Good, Bad And Ugly Of Fingerprint Scanning - InformationWeek
Mobile // Mobile Devices
12:59 PM
Connect Directly

Good, Bad And Ugly Of Fingerprint Scanning

Apple's recent purchase of Authentec points toward the possibility of a fingerprint-secured iPad. There are some advantages to the technology, some disadvantages, and some dangers.

While some call it merely a blocking move against Samsung and other competitors, the acquisition by Apple of Authentec increases the potential for an iPad secured by a fingerprint reader.

Such technology has some real advantages, according to security technologist Bruce Schneier. "You want it to be as fast or faster than the four-digit PIN," which is the current default security feature for iOS devices, he said. Fingerprint scanners certainly meet that requirement.

But what about security issues? Can it be faked? Are there privacy dangers? Schneier points out "Remember, what we're trying to replace here is a four-digit PIN." Such a PIN can't be considered a particularly strong security barrier, so the bar is low if all you're looking for is an improvement.

As for privacy, there is a right way and a wrong way to implement a fingerprint system. If all the device does is compare the print to a master stored locally on the device, then Schneier sees no particular privacy problem. Privacy problems do show up when you start storing prints in databases outside of the device.

It's also important to understand what such devices can and can't do. It's not that hard for a determined attacker to spoof a fingerprint that will defeat a reader, as the Mythbusters demonstrated a few years ago:

Phillip Hallam-Baker of Comodo notes that the Secret Service follow the President about breaking every glass he touches just to stop people getting fingerprints from them.

The worst-case scenario for this is where criminals cut off a finger to use it for access. There might be some urban legend around this, but it really has happened, as described in this 2005 BBC report. The companies that make the scanners claim to be able to defeat these attacks in various ways, but this doesn't satisfy Hallem-Baker: "...that is irrelevant unless they convince the bad guys not to try. If attacked, I am not going to be thinking 'oh at least they didn't get my employer's email' as I look at the bleeding stump where my finger used to be."

Like Schneier, Hallem-Baker thinks fingerprint scanners could be a valuable addition to mobile devices if properly implemented and if users have proper expectations of them. But scanners should always just be a second factor, not the only barrier to entry.

He also points out that fingerprints aren't the only technology Authentec works on. The acquisition could be about more.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for InformationWeek Newsletters
Current Issue
The Next Generation of IT Support
The workforce is changing as businesses become global and technology erodes geographical and physical barriers.IT organizations are critical to enabling this transition and can utilize next-generation tools and strategies to provide world-class support regardless of location, platform or device
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll