Biometric ID Fairy: A Misguided Response to the Equifax Mess that Will Only Enrich Cybersecurity Grifters and Strengthen the Surveillance State

This is Naked Capitalism fundraising week. 597 donors have already invested in our efforts to combat corruption and predatory conduct, particularly in the financial realm. Please join us and participate via our donation page, which shows how to give via check, credit card, debit card, or PayPal. Read about why we’re doing this fundraiser, what we’ve accomplished in the last year and our current goal, supporting the comments section.

By Jerri-Lynn Scofield, who has worked as a securities lawyer and a derivatives trader. She now spends much of her time in Asia and is currently working on a book about textile artisans.

Former Equifax CEO Richard Smith is halfway through four days of testimony before various Congressional committees– and he is “deeply sorry” about the data breach that compromised the identities of more than 140 million Americans, as CNN reports.

The magnitude of the leak, the company’s cack-handed response, and the massive publicity that’s ensued has convinced the serious people that SOMETHING must be done.

Now, we might think that this might lead our Congress critters to a sober and sane assessment of cybersecurity defects, or the consequences of centralizing information collection without due care and oversight (whether it’s collected by a company, or a government agency).

Alternatively, dare we hope that the hack might spur a full rethink of the current regulatory realm– in which our personal financial data are available, 24/7, more or less for the asking, so that financial firms can grift us, safeguarded by firms such as Equifax who cannot be bothered to install a basic software patch to protect said data from being compromised.

(And, I might mention in passing, such personal financial data are often linked to other confidential personal data: e.g. medical records, purchasing history.)

Some members of Congress, such as Janet Schakowsky have proposed a radical break from the current system: shifting credit reporting from a universal system over which a consumer has no control, to one where you could opt out or even, have to opt in for companies to use your data.

Depending on how extensive the responses are, such a change would essentially trash the business models of the three major credit reporting agencies, by preventing them from selling your data without your consent. As Bloomberg reports in These Five Data-Security Ideas Emerged in the Equifax Hearing:

Schakowsky also said she’d like lawmakers to start a broader discussion about the role of credit-reporting firms. Consumers don’t have the ability to remove their information from Equifax’s databases because it’s furnished by banks and telecommunications companies. “Most Americans really don’t know how much information” the companies have, Schakowsky said. “I don’t want you to have my information anymore. I want to be in control of my information.”

Seems sensible, yes?

Which is why the serious people have to mount a full court press to make sure that something so sensible doesn’t get implemented.

Let no Crisis Go to Waste: Opportunity for Grifting

Rahm Emanuel once famously said, “You never want a serious crisis to go to waste. And what I mean by that is an opportunity to do things you think you could not do before.”

Their response to the Equifax hack: replacing Social Security numbers with a system that might include a universal biometric identity system, plus further numeric verification, as Bloomberg reports in The White House and Equifax Agree: Social Security Numbers Should Go.

Big mistake. Although I admit, it would create ample opportunities for grifting.

First, Do No Harm: Biosecurity Fairy Delusion

One of the reasons put forward for replacing Social Security numbers is that these cannot be changed. So, once a data base is hacked– and a number is compromised– you’re still stuck with that number, and must cope with the consequences. As per Bloomberg, in The White House and Equifax Agree: Social Security Numbers Should Go:

The failure of the Social Security number is that there’s only one for each person, “once it’s compromised one time, you’re done,” Bob Stasio, a fellow at the Truman National Security Project and former chief of operations at the National Security Agency’s Cyber Operations Center.

Well, why’s that? These numbers are  a man-made construct. They’re neither god given, tattooed into our foreheads, or embedded within us at birth– or at least not yet.

If problem is that once compromised the numbers cannot be changed, let’s change that. Rather than create an entirely new system, assuming that the form of the identifier solves the problem.

Stick with me as I lay out the alternative and point out the obvious– your biometric data: your DNA, your eyeball, your fingerprints. Now, that really cannot be changed. If those data are the means by which you’re known to a database and those are hacked or compromised, what would be your recourse? You can’t replace your eyes, or your fingers, or acquire completely different DNA.

Using a biometric system when the basic problem of securing and safeguarding data have yet to be solved will only worsen, not address, the hacking problem.

What we’re being asked to do is to turn over our biometric information, and then trust those to whom we do so to safeguard that data.

Given the current status of database security, corporate and governmental accountability, etc.: How do you think that is going to play out?

Especially as, Bloomberg quotes one of the principal advocates for change, Rob Joyce, special assistant to the president and White House cybersecurity coordinator, on what really concerns him:

“It’s really clear, there needs to be a change, but we’ll have to look at the details of what’s being proposed,” Joyce said. In the response to the Equifax hack, though, he said, “we need to be careful of Balkanizing the regulations. It’s really hard on companies today” facing local, state and federal regulators as well as international rules, he added.

Imagine that! In the face of this widespread data breach, what exercises Joyce is the regulatory burden companies must confront in securing your data. Is this for real?

Mangling Identification and Authentication 

One basic problem is a confusion between the use of the identifier– whether it be a number, or biometric– for identification and authentication. Merely switching to a biometric system doesn’t address this, because if the database gets hacked, now the hackers have your biometric information too! Whereas currently, they only had access to numeric data.

Permit me to quote at length from an email from our own Naked Capitalism Richard Smith on this issue, as he understands these issues far better than I do. I do want to point out the spectacular opportunity for confusion in that our Richard shares a name with the former Equifax CEO.

So I want to underline that all quotations that follow are from the Naked Capitalism Richard Smith:

If one swaps an old number for a new:

the old compromised identifier is just as good for identifying a person as the new post hack one. The new number is redundant. Neither the old number nor the new number can authenticate and that is the nub of the issue.

In principle there are lots of ways to identify yourself to a computer system. but they all have to satisfy a uniqueness requirement. I assume the Social Security number does this in the US. Elsewhere one can do it by providing name address and date of birth. Admittedly this relies on there not being twins, triplets quads etc all with the same name and cohabiting, but AFAIK, so far so good.

So one way or another one has one’s unique identifier. All good. Uses can say who they are, and not get mixed up with someone else by the blind machine. But they still can’t prove that they are who they say they are. What a Social Security number or name/address/date of birth combo does not and cannot do, is prove that the person presenting the identification details is who he claims to be. Anyone can make up a name and address and even without data leaks or hacks, a genuine Social Security number can be fabricated. So it doesn’t matter if the Social Security number you produce is the original one or its post-hack replacement. Neither is trustworthy.

It’s particularly easy to fabricate ID if there’s no flesh and blood human in the loop. Since eliminating flesh and blood humans from the process is the whole name of the computing game, authentication is a big unsolved problem. Without authentication, there can be no trust. Without trust, the whole human social enterprise takes a fatal hit (see unauthenticated Twitterbots for a recently pervasive and obvious example). This is why people are saying ‘we need a whole new system’. They’re right, but until we build hackproof systems, it ain’t gonna happen. There now follows a shorter version of the previous sentence. It ain’t gonna happen.

Jerri-Lynn here: The basic problem with what the grifters propose to do is take your biometric information and use that to replace the Social Security number. But, does that really solve the authentication problem? And, if it does not, we end up in a worse situation than if we were to make the Social Security number system more robust and changeable (although admittedly, it would still not be perfec)t. Because biometrics, once  hacked, cannot be changed.

Permit me to turn to Naked Capitalism’s Richard Smith again:

Biometrics illustrates the difficulty a different way. A biometric (fingerprint, retina scan or DNA sample) is also a unique identifier, but, (ignoring data breaches for a moment) it does two things at once:

  1. It uniquely identifies you

  2. It proves that you are who you say you are. An SSN or name/address/DoB cannot do this, not even in principle.

I should point out that even without data breaches, there are other ways to compromise biometric information– difficult, but doable, if the stakes are high enough. Steal a finger (or a fingerprint, for that matter), steal an eyeball, or supply someone else’s DNA swab to the unattended DNA scanner. The stuff of many gruesome scenes in recent action movies.

To be sure, not likely to be employed frequently, but the sort of thing that might come into play if the stakes are high enough.

But, here’s the key point, and I turn to Naked Capitalism’s Richard Smith again:

Unfortunately, as soon as you stop ‘ignoring data breaches for a moment’, and get real, this whole biometric idea dies miserably too. So it’s all a big waste of time until Internet-connected systems can be made verifiably hackerproof. And that is a ridiculously remote prospect.

