3 ms·

Biometrics as an authentication factor suffers from a "weakest-link" problem. The strength of authentication of _every_ system using biometric factors can only

Biometrics as an authentication factor suffers from a "weakest-link" problem. The strength of authentication of _every_ system using biometric factors can only be as strong as the weakest, least secure implementation out of those systems. Passwords suffer from the same "weakest-link" problem to a degree, but at least we can choose to have more than 1 or 2 and even more than 10 different passwords. Also, they can be changed after a leak. In biometric authentication, once your raw biometric data has been leaked, you are basically left to rely on the strength of the PAD (Presentation Attack Detection) and the (lack of) propagation of the leaked information.

bostik 7y ago
I honestly feel that the best we as an industry can do about it is to start referring to biometrics as "amputationware". As often and widely as possible. Until the public perception about them changes, vendors will keep pushing the scheme ever further as a silver bullet.
- Phemist 7y ago
  Haha. I've been playing around with (and written about) the idea of a new set of authentication factor categories. I think part of the public perception problem is the "things you have, know and are" slogan of authentication (factors). It is super catchy, but makes biometrics ("are") way too prominent. It promises you can prove who you are by who you "are". Why the need for the other 2 categories? I'm still on the fence as to the replacement, but I think seperating the factors based on "knowledge" versus "possession", and then further based on high versus low "transferability" is a good start. Smart cards are highly transferable possession factors, whereas biometrics are lowly transferable possession factors. Passwords are highly transferable knowledge factors, whereas things like keystroke dynamics are lowly transferable knowledge factors. The model really just lacks a catchy slogan now.

bostik 7y ago

I honestly feel that the best we as an industry can do about it is to start referring to biometrics as "amputationware". As often and widely as possible. Until the public perception about them changes, vendors will keep pushing the scheme ever further as a silver bullet.

Phemist 7y ago
Haha. I've been playing around with (and written about) the idea of a new set of authentication factor categories. I think part of the public perception problem is the "things you have, know and are" slogan of authentication (factors). It is super catchy, but makes biometrics ("are") way too prominent. It promises you can prove who you are by who you "are". Why the need for the other 2 categories? I'm still on the fence as to the replacement, but I think seperating the factors based on "knowledge" versus "possession", and then further based on high versus low "transferability" is a good start. Smart cards are highly transferable possession factors, whereas biometrics are lowly transferable possession factors. Passwords are highly transferable knowledge factors, whereas things like keystroke dynamics are lowly transferable knowledge factors. The model really just lacks a catchy slogan now.