4 ms·

As someone who actively researches biometric authentication, when I hear/read someone saying that biometrics are "usernames" and not "passwords", I automaticall

As someone who actively researches biometric authentication, when I hear/read someone saying that biometrics are "usernames" and not "passwords", I automatically think they fundamentally misunderstand what a biometric is. A biometric is both a 'username' and a 'password' - for instance, when you access your computer/device/whatnot you type in your username and your password to identify to the system that you are requesting access (on mobile the account is implied). When using a biometric, the system will have a stored template (similar to a password) that it associates to the system user account, and in ideal situations you (the user) do not need to do anything other than be present to access the system resources. It's a difference between identification and verification. Do you go to your friends each time they ask you something and say "are you so and so?", or have you already identified who they are? Based on the video it seems that MS is starting to understand this difference. Check out the video at ~2:35. He sits down at the login screen, and it just opens the desktop. For consumer applications this is really the goal of any biometric system. Now spoofing and biometric template data being stolen are still real problems. Unfortunately, spoofing is not a very hot topic in the biometric field (usually conferences only have a relatively small percentage of papers on the subject), but given more consumer applications I'm hoping more funding will start to head that way. Concerning biometric template data, no you can't change it in it's most raw format, your fingerprint is static..that's what so great about it. However, there are methods such as key-binding where the template is itself encrypted with a private key. This however leads to more passwords... In any case, it's unfortunately up to companies like MS to start paving the way to successful implementations - if the data breaches we hear about almost monthly (Uber, Target, etc) are any indication, your password is just as at risk as your fingerprint.

hurin 12y ago
> if the data breaches we hear about almost monthly (Uber, Target, etc) are any indication, your password is just as at risk as your fingerprint. Two things - let's assume these companies follow best practices and both the fingerprints, biometric details and passwords are all hashed. Still: a) Unlike a password your biometric data is publicly obtainable. b) You cannot change your biometric data after it's been compromised. > As someone who actively researches biometric authentication, If you are an expert in the field - I think you are doing people an active disservice by telling them the security is just as good. Finally I think typing passwords just isn't that hard - everyone is used to it by now. I maybe odd in this - but its hard for me to see the greater degree of convenience as a huge breakthrough (even without the security implications).
- therobot24 12y ago
  > security is just as good Read the post, i never discuss the security or merit of a biometric versus a standard user/pass login. I only discuss the advantages/disadvantages and goals of each system. If you inferred a recommendation for one or the other then you misunderstood. > Finally I think typing passwords just isn't that hard - everyone is used to it by now. I maybe odd in this I completely agree. However, when you see people go to their 'secret drawer' and open up their password book to login to X, then you realize it's a fundamentally broken system (just as using a raw biometric is).
mejari 12y ago
"A biometric is both a 'username' and a 'password' " This is true, but usually people don't go around showing their passwords to any camera they walk by or surface they touch. That is why people say that it is more appropriate for biometrics to identify someone than it is to provide their authentication. "our password is just as at risk as your fingerprint." Also true, but what do you do when these breaches happen if the data is biometric? You can't send out an e-mail asking people to change their fingerprints or face. With existing password infrastructures after a breach the infrastructure can be upgraded to prevent that breach, then the users can be told to change their passwords, then that vulnerability is closed. Once a person's biometric data is stolen (or just taken from the hundreds of sources of our biometric data we leave around daily in the form of pictures and fingerprints) that's it, you can't close whatever breach they used to get in and then move on, because the user can't change their "password" to one that has not been compromised. That account is forever breached. Biometrics violate several of the requirements for something that can be used as authentication, which is why they are great as identifiers, but terrible as authenticators.
- therobot24 12y ago
  > usually people don't go around showing their passwords to any camera they walk by or surface they touch. That is why people say that it is more appropriate for biometrics to identify someone than it is to provide their authentication. Yea i see the point, but there will always need to be an asterisk after the statement, "a biometric is a username, not a password", because it's only valid in the sense there are concerns about the security of the biometric template. Down the line maybe we'll figure out this spoofing/liveness test thing, but we won't find out while many instantly write off the merit of the system to begin with. > what do you do when these breaches happen if the data is biometric? You can't send out an e-mail asking people to change their fingerprints or face. I did mention this somewhat in the original post. Saving a raw biometric template (minutiae points or whatnot) is synonymous to keeping a database of plain text passwords. It's just wrong. The data breaches (Uber, Target, etc.) are proof that in 2015, we still have this problem. I would never trust a start-up or large corporation with consumer grade biometric authentication. However, on my laptop a different story...i've been using the Thinkpad fingerprint reader for years and love it.
dsugarman 12y ago
there are 2 main reasons why you wouldn't want this as a password, 1: you leave a biometric footprint everywhere you go, 2: once compromised, you can't reset your biometric profile. In situations where you would want it to automatically authenticate you, it's likely for a system you wouldn't have had password protected in the first place ex. your xbox.
- therobot24 12y ago
  > 1: you leave a biometric footprint everywhere you go, Latent fingerprints, high resolution video, facebook profiles...all examples of how i can pick up someone's biometric. This is not an unknown problem. > 2: once compromised, you can't reset your biometric profile. Clearly. Just based on the definition you can draw that conclusion - a unique, unchanging trait that is used to separate the user from a group. Common and justified criticisms that people think are just the 'silver bullet' of why a biometric should never be implemented. I've posted replies to these a few times. Feel free to check them out. Either way, the difference between a corporate login system, and me logging into my laptop is huge. MS implementing a biometric for a consumer laptop is fitting given the current state of the field. Use it or don't, no one is forcing you.

