5 ms·

Falsehoods programmers believe about Biometrics

90 points by edent 6y ago

thih9 6y ago
I like how the article provides examples, that's what I was always missing in the original articles; fortunately there are versions with examples now, e.g.: https://shinesolutions.com/2018/01/08/falsehoods-programmers-believe-about-names-with-examples/ https://shinesolutions.com/2018/01/08/falsehoods-programmers... . I wish there were more points though; at the moment there are only five, while the linked "Falsehoods Programmers Believe About Names" had more than 30.
- Igelau 6y ago
  I saw that as a feature of the originals. Without examples, we had to think about them and discuss them to understand why some of them were false, as well as practice being open about our own ignorance.
amelius 6y ago
I think most programmers are aware of these. It's lawmakers who need a refresher.
- corty 6y ago
  Yes! But the refresher for lawmakers should be much longer, and e.g. include the typical error rates and what they mean.
cjnicholls 6y ago
This is a more extensive list of falsehoods i usually use. https://github.com/kdeldycke/awesome-falsehood https://github.com/kdeldycke/awesome-falsehood
- kdeldycke 6y ago
  Just added that article to the collection: https://github.com/kdeldycke/awesome-falsehood/commit/eadea6eea8e123e2e479f301f057889f579a705c https://github.com/kdeldycke/awesome-falsehood/commit/eadea6...
geoah 6y ago
The article for me is missing the rationale behind those claims. I am not sure programmers believe those things. I would expect each of these claims to have at least one story/link backing them up. I'm not sure any programmer claims that biometrics are the "perfect security measure", and if they did it would be nice to have a source.
ulucs 6y ago
How probable is it that my fingerprint matches with someone else's, given that there is some acceptable variance allowing my fingerprints to work every time?
- PragmaticPulp 6y ago
  Depends entirely on the implementation, of course, but modern implementations have extremely low probabilities of false matches. These are tested by running the algorithm against large databases of fingerprints and looking for false matches between any two different fingerprints. Note that this scenario is vastly worse than any real-world scenario, as you can’t simply have a million different people try to unlock a device. The practical question is to consider the probability of a specific random person being able to unlock your phone, which is orders of magnitude lower probability than considering if any person can unlock your phone. Any secure fingerprint system would also have exponential back off for excessive tries, further limiting the practicality of a random attacker matching.
  - dariusj18 6y ago
    Reminds me of when I was a kid. We left the grocery store, unlocked the car with a keyless remote and got in. My dad put the key in the ignition and couldn't turn the car on. He was confused, I was confused, I had felt a general sense of wrongness. Looked around and noticed, this wasn't our car. Same Make, Model, Year and Color and the keyless also matched, though the interior color was different. Our car was two cars further down the aisle. The chances of that happening are so very slim, but also not.
    - Brian-Puccio 6y ago
      Same with a mid-90s Audi with my grandmother picking up someone from the airport. Took us a minute to figure out we weren’t in her car because both were immaculate inside. Though it was a while ago so I’m thinking they both just shared the same physical key to unlock the doors and start the engine.
    - hansvm 6y ago
xoa 6y ago
Pretty meh piece. This isn't so much "falsehoods programmers believe about Biometrics" as it is "strawmen and tired memes 'techies' toss around about Biometrics". And sure enough at the end, the idiotic "biometrics are usernames" thing comes out. No, they're not usernames, nor are they passwords. They're measurements, any measurements, of our bodies. Hence bioMETRICS. They can be fingerprints sure (one of the oldest ones), but they can also be anything from faces and retina to the musculature of your ass or skeletal structure, your gait as you walk or patterns in how you type. Biometrics are a rapidly advancing but still fairly primitive field, but anything about someone's body that reasonably reliable bits of entropy can be extracted from can be part of an overall biometric pattern. Like ALL security, they are part of an economic equation as well as arms race in terms of how much time/resources attackers must expend vs how much users must expend and the value of attack. They're not silver bullets, but neither is anything else by definition. They can absolutely be an extremely useful part of a secure system for multiple reasons. Amongst them, two big ones are usability and threat model match. First, security systems are designed for and must be usable by some set of human beings at a practical level. The amount of time/resources the defenders need to expend has to be feasible and proportional. If that isn't the case then you simply end up with people working around it, the classic passwords-on-sticky-notes or add-one-each-required-rotation or whatever issues. Telling everyone they have to memorize 256 bits of entropy and then rotate it every 6 months and then having that fail to happen isn't a failure of the users, it's a failure of the security system because it's a shitty fucking system. Biometrics, properly done (like anything else), offer a significant number of bits that require a different attacker model to copy at high ease of use to the majority of users. The ratios alone make it worthy of consideration. Second, they flat out are better against certain common threat models. Like this bit at the end: If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism. If you think a state actor is after you, well you're probably fucked. But that aside "just universally use passwords" is WORSE advice. We now live in an era of near perpetual over the shoulder high resolution video surveillance in many public spaces, ever cheaper drones that can offer the same anywhere outdoors, and extremely hard to detect cameras that can be quickly installed indoors. We have good enough storage and AI analysis to handle a lot of simple stuff, as China is putting into practice. From a fundamental ML standpoint, "a human entering a pin/passcode on their phone, tablet or computer" is a VERY regular pattern. The boxes or screens for entry, the result of entry (typically a bunch of dots), the patterns of input, all are highly regular in general. In turn, I'd be genuinely surprised if state actors aren't already at least testing universal wide scale automated password harvesting. Someone enters a password in view of a surveillance camera, and it automatically records their key entry in real time and matches it to their face. In contrast, good biometrics require some level of individual targeting and resource expenditure (this is a shifting target sure, but so is everything else in security). I'd certainly never depend on biometrics everywhere, but everything in sec is about layers and matching tools to threats. I do try to use biometrics and HSMs whenever I'm out in public, along with long master passwords that I enter in more physically secure areas. It's irritating to see them get dismissed so blithely by people who should know better, rather then recognizing they're a work in progress along with other authentication. And as far as state actors or even other lesser physical individualized threats go, frankly normal people just don't have the tools right now at all unfortunately. Dealing with attacks like that requires higher level composite tools like coercion codes or automated location/use/code based device views, all transparently implemented across major classes of devices and backed up and down the stack. Biometrics have a big role to play in that too, but they're just primitives along with other authentication factors for use in more complex applications.
VLM 6y ago
One missed in the list is the seller / marketer always hyperinflates the equivalent bits strength of a biometric under the most ideal conditions etc. In real world practice the equivalent number of bits of something like a real world iris scanner is NOT even close to the number of megapixels in the camera LOL. Another problem alluded to was filth. The fingerprint scanner at a former employer was filthy beyond all recognition after housekeeping destroyed the first one trying to clean it (side issue, why are all biometric sensors so incredibly non-robust compared to a RFID scanner or human guard?). Anyway the thick gross layer of human grease on the fingerprint scanner made people grossed out during flu season so they would capacitive couple getting close to but not touching the sensor and relying on the last person to touch the filthy thing to have left enough fingerprint to work. It worked pretty well. The concept of a non-contact fingerprint scanner in the last century is pretty funny. I wonder if it still works. A more general filth problem is in the covid era I would not want to share eyeball juice with everyone going thru a retina scanner.
est31 6y ago
Just a few weeks ago the German government introduced the requirement to upload fingerprints to national ID cards... Quite sad.
- dane-pgp 6y ago
  "Germany to require fingerprints and biometric images for ... passports and national IDs" https://www.biometricupdate.com/202011/germany-to-require-fingerprints-and-biometric-images-for-government-ids https://www.biometricupdate.com/202011/germany-to-require-fi...
Igelau 6y ago
> a family with a genetic mutation which means they have no fingerprints I had to give ink fingerprints a few years back and the ah, Print Taker Person expressed some concern that my prints were on the border of not being visible enough (I have a heck of a time with the fingerprint doodad on my Mac). When I was recounting the incident to my grandmother, she said the same thing happened to her mother when they immigrated. It's not that I have no fingerprints, but they are very faint and partial.
IshKebab 6y ago
> Biometrics are, at best, usernames. He probably needs to add this to the list of falsehoods because a lot of programmers (including the author) believe this falsehood. Biometrics are different to usernames. If you are under the impression that they are equivalent please include a copy of your fingerprint in your reply, to go with your username! Repeat after me: Biometrics are not passwords. Biometrics are not usernames.
deleted 6y ago
[deleted]
wtmt 6y ago
I thought this would be a great list to share, but found it quite short and wanting in certain respects. I don't know what class of programmers this list is intended for, but I believe that anything about biometrics should start with the statement that biometrics capture and verification are all about probabilities and thresholds for false positives/false negatives. They're not deterministic. This list doesn't comprehensively cover the falsehood that biometrics are considered by many systems to be static throughout one's life. Biometrics change with working conditions, age, health conditions, weather and environmental factors, due to accidents, surgeries, etc. The "Biometrics can’t be changed" section could do with more information.
mojuba 6y ago
Pro musicians have a big problem with their fingerprints. The scanners often have trouble picking up e.g. a pro pianist's or a guitar player's fingerprints, or even when they do, they'll fail to identify it days or weeks later.