Meaning that biometrics boils down to just a BS “solution”, which doesn’t solve the basic problem. In fact, one of the options discussed in the Bloomberg article would be to use biometrics and then provide you a super duper card with a fancy-sounding PIN:

Joseph Lorenzo Hall, chief technologist at the Center for Democracy and Technology in Washington, said one possibility could be giving individuals a private key, essentially a long cryptographic number that’s embedded in a “physical token” that then requires users to verify that the number belongs to them. It could work like the chip in a credit card that requires the owner to enter a pin allowing use. He pointed to Estonia where they have deployed such cards that people use to validate their identity.

“Your pin unlocks your ability to use that big number,” he said. The challenge is how to create the identifiers and how to distribute the keys. “It’s very promising” and “it’s possible to technically design something like this” but it could be expensive to design and disseminate such material to each American, he said. “This is a pretty big endeavor.”

So someone holds you up, gets your new, improved, super duper identity card, and makes you give them your PIN. Or hacks the database with the biometric ID and gets the info loaded onto your super duper card. Now they have your biometric info from a system that provides no greater security than if a more sophisticated Social Security number system were created, -reinforced by the same cryptographic PIN.

But the logical problems here aren’t the point.

Replacing Social Security numbers with a new biometric system would provide spectacular opportunities for grift.

And, as regular readers know, that’s almost certainly not a bug, but a feature.

Centralization Draws Hackers

It should be apparent that part of the problem is that the centralization of so much valuable information is what draws hackers. And the more we centralize, the more precious the prize will be. I’m not by any means conversant on the ins and outs of cybersecurity.

But as a starting point, maybe should rethink the whole impulse to centralize such data collection, for starters.

And, after such a thought experiment, then further focus on obvious measures to safeguard such information– such as installing regular software patches that  have prevented the Equifax hack– should be the priority.

And, how about bringing back a concept in rather short supply in C-suites– that of accountability? Perhaps measures to increase that might be a better idea than gee whiz misdirected techno-wizardry.

Panopticon

Do we really want to move to a world where all personal data are collected, and can be surveilled? I know, we’re far further along that path than most of us as willing to admit. But at the moment, in the United States, biometric data haven’t been fully integrated into the mess. Shouldn’t we figure out better ways to secure databases before we consider shovelling even more information into them?

Aadhar is No Model

Let me close by discussing obvious and well-reported problems with a system that relies heavily on biometric identification– so we can see some of the practical problems that have emerged with this seeming panacea.

India has rolled out the Aadhar identity system, a unique 12 digit identification number, which also incorporates biometric data. One of the experts quoted by Bloomberg, Bruce Schneier, a fellow at Harvard’s Kennedy School of Government, mentioned this as a possible model:

He pointed to India’s wide-scale rollout of the Aadhaar card, a unique number provided to citizens after collecting their biometric information — fingerprints and an iris scan — along with demographic details, to almost 1.2 billion people. In the U.S., a more secure system could be designed, “but magic math costs money,” he said.

Not a great idea.

I’ll only discuss three points here. First, the move to make the Aadhar number a universal identifier means that when it is compromised (as has already occurred and I discuss further below), that kicks off considerable potential knock-on effects for the person whose identity has been hacked.

Just one example: SIM cards are more tightly controlled in India than many other places– in part due to concerns about terrorism– and the process for applying for a SIM is highly bureaucratic. A recent Indian court decision mandated mobile users link their mobile accounts to their Aadhar number. The more functions are loaded onto the Aadhar, the more things might need to change in the light of a potential data hack. So, say your Aadhar number is hacked– that means you may need to change your mobile too. Big bummer.

It also means that people who are not Indian citizens but spend considerable time in the country–  resident foreigners, various categories of Indians who visit India but reside outside of the country– find it considerably more difficult to get access to services that require Aadhar identification.

Second, Aadhar information has already been hacked.  Just a couple of examples to illustrate this is not just some imaginary scenario. As reported by the Economic Times in Reliance Jio data leak: Tech gets smarter but your safety gets dumber in July, “a website called ‘magicapk’ leaked details such as email addresses, names and Aadhar ID details (in some cases) of Reliance Jio smartphone users”.

