Free Newsletters

   All InfoWorld Newsletters
Tech Watch | InfoWorld Staff » Thumbs down for biometric security

March 27, 2006 | Comments: (0)

Thumbs down for biometric security

Authenticating users to computer systems via biometric technologies may be the rage with some, but it certainly does not have unanimous backing.

Author and enterprise systems consultant Ted Neward, serving on a panel at TheServerSide Java Symposium in Las Vegas on Saturday afternoon, pointed out that even biometric systems are not foolproof.

Neward said if someone steals his password, he can always get a new password. The same type of functionality is not offered with biometric systems, he pointed out.

"What if somebody gets the digitized representation of my thumb? Do I go out and get a new thumb?" he asked.

USB key-based security is preferable, Neward said.

Also during the session, panelists noted that security is not a glamorous subject for developers.

"Security is bloody boring," said Jeremiah Grossman, founder and CTO of WhiteHat Security.

"Security is just the most boring thing. What happens when something's secure? Nothing," Jeremiah said.

Neward also questioned Microsoft's Passport security system, saying it would have user information stored with the most attacked company in the world. But he applauded Microsoft's focus on security in the development process.

"They've mandated that their developers go through security training," and the company enforces security reviews, Neward said. Open source projects do not have these same requirements, he said.

Panelists also discussed the current phishing issue. As more history and consciousness grows around phishing, these schemes will lose their effect, Neward said.

Panelist Justen Stepka, an author and technologist affiliated with Authentisoft, said the issue of security must be addressed at three levels: the network, code and the social level. All three pieces together comprise a proper solution, he said.

Posted by Paul Krill on March 27, 2006 09:50 AM


RATE THIS ARTICLE:





 

  •  
  • COMMENTS




What is your take on authentication? With all the online banking security frenzy and the laws mandated by Federal regulators now requiring banks to strengthen security for Internet customers-- do you think the market is too crowded? I don't want to stop banking online, but I also want some sort of guarantee that my funds will be safe, without the fear of having to sacrifice a thumb.

Posted by: Linsey Krauss at March 27, 2006 10:37 AM

Biometrics are not ADA compliant.

Posted by: Victor at March 27, 2006 05:19 PM

Having had my ATM card fraudulently reproduced once and used in Israel (where I've never been), I'm a little bit sceptical of online banking. But I don't actually do any banking online.

On the other hand, I've done my taxes and used my credit cards online for years with no problems. So it's a mixed bag for me.

Posted by: Paul Krill at March 28, 2006 09:56 AM

Biometric devices do not only use thumbs to authenticate a user. There's also retinel scanners and voice recognition. But then again, that might just mean you'll lose your tongue and eyes. There's no foolproof security method, since technology only takes it so far, so another alternatice would be to use multi-factor security.

Posted by: Antonio Victor at March 28, 2006 09:58 AM

The whole point of security is to slow the person down not give them the whole farm and say "well I'm just going to put a massive door here you can't get trough.' There is always a way in the system and if that massive (bimetric) door breaks down you're in large trouble.
We are not invulnerable unless we live forever. Think of a castle and how it usually has a multi-teered outer wall system. It slows down the attackers enough so they can be dealt with but never stops them completely alone. That's your job through hiding the password etc. So it's a time factor in order to have more time then the intruder to stop him form coming in. You have the advantage because of the sytem he's trying to attack. Like with open source there are usually more walls put up I think. Otherwise you're just marked for death. There attacking your person instead of just a code wtc. Real creepy. Say someone needs to hack a system for some emergency reason across national lines. Who is going to kill that person for the info or completley steal that person's identity.
This is just silly as the movie 'Minority Report' already warned about this. Why do we make films like this for our own personal enjoyment or to help us too? People should heed more warnings from famous books and films.

Posted by: Mark at March 29, 2006 09:52 AM

There is a technology, Light Emitting Sensor, that is now available by our company Integrated Biometrics, that will not work unless the fingerprint is presented by a living human being with a pulse. It does not require a password, it is a USB connected device and can be an enterprise level solution. The spoof that happened in National Treasure will not work on our physical and logical product. www.integratedbiometrics.com See for yourself.

Posted by: Charles at March 29, 2006 04:23 PM

Biometrics may not be perfect. Does anyone really think passwords are?

I've done enough security work to know all too well the limitations of password based security. Yet 99% of all authentication systems are based on an account/password challenge.

Let's give biometrics a chance. The security world badly needs some new tools and implementations in this area.

Posted by: Brian Harder at March 30, 2006 09:45 AM

Technology White Papers

 

InfoWorld Technology Marketplace

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert

Find out when the latest white paper is available:
 
 
» BUY A LINK NOW

Sponsored Technology Links