be faked? Are there privacy dangers? Schneier points out "Remember, what we're trying to replace here is a four-digit PIN." Such a PIN can't be considered a particularly strong security barrier, so the bar is low if all you're looking for is an improvement.

As for privacy, there is a right way and a wrong way to implement a fingerprint system. If all the device does is compare the print to a master stored locally on the device, then Schneier sees no particular privacy problem. Privacy problems do show up when you start storing prints in databases outside of the device.

It's also important to understand what such devices can and can't do. It's not that hard for a determined attacker to spoof a fingerprint that will defeat a reader, as the Mythbusters demonstrated a few years ago:

Phillip Hallam-Baker of Comodo notes that the Secret Service follow the President about breaking every glass he touches just to stop people getting fingerprints from them.

The worst-case scenario for this is where criminals cut off a finger to use it for access. There might be some urban legend around this, but it really has happened, as described in this 2005 BBC report. The companies that make the scanners claim to be able to defeat these attacks in various ways, but this doesn't satisfy Hallem-Baker: "...that is irrelevant unless they convince the bad guys not to try. If attacked, I am not going to be thinking 'oh at least they didn't get my employer's email' as I look at the bleeding stump where my finger used to be."

Like Schneier, Hallem-Baker thinks fingerprint scanners could be a valuable addition to mobile devices if properly implemented and if users have proper expectations of them. But scanners should always just be a second factor, not the only barrier to entry.

He also points out that fingerprints aren't the only technology Authentec works on. The acquisition could be about more.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Commentary
Enterprise Guide to Edge Computing
Cathleen Gagne, Managing Editor, InformationWeek,  10/15/2019
News
Rethinking IT: Tech Investments that Drive Business Growth
Jessica Davis, Senior Editor, Enterprise Apps,  10/3/2019
Slideshows
IT Careers: 12 Job Skills in Demand for 2020
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/1/2019
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
Slideshows
Flash Poll