Gates: Forget your passwords

TalkBack 5 of 62:

Next »

« Previous

• Thread View
• Flat View

Biometric Security Hoax

John,

Not necessarily. I work with Biometric readers for our time-and-attendance system. Bio readers do not necessarily capture your fingerprint - what they capture is a template of "interest points" that is unique to the individual. While a fingerprint capture is certainly POSSIBLE it's not required.

What happens is the bio reader generates a mathematical template - I.E. "password" that your finger uniquely produces. On the verification pass, you present your fingerprint again and the reader re-generates the template. The validation part is where the 2nd template is compared to the first. The match must be within certain percentage points - I.E. the template generated the 2nd time must look "substantially" like the one stored.

While the techology to "capture" and "reconstruct" your fingerprint certainly exists, it doesn't have to be used that way. IOW - just because a fingerprint template is stored for you doesn't mean a third-party can just "duplicate you" if they have the template. They would have to have a finger that the reader re-calculates a template just like yours to make it work. The templates are often encrypted data that has no reverse translation. This is called 1 to 1 verification.

Biometric validation isn't really a hoax. Believe it or not, doing validation that way instead of using passwords could greatly simplify some things. Biometric finger scanners installed on PC's (provided they standardized the mechanism of template generation) would be, actually, quite convenient. When you go to a website that you've registered at previously, you would simply present your finger instead of having to remember a password - your unique template would match the one on file at the website and you're in.

There's no more inherent lack of security with stored finger templates than there is with passwords. Just the fact that the templates are much larger data fragments (several hundred bytes) actually DECREASES the possibility that someone could just "hack" your identity.

-CB

Posted by: CodeBubba   Posted on: 11/18/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now