And, another: a graduate of one prestigious Indian Institute of Technology (IIT) committed more serious and sustained hack, stealing Aadhar data to verify the identities of people who used his app. As reported in The Indian Express, in IIT Kharagpur graduate hacked Aadhaar data through Digital India app: Police, in August:

an IIT Kharagpur graduate who has been accused of hacking into the central identities data repository of the Unique Identification Development Authority of India’s (UIDAI) Aadhaar project gained access to the repository through the Digital India e-hospital initiative of the Ministry of Electronics and Information Technology, police investigation has revealed. Bengaluru Police on Thursday formally announced the arrest of Abhinav Srivastava — a 31-year-old hailing from Uttar Pradesh — in connection with a complaint of unauthorised access of the central identities data repository filed by the UIDAI on July 26.

The complaint to the police stated said that Srivastava had accessed UIDAI data without authorisation between January 1 and July 26 for an app called ‘eKYC Verification’. The app delivered demographic data like name, address, phone number of individuals from the central identities data depository of Aadhaar to authenticate unique identity numbers. It was placed on Google Play Store with the claim that it was developed by an entity called myGov linked to the start-up Qarth Technologies, which had been acquired by the taxi hailing service Ola in 2016.

And a final, particularly controversial Aadhar issue:  Wikileaks last month released material related to Expresslane malware— suggesting that the CIA had hacked the Aadhar database (see, for example, CIA SPIES INDIA’S BIOMETRIC AADHAAR DATABASE IN REAL TIME in myhacker.net or  Aadhaar security: WikiLeaks hints at CIA access to India’s national ID card database in DNA).

Now, to be fair, I should acknowledge that the in response to this Wikileaks claim–  “In another tweet, they published an article that says “Aadhaar in the hand of spies”” DNA reported:

However, the official sources in India have denied any such claims, say media reports.

Earlier, defending its decision to make Aadhaar a necessary document for availing benefits of government schemes, the Union Law Minister Ravi Shankar Prasad informed the Supreme Court that the government has formed a high-level committee for Aadhaar data protection. However, the Supreme Court refused to pass any interim order against the Central government notification for making Aadhaar mandatory. The Supreme Court was hearing a petition that said making Aadhaar compulsory would violate the right to privacy of an individual.

I do wish to point out that concerns that security of the Aadhar database was compromised from the get go have long dogged the program, as reported in The Sunday Guardian.com, Foreign agencies can access Aadhar data:

The biometric and demographic data collected for Aadhar may be extremely vulnerable to access by foreign intelligence services, defence services and multinationals interested in the commercial use of the data.

The three private entities contracted by the Unique Identification Authority of India (UIDAI) for biometric solutions for Aadhar, have strong ties with the US and the French intelligence or defence establishments.

There are myriad other problems with the Aadhar system– which alas, I lack space to discuss here. I do want to emphasize that Aadhar is so riddled with problems that I think it’s a very poor model the US to  follow.

Bottom Line

The Equifax hack has revealed the sad and sorry state of cybersecurity. But inviting the biometric ID fairy drop by and replace the existing Social Security number is not the solution.

It would only mean turning over your biometric information, as another source of data to be mined by corporations, and surveilled by those who want to do so. And it would ultimately not foil identity theft.

Let me close with a further snippet reported by Bloomberg on what the real target is here:

Joyce’s comments helped take some of the focus off Equifax’s blunders, analysts at Cowen Inc. said in a note Tuesday.

The “White House may be indirectly coming to Equifax’s rescue,” they wrote. “This reduces the risk of business-model-busting legislation such as a requirement that consumers opt-in to a credit bureau collecting their data.”

This research report thinks this sleight of hand is unintended. I don’t think so.

Print Friendly
Tweet about this on TwitterDigg thisShare on Reddit0Share on StumbleUpon0Share on Facebook0Share on LinkedIn16Share on Google+0Buffer this pageEmail this to someone

30 comments

    1. Lambert Strether

      Here is a paper from Jeremy Grant, Managing Director, The Chertoff Group, “Secure Biometric Authentication: A Fundamental Building Block for Achieving Trusted Cloud Services” (PDF):

      The emergence of reliable, easy to use, consumer-grade biometric technologies
      has fueled significant innovation in the security and usability of authentication
      solutions, making it easier for organizations to comply with requirements for
      authentication. Ten years ago, biometrics required expensive, specialized, standalone
      hardware, and its deployment was largely limited to high security facilities.
      Today, however, most devices ship with cameras and finger sensors that can be
      used to complement, or in some cases even replace, passwords with fingerprint
      or face recognition.

