What you can do with your finger

I was reading an article just the other day about attacks on the Microsoft Fingerprint Reader, that contained the important reminder that this isn't a security device, it's a convenience device; that it should not be used as credentials for logging on to a corporate system.

I've maintained on several occasions that a fingerprint is a claim of identity, and falls far short of being a proof of identity.  It also has the interesting property that you can't revoke it and issue a new one if it has been exploited, making it of limited use as a credential.

So, what can you do with a fingerprint?

Well, there are some identity-related uses I can think of.

Suppose you are in a busy hospital, with a number of terminals spread around the place.  Accessing these terminals for private information should require strong credentials.  But what about public information?

Does, say, a nurse occasionally need to verify the usual dosage for Tylenol?  Would a doctor find it convenient to search for phone numbers of specialists whose work he has previously approved of?  I'd say that's likely - and each person will have their own favoured subset of public information, and starting point(s) for looking at it.

For such public information, of course, it would be great to walk up to a terminal, press your finger against the print reader, and have your chosen view on that information be rapidly displayed.

What other uses can you think of, where a false match would not reveal sensitive or private information, or provide privileged access to systems, but where a relatively good rate of true matches makes a system easier and quicker to use?

Published Sat, Mar 11 2006 20:56 by Alun Jones

Comments

# Biometrics fail to authenticate, once again

Steve Riley points to Mythbusters' successful attempts to breach biometric security - okay, so it's not

Thursday, October 05, 2006 7:58 PM by Tales from the Crypto

Leave a Comment

(required) 
(required) 
(optional)
(required)