Biometric Musings Part 1: Authenticating with public data

The other day, I made the statement that a biometric system, implemented poorly, can actually be worse than a password system.  I promised I would return to it, and so I shall do so now.  Although my thinking is to do so in stages and cover a couple different musings about biometrics over a period of a few weeks.  I should start by saying first off that I’m a huge fan of biometrics; it’s actually (little known fact) why I got into security in the first place. I’m a huge advocate of biometrics… but it’s important that we understand it rationally and logically in order for them to really be successful in the marketplace.  Part of that rational understanding means analyzing the flaws as well as the features.

So the first musing to tee up about biometrics is the general point that they are, strictly speaking, public data.  Meaning, unless you’re analyzing a part of me that I usually keep covered (whew, let’s hope the industry doesn’t go there), you’re analyzing something that’s visible to whomever should care to look.

Some of you might question what significance that has; so what if we are authenticating with public data?  I think, philosophically, it changes the dynamics of the authentication process involved.  In other words, it’s takes the authentication “factor” from “what you are” to “how good is your reader”.

Here’s what I mean by that… We probably all remember the traditional authentication factors, right?  They are “what you have”, “what you know”, and “what you are.”  A password (“what you know”) is the closest to actually being reflected by the language we use to describe the factor.  It is, in fact, “what you know” – or a secret shared between you and the authentication system.

In the “what you have” camp we usually put SecureID… and dongles, and tokens, and smartcards, etc., etc.   But none of this stuff is really “what you have” per se. It’s really “proof of a secret shared with the token” under the hood.  The security of the system relies on the ability of the device to keep that secret.  They all work that way.

Biometrics we classify as “what you are.”  But that’s not really true exactly.  ”What you are” implies some kind of objective truth….  We don’t have that.  More precisely, it’s “measurements of what you appear to be based on a narrow set of criteria that we can read and analyze.”   The biometric authentication process derives security from the fact that it is difficult for someone else to read the same data the same way.  I put my fingerprint everywhere I go; why can’t someone use that to log in?  The truth is, they can… except the reader implements some type of countermeasures to detect if the reading is occurring within “live finger” parameters.

So the barrier is a technological one.  Meaning, the reason (barrier) keeping the bad guys out is how well the system is at making replay and spoofing difficult.  Meaning, it’s a hardware problem under the hood.

Note:  this post was pre-authored and scheduled.  Apologies for any comments that are not immediately moderated.