      * * *

      On unhackable systems:

      Program testing can be used to show the presence of bugs, but never to show their absence!

      –Edgers Dijkstra (1970) “Notes On Structured Programming” (EWD249), Section 3 (“On The Reliability of Mechanisms”), corollary at the end.

      Shorter: Na ga happen.

      Reply
  1. River

    All the tech in world won’t help if you leave the username/password as Admin/Admin. That’s just baby town frolics!

    Reply
  2. polecat

    “Hey, John Anderton !” .. “You could sure use a back alley pair of seeing eye apertures about now !”

    Reply
  3. Watt4Bob

    The basic trouble with our country, in the most basic sense possible, is that every problem is another opportunity for someone’s brother-in-law, uncle, or friend to cash in.

    It’s a ubiquitous, and never-ending grift and making believe that it’s not, is the only immutable rule in Washington D.C.

    There is no issue so important, so absolutely vital that it can’t be entrusted to some well-connected numbskull sure to irretrievably f*ck it up, and over charge for the damage.

    Every project is sure to be executed on a cost-plus basis because if it weren’t, the vendor (relative/buddy) tapped for the job could not afford to almost learn how to do the work by endless, costly, trial and error/failures.

    The corruption of our government has at last become so complete that there is no longer any chance of an honest appraisal of our options going forward, on any front.

    The crooks have driven all honest players off the field, and what we’re left with is this hopeless mess that resembles nothing so much as a hog wallow that extends at least, from Washington to New York.

    For over thirty years following WWII, the MIC at least delivered planes that flew, ships that sailed and missiles that hit their intended targets.

    For the last four decades it’s been against the rules to ask where the money went, or when the ‘products’ are due to be delivered, let alone “will they work”.

    Watch the video, the CEO of Equifax was genuinely surprised to be grilled on the stupendous failures he is responsible for, and that is because, in the whole of his ‘professional’ experience, it has been forbidden to hold people of his ‘elite’ stature accountable for anything.

    So it comes as no surprise to me, that the end result of all the chatter surrounding the Equifax hack should be a storm of opportunism that enriches some well-connected snake, and incidentally, vastly super-charges the surveillance state, and encroaches on our collective right to privacy.

    Oh, and did I mention that all the money we’re spending has done nothing to keep the Chinese or the Russians, or just about anybody who cares to look really, from rifling any system on the planet that is ‘protected’ by the security organizations employed by the US government, and paid for by the American tax-payer?

    Remember, the Chinese stole the complete
    plans for ‘our’ F35 fighter jet, and built their own.

    And guess what, theirs will not only be delivered on time, it will likely work.

    It seems that we, as a nation have decided that there is nothing more admirable that to make money, and how that money is made is of little concern.

    We’ve been convinced of this by a relatively small group of folks who care for nothing except making money, and a lot of the things they don’t care about are vitally important to you and I.

    Reply
    1. JTMcPhee

      A couple of responses: The MIC turned out any number of turkeys that would not fly or float, even during the 30 years following WW II. See the Navy’s “Cutlass” and “Panther” and ships that go “crack in the night” and so much more. A quick voyage through “military fails” as a category in youtube gives lots of examples.

      And I’d suggest expanding your list of crooks dipping into the MMT’s endless flood to include the Israelites, who also “rifle” every system and secret that the Empire supposedly holds dear: http://mondoweiss.net/2012/07/cia-considers-israel-the-largest-counterintelligence-threat-in-the-middle-east/

      And you speak of a “right to privacy.” I will say it again: “Rights,” in the sense of personal “rights” of individual flesh and blood citizens, simply do not exist, unless there is a mechanism to enforce them. And there are no such mechanisms in this country, or in most of the rest of the world. It’s futile to talk about “fixing” that, because all the vectors and momentum and power and money are aimed at looting and domination.