hurin 12y ago

> if the data breaches we hear about almost monthly (Uber, Target, etc) are any indication, your password is just as at risk as your fingerprint. Two things - let's assume these companies follow best practices and both the fingerprints, biometric details and passwords are all hashed. Still: a) Unlike a password your biometric data is publicly obtainable. b) You cannot change your biometric data after it's been compromised. > As someone who actively researches biometric authentication, If you are an expert in the field - I think you are doing people an active disservice by telling them the security is just as good. Finally I think typing passwords just isn't that hard - everyone is used to it by now. I maybe odd in this - but its hard for me to see the greater degree of convenience as a huge breakthrough (even without the security implications).

therobot24 12y ago
> security is just as good Read the post, i never discuss the security or merit of a biometric versus a standard user/pass login. I only discuss the advantages/disadvantages and goals of each system. If you inferred a recommendation for one or the other then you misunderstood. > Finally I think typing passwords just isn't that hard - everyone is used to it by now. I maybe odd in this I completely agree. However, when you see people go to their 'secret drawer' and open up their password book to login to X, then you realize it's a fundamentally broken system (just as using a raw biometric is).

mejari 12y ago

"A biometric is both a 'username' and a 'password' " This is true, but usually people don't go around showing their passwords to any camera they walk by or surface they touch. That is why people say that it is more appropriate for biometrics to identify someone than it is to provide their authentication. "our password is just as at risk as your fingerprint." Also true, but what do you do when these breaches happen if the data is biometric? You can't send out an e-mail asking people to change their fingerprints or face. With existing password infrastructures after a breach the infrastructure can be upgraded to prevent that breach, then the users can be told to change their passwords, then that vulnerability is closed. Once a person's biometric data is stolen (or just taken from the hundreds of sources of our biometric data we leave around daily in the form of pictures and fingerprints) that's it, you can't close whatever breach they used to get in and then move on, because the user can't change their "password" to one that has not been compromised. That account is forever breached. Biometrics violate several of the requirements for something that can be used as authentication, which is why they are great as identifiers, but terrible as authenticators.

therobot24 12y ago
> usually people don't go around showing their passwords to any camera they walk by or surface they touch. That is why people say that it is more appropriate for biometrics to identify someone than it is to provide their authentication. Yea i see the point, but there will always need to be an asterisk after the statement, "a biometric is a username, not a password", because it's only valid in the sense there are concerns about the security of the biometric template. Down the line maybe we'll figure out this spoofing/liveness test thing, but we won't find out while many instantly write off the merit of the system to begin with. > what do you do when these breaches happen if the data is biometric? You can't send out an e-mail asking people to change their fingerprints or face. I did mention this somewhat in the original post. Saving a raw biometric template (minutiae points or whatnot) is synonymous to keeping a database of plain text passwords. It's just wrong. The data breaches (Uber, Target, etc.) are proof that in 2015, we still have this problem. I would never trust a start-up or large corporation with consumer grade biometric authentication. However, on my laptop a different story...i've been using the Thinkpad fingerprint reader for years and love it.

dsugarman 12y ago

there are 2 main reasons why you wouldn't want this as a password, 1: you leave a biometric footprint everywhere you go, 2: once compromised, you can't reset your biometric profile. In situations where you would want it to automatically authenticate you, it's likely for a system you wouldn't have had password protected in the first place ex. your xbox.

therobot24 12y ago
> 1: you leave a biometric footprint everywhere you go, Latent fingerprints, high resolution video, facebook profiles...all examples of how i can pick up someone's biometric. This is not an unknown problem. > 2: once compromised, you can't reset your biometric profile. Clearly. Just based on the definition you can draw that conclusion - a unique, unchanging trait that is used to separate the user from a group. Common and justified criticisms that people think are just the 'silver bullet' of why a biometric should never be implemented. I've posted replies to these a few times. Feel free to check them out. Either way, the difference between a corporate login system, and me logging into my laptop is huge. MS implementing a biometric for a consumer laptop is fitting given the current state of the field. Use it or don't, no one is forcing you.