(Editor's note: In this guest essay, Dave Aitel, CEO of penetration testing firm Immunity Inc., points out two shortcomings with using biometric sensors as a replacement for old-fashioned passwords.)

Weak passwords are often blamed for many security breaches - but one of the biggest mistakes we can make is to replace them with biometrics.

Over the past few years, there's been a lot of discussion from security firms, startups, big technology companies and privacy advocates about the need for technology to move beyond the password.

The most widely suggested replacement for passwords has been biometrics (fingerprints, heartbeats, voice and facial recognition, iris/retinas) - and now that Apple has just introduced a fingerprint scanner on the new iPhone 5S, it's going to add tremendous momentum to this already burgeoning industry.

TOUCH ID: 10 questions on the iPhone's fingerprint sensor

MORE ON NEW IPHONES: Apple tiptoes down market to challenge Android

However, there are two important reasons why biometrics won't work, and why the old-fashioned password is still a better option: a person's biometrics can't be kept secret and they can't be revoked.

It's important to think that through before we rush ahead with mass-market biometrics. People expose their biometrics everywhere - they leave fingerprints behind at bars and restaurants, their faces and eyes are captured in photos and film, etc. There's no real way to conceal this data from the world.

As Deloitte & Touche researchers noted way back in 2006, spoofing a person's biometrics, particularly fingerprints (using lifted prints on gummy bears), is a legitimate threat. However, it's the second problem with biometrics that is the really big one: once a person's biometrics have been compromised, they will always be compromised.

Since a person can't change their fingerprint or whatever biometric is being relied upon, it's 'once owned, forever owned.' That is biometrics' major failing and the one that will be hardest to overcome.

It's also a mistake to think that a biometric protection can't be altogether bypassed, just like any other security measure. A few ways to do this include exploiting vulnerabilities in the hardware or firmware, and cold booting the device itself.

Finally, biometrics are often seen as a military-grade security technology. But in high security environments, biometrics are only a small part of the security puzzle. Part of the reason is that it's silly to only have 10 possible passwords your whole life (20, if you count toes), but the other reason is that fingerprint identification technology is not perfect - on a large enough database you will inevitably get collisions.


In fact, concerns about the statistical probability of false matches have been expressed by the National Academies of Science, National Institute of Standards and Technology, US Department of Justice, International Association for Identification, and more.

Biometrics are better than nothing, but they're not a lot better. They have vulnerabilities, just like any other security measure - but unlike a password, once a biometric is compromised, it is permanent.

Today, if your Twitter account gets hacked, you just change the password - but if you are using a biometric, you will be stuck with that hacked password for the rest of your life. We need to keep that in mind before we start using biometrics to authenticate universal sign-ins and financial transactions.

About the essayist: Dave Aitel, CEO of Immunity Inc., is a former computer scientist for the National Security Agency who specializes in offensive security for Wall Street financial firms, Fortune 500s and manufacturers.

facebook sharetwitter shareemail shareemail share
Read or Share this story: http://usat.ly/1elPjBy