Biometrics - it’s not the technology that’s broken
By Simon Bisson & Mary Branscombe in Editorial
Posted in Identity, Hardware, Security on
When we landed in Los Angeles this trip, I was relieved and disappointed at the same time. We’d been expecting the new ten-finger sensors instead of the left-index-right-index-photograph dance you currently do, but they weren’t installed yet. I’m keen to see these in action, and I don’t expect to be in Boston, Dulles or Atlanta any time soon (they’ll be in all US airports by the end of the year). The current scanners are optical - rather like a bar code scanner in a supermarket. That’s a little slow and could be fooled by a fake finger (unlikely as the TSA agent would spot it).
Scanning ten fingers is good for security - more chances of a match with fingerprints the FBI has found at crime scenes where you’re as likely to get a thumb print as anything else. And if it’s not going to take five times as long, it must be using an active technology like the AuthenTec scanner in my HP 2710p notebook - and I want to see how well it works in a heavy duty situation.
I like the HP scanner because I don’t have to remember passwords any more, so I can make them longer and harder to break. I wish HP would write a driver to let me use it for scrolling and I can’t wait until the promised update compensates for the way the screen moves a little as I scan my finger so I don’t have to brace it with my other hand any more. This is much more about convenience than security, and I think my fingerprints are safe enough in my PC. I’m less happy about government use of biometrics, because the government has a terrible record on data security and a dubious one on protecting privacy.
Motorola didn’t reassure me after they did a pilot for biometric visas for the UK, Austria, Luxembourg, Portugal and Spain and the UK. “From the pilots we’ve been involved with, it’s clear that the biggest challenge is around working practices,” says Gillian Ormiston, senior solutions consultant for Biometric Identity Management and Security Solutions at Motorola. The biometrics worked fine - but switching from a paper visa process to tapping it all in on computer wasn’t always as smooth, and that’s where security problems - or just mistakes - can happen.
A friend of ours is cabin crew with a major UK airline and that meant he ended up in the pilot for the US visa biometrics some years ago. He and a colleague were scanned, photographed and welcomed to America. Next week he was back at the same airport, but his fingerprints didn’t match; turns out they’d switched the scans for him and his colleague.
It should have been obvious from the photo that our friend was the same person. It was, in fact, but there was no way to easily update the record to deal with the mistake. It took months to sort out and even if the TSA is very polite about secondary interviews, it adds at least an hour of sitting around being checked on before you can get into daylight and start adjusting to the time zone.
Security is a process rather than a state; it’s what you do rather than what you are. But the process of how you get to be secure - as an individual or a country - has to be right too. Just putting biometrics into a system doesn’t make it more secure.
Not yet rated
Loading ...Comment by Jim Kerr - March 13, 2008 on 1:17 pm
Mary - “Just putting biometrics into a system doesn’t make it more secure.” I have to disagree. Biometrics is instant added security. This is because I am passing more complex credentials with a biometric. I am using a 30 character password that I could never remember if I had to type it in myself. But because my fingerprint remembers it for me, I have the added security of a much stronger password. So that is measureably better than an the typical 8 character password that you hope an employe will be able to remember and not have to write down as it changes.
Comment by John Green - March 14, 2008 on 9:10 am
My latest HP laptop also has a fingerprint reader, but it often takes six or seven attempts to log on. With all the possibilities and dangers of badly specified government IT systems (I once worked on oe of the better ones) I would take a lot of convincing that (a) they’ll work and (b) they will be secure. At the moment I am far from convinced, and there is always the risk that data procured for lawful purposes will be transferred to other users (even other governments) and used against the individual. No thanks.
Comment by Simon Bisson & Mary Branscombe - March 16, 2008 on 7:52 am
@Jim
I’m going to disagree back 
It’s the password that adds the security; the biometric adds the convenience. You could get the same security with a smartcard, authentication token or simple memory. But mainly, if the system you log in to is insecure the biometric doesn’t fix that.
@John
I certainly agree that the private use of biometrics is a different kettle of fish to government data collection and I worry a lot about it. If a national fingerprint registry was compromised, how would the government issue me a new finger?
On the repeated attempts. First, clean the scanner regularly; second, stabilise the lid so it shakes less. And third, watch for the promised update.
Make a comment
Tag cloud
Archives
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
Most commented posts
- Java’s SSVAGENT.EXE: training the monkey
5 comments
- Wubi Tuesday
- Not very open, not very social
- The best mobile game ever
- A Big Day In The Enterprise IT World
- Employees are our most valuable asset (snigger)
- Biometrics - it's not the technology that's broken
- More battery life, fewer explosions
- Spam Fighting in Exchange
- IDF: Will SSD mean the end of 5GB free?
Highest Rated Blog Posts
- Nobody knows what Web 2.0 really is (100%)
- Songs of distant satellites (100%)
- Log in and lock in (100%)
- Mommy, why is there a home server in the office? (100%)
- Employees are our most valuable asset (snigger) (100%)
- Locking down IT or blocking creativity (100%)
- Video opera? What would you do with huge bandwidth and millions of pixels? (100%)
- Consumer BlackBerrys are good for business (100%)
- HD Trek (100%)
- Top tips for speeding up Vista (100%)