90 points by edent 6y ago

I like how the article provides examples, that's what I was always missing in the original articles; fortunately there are versions with examples now, e.g.: https://shinesolutions.com/2018/01/08/falsehoods-programmers-believe-about-names-with-examples/ https://shinesolutions.com/2018/01/08/falsehoods-programmers... . I wish there were more points though; at the moment there are only five, while the linked "Falsehoods Programmers Believe About Names" had more than 30.

Igelau 6y ago
I saw that as a feature of the originals. Without examples, we had to think about them and discuss them to understand why some of them were false, as well as practice being open about our own ignorance.

amelius 6y ago

I think most programmers are aware of these. It's lawmakers who need a refresher.

corty 6y ago
Yes! But the refresher for lawmakers should be much longer, and e.g. include the typical error rates and what they mean.

cjnicholls 6y ago

This is a more extensive list of falsehoods i usually use. https://github.com/kdeldycke/awesome-falsehood https://github.com/kdeldycke/awesome-falsehood

kdeldycke 6y ago
Just added that article to the collection: https://github.com/kdeldycke/awesome-falsehood/commit/eadea6eea8e123e2e479f301f057889f579a705c https://github.com/kdeldycke/awesome-falsehood/commit/eadea6...

geoah 6y ago

The article for me is missing the rationale behind those claims. I am not sure programmers believe those things. I would expect each of these claims to have at least one story/link backing them up. I'm not sure any programmer claims that biometrics are the "perfect security measure", and if they did it would be nice to have a source.

ulucs 6y ago

How probable is it that my fingerprint matches with someone else's, given that there is some acceptable variance allowing my fingerprints to work every time?

PragmaticPulp 6y ago
Depends entirely on the implementation, of course, but modern implementations have extremely low probabilities of false matches. These are tested by running the algorithm against large databases of fingerprints and looking for false matches between any two different fingerprints. Note that this scenario is vastly worse than any real-world scenario, as you can’t simply have a million different people try to unlock a device. The practical question is to consider the probability of a specific random person being able to unlock your phone, which is orders of magnitude lower probability than considering if any person can unlock your phone. Any secure fingerprint system would also have exponential back off for excessive tries, further limiting the practicality of a random attacker matching.
- dariusj18 6y ago
  Reminds me of when I was a kid. We left the grocery store, unlocked the car with a keyless remote and got in. My dad put the key in the ignition and couldn't turn the car on. He was confused, I was confused, I had felt a general sense of wrongness. Looked around and noticed, this wasn't our car. Same Make, Model, Year and Color and the keyless also matched, though the interior color was different. Our car was two cars further down the aisle. The chances of that happening are so very slim, but also not.
  - Brian-Puccio 6y ago
    Same with a mid-90s Audi with my grandmother picking up someone from the airport. Took us a minute to figure out we weren’t in her car because both were immaculate inside. Though it was a while ago so I’m thinking they both just shared the same physical key to unlock the doors and start the engine.
  - hansvm 6y ago

