finger print?

I have seen too many movies in which the bad guys cut off someone's hand, or other body part to use them for biometrics through security.

I can understand using biometrics inside a facility, like at a bank to identify who is cashing a check, whencombined with security camera mug shot, or inside a work place where your voice activates the computer, except when you have a cold & sore throat & it does not recognize you as you.

But if some gadget on my home computer claims that it is really me, then a hacker can spoof the signal & also claim to be me, having copied the signal that is me.

My understanding is that the technology runs around $100.00 for this thing you stick your finger in beside your PC. I personally prefer the little camera beside the PC that has the dual purpose of teleconferencing & security checking, except when I am at home in the nude ... I don't bother to get decent unless I expect guests or need to leave home.

Some of the cheaper devices in use today have actually been spoofed simply by shinning a flashlight on them. It seems that the authorized user leaves his fingerprint on the scanning surface (from body oils), and it will actually read the fingerprintas the finger.

You shouldn't have to worry about this, or the feared "finger cutter" too much though. The better devices employ a biofeedback feature, which requires that the finger have things like a pulse or skin galvanic response.

A time ago, people thought that Passwords was a good way to protect their critical data. Today we know that this is not enough

Nothing is perfect, principally in the Computer World. I know, like many many other people, that Fingerprints (and other devices) can have holes. And I know that many people will work to find and exploit this holes.

I don't think that it should replace the password. I think it should be used in combination with the password. In combination that would at least give you two layers of authentication. There is always a way around security devices no matter how goodthey are. Someone with way too much time on their hands will find that way sooner or later.

As a computer security designer, there are three types of person intent upon accessing your machine and/or data

1: the opportunist or casual thief / interloper

A simple password or even a sceeensaver will probably deter this sort - they have only passing interest in your information and equipment and have no real intent in using it for ill gotten gains - ecenpt for those able ot steal your laptop or PC.

2: The Clued-Up Crook

These have a greater level of skill, courage or determination to access your equipment and will circumvent Windows passwords but will have an equally more specific reason to access your PC. More reason = More effort

3: The Organised Thief - Geek

These are quite prepared to go to complex and risky methods to access your PC and their intentions are absolutely clear- they are tooled up to do a lot of harm.

Unfortunately, most security devices and software is designed to deter categories 1, some category 2 and very few category 3.

A rule of thumb would be to assses

Fingerprints are probably about as good as passwords, with the one benefit that it is tough to choose a bad one. On the other hand, the readers can be expensive, and the cheaper ones are subject to the attacks mentioned in other responses. If you do decide to go with fingerprints (and I'm not recommending them - look into smart cards for a more flexible solution that has as good or better security at about the same price), don't replace passwords with them, use them as a second authenticationfactor.

Always go with the principle of "Something you own (smart card, plug-in key, fingerprint, retinal scan etc) and something you know (password, PIN number etc)
These in combination should give a good measure of security. But don't forget the Physical security Locked Office doors, Photo ID badges Tie down cables to the desk etc. It is no good having the best security and losing the PC....But if you do...Did you encrypt the sensitive infrmation on the Hard Disk???

Mike.

The problem will any sort of biometric authentication is that it cannot be changed. Should a fingerprint be compromised - how depends on the implementation - non-repudiation could become a nightmare for the real owner. Biometrics need to be supported with supplementary controls as per other answers. Before implementing biometrics you need to answer the risk management question - what value is a biometric adding to the process?

This question was auto closed due to inactivity