xoa 6y ago

Pretty meh piece. This isn't so much "falsehoods programmers believe about Biometrics" as it is "strawmen and tired memes 'techies' toss around about Biometrics". And sure enough at the end, the idiotic "biometrics are usernames" thing comes out. No, they're not usernames, nor are they passwords. They're measurements, any measurements, of our bodies. Hence bioMETRICS. They can be fingerprints sure (one of the oldest ones), but they can also be anything from faces and retina to the musculature of your ass or skeletal structure, your gait as you walk or patterns in how you type. Biometrics are a rapidly advancing but still fairly primitive field, but anything about someone's body that reasonably reliable bits of entropy can be extracted from can be part of an overall biometric pattern. Like ALL security, they are part of an economic equation as well as arms race in terms of how much time/resources attackers must expend vs how much users must expend and the value of attack. They're not silver bullets, but neither is anything else by definition. They can absolutely be an extremely useful part of a secure system for multiple reasons. Amongst them, two big ones are usability and threat model match. First, security systems are designed for and must be usable by some set of human beings at a practical level. The amount of time/resources the defenders need to expend has to be feasible and proportional. If that isn't the case then you simply end up with people working around it, the classic passwords-on-sticky-notes or add-one-each-required-rotation or whatever issues. Telling everyone they have to memorize 256 bits of entropy and then rotate it every 6 months and then having that fail to happen isn't a failure of the users, it's a failure of the security system because it's a shitty fucking system. Biometrics, properly done (like anything else), offer a significant number of bits that require a different attacker model to copy at high ease of use to the majority of users. The ratios alone make it worthy of consideration. Second, they flat out are better against certain common threat models. Like this bit at the end: If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism. If you think a state actor is after you, well you're probably fucked. But that aside "just universally use passwords" is WORSE advice. We now live in an era of near perpetual over the shoulder high resolution video surveillance in many public spaces, ever cheaper drones that can offer the same anywhere outdoors, and extremely hard to detect cameras that can be quickly installed indoors. We have good enough storage and AI analysis to handle a lot of simple stuff, as China is putting into practice. From a fundamental ML standpoint, "a human entering a pin/passcode on their phone, tablet or computer" is a VERY regular pattern. The boxes or screens for entry, the result of entry (typically a bunch of dots), the patterns of input, all are highly regular in general. In turn, I'd be genuinely surprised if state actors aren't already at least testing universal wide scale automated password harvesting. Someone enters a password in view of a surveillance camera, and it automatically records their key entry in real time and matches it to their face. In contrast, good biometrics require some level of individual targeting and resource expenditure (this is a shifting target sure, but so is everything else in security). I'd certainly never depend on biometrics everywhere, but everything in sec is about layers and matching tools to threats. I do try to use biometrics and HSMs whenever I'm out in public, along with long master passwords that I enter in more physically secure areas. It's irritating to see them get dismissed so blithely by people who should know better, rather then recognizing they're a work in progress along with other authentication. And as far as state actors or even other lesser physical individualized threats go, frankly normal people just don't have the tools right now at all unfortunately. Dealing with attacks like that requires higher level composite tools like coercion codes or automated location/use/code based device views, all transparently implemented across major classes of devices and backed up and down the stack. Biometrics have a big role to play in that too, but they're just primitives along with other authentication factors for use in more complex applications.

VLM 6y ago

One missed in the list is the seller / marketer always hyperinflates the equivalent bits strength of a biometric under the most ideal conditions etc. In real world practice the equivalent number of bits of something like a real world iris scanner is NOT even close to the number of megapixels in the camera LOL. Another problem alluded to was filth. The fingerprint scanner at a former employer was filthy beyond all recognition after housekeeping destroyed the first one trying to clean it (side issue, why are all biometric sensors so incredibly non-robust compared to a RFID scanner or human guard?). Anyway the thick gross layer of human grease on the fingerprint scanner made people grossed out during flu season so they would capacitive couple getting close to but not touching the sensor and relying on the last person to touch the filthy thing to have left enough fingerprint to work. It worked pretty well. The concept of a non-contact fingerprint scanner in the last century is pretty funny. I wonder if it still works. A more general filth problem is in the covid era I would not want to share eyeball juice with everyone going thru a retina scanner.

est31 6y ago

Just a few weeks ago the German government introduced the requirement to upload fingerprints to national ID cards... Quite sad.

dane-pgp 6y ago
"Germany to require fingerprints and biometric images for ... passports and national IDs" https://www.biometricupdate.com/202011/germany-to-require-fingerprints-and-biometric-images-for-government-ids https://www.biometricupdate.com/202011/germany-to-require-fi...

Igelau 6y ago

> a family with a genetic mutation which means they have no fingerprints I had to give ink fingerprints a few years back and the ah, Print Taker Person expressed some concern that my prints were on the border of not being visible enough (I have a heck of a time with the fingerprint doodad on my Mac). When I was recounting the incident to my grandmother, she said the same thing happened to her mother when they immigrated. It's not that I have no fingerprints, but they are very faint and partial.

IshKebab 6y ago

> Biometrics are, at best, usernames. He probably needs to add this to the list of falsehoods because a lot of programmers (including the author) believe this falsehood. Biometrics are different to usernames. If you are under the impression that they are equivalent please include a copy of your fingerprint in your reply, to go with your username! Repeat after me: Biometrics are not passwords. Biometrics are not usernames.

deleted 6y ago

[deleted]

wtmt 6y ago

I thought this would be a great list to share, but found it quite short and wanting in certain respects. I don't know what class of programmers this list is intended for, but I believe that anything about biometrics should start with the statement that biometrics capture and verification are all about probabilities and thresholds for false positives/false negatives. They're not deterministic. This list doesn't comprehensively cover the falsehood that biometrics are considered by many systems to be static throughout one's life. Biometrics change with working conditions, age, health conditions, weather and environmental factors, due to accidents, surgeries, etc. The "Biometrics can’t be changed" section could do with more information.

mojuba 6y ago

Pro musicians have a big problem with their fingerprints. The scanners often have trouble picking up e.g. a pro pianist's or a guitar player's fingerprints, or even when they do, they'll fail to identify it days or weeks later.