      But of course I agree generally with your observations, and second all the points you make. And I agree that there is no fixing it, because individual and corporate (both “guvment” as in “agency” and “Pentagram”, and post-national fictional entities like Lockheed “We know who we are working for” Martin and the rest) “interests” are, as you say, all and simply “about” filching wealth from the rest of us. “It’s too big.” https://www.youtube.com/watch?v=Dw2fZOyjcAg

      Reply
      1. BoycottAmazon

        !nemA. No unflappable, unbreakable mechanism to defend any rule.

        The “founding fathers” fooled their children with talk of inalienable ( “God(s) given) “rights””, but since as those deist/atheist knew, there is no god/gods, or at least not one who cares, therefore there are no rights.

        Everything gained or lost is expanded or contracted privilege.

        Reply
    2. JGW

      Forgot the OMB hack of every contractor personal info who applied for clearances. I was in that one. Surely no hacker are interested in those targets, right?

      Reply
  4. chris

    Seems like a simple issue. If something valuable is getting stolen, fix the security around the thing rather than swap it for an equally valuable thing.

    Reply
  5. JP

    You may not necessarily have to provide an eyeball, merely a picture of an eyeball, perhaps taken from another (hacked) eyeball scanner might do just fine.

    Reply
    1. Lambert Strether

      Mirror, mirror on the wall….

      Random thought: Has anybody proposed “A Day Without Cellphones?”

      (I’m picturing literally billions of people simultaneously looking into these tiny, relfective slabs of glass… One can only achieve connection with others through being utterly self-absorbed.)

      Reply
  6. Tom C.

    Eye scanners, on every device, world wide. They’d have cut-out yer eye to get your stuff.

    (Was this a movie…)

    Reply
    1. Lambert Strether

      And that would never happen! (Unless of course our world is a terrible dystopia with a percentage of operators who will do anything for money. Like, for example, purchasing “clean” body parts, if you’re rich enough….)

      Reply
    2. River

      I know it was done in Demolition Man. Tom Cruise had his eyes replaced in Minority Report to avoid all the scanners.

      Reply
  7. EoH

    As you say, biometric data can be compromised. With increasingly powerful computers and software, that will become easier to do.

    It uniquely identifies you and cannot be changed. That is the problem. I would be loathe to give it to MS or Apple, let alone allow it to be used without restriction by a “credit rating agency” whose customers are lenders, not the owner of the data.

    A bigger problem is that this looks like is a distraction from Equifax’s gross negligence. Essentially, its entire database was hacked, is in the wild, and portions of it might be useful to criminals for a generation.

    Yet Equifax apparently faces no cost for its gross negligence, other than to pay its bill to the professional apology industry. It might even increase its business because of it. Is that what Bill Black would describe as criminogenic? More basically, what is it we teach our children about facing the natural and logical consequences of their mistakes? Capitalism, like politics, seems to have dispensed with such crude notions of accountability.

    The US lacks, by design, a data protection regime remotely similar to Europe’s, which mandates, among other things, that a data processor maintain adequate physical and virtual security protections over data, mandates retention, time and use limits, mandates disclosure, and has teeth and a process for using them when data processors fail to live up to their commitments.

    Reply
  8. Fred1

    The issue of the protection of one’s identity reminds me of the story of Rumpelstiltskin and the seven Horcruxes in the Harry Potter stories.

    Reply
  9. JBird4049

    Just about anyone reading my post would face probable prison time and certainly destitution from all the lawsuits and fines. That includes the vast majority of Americans, but somehow it’s not a problem to solved, it’s an opportunity for legal grift for the very people who caused it and all their friends.

    Sometimes I worry about the rants I post, and then I see more of this…

    Reply
  10. Tooearly

    I believe the record will show that on the day of the hack or shortly there after I posted on this forum the idea that this would be an excuse to require such measures.one can always be sure that no excuse to enact more surveillance and fascist economic theft wull be overlooked

    Reply
  11. Disturbed Voter

    Privacy and security, only for the Elite. They need it, and only they can afford it. Part of that security includes an armed bodyguard. Monetizing everything, means everything becomes unaffordable except for the Elite. This pattern is no accident, it is all part of the plantation.

    As a system admin, I can admit that mistakes do happen. This wasn’t a big problem, until everything was hooked together. It isn’t just centralization of databases. At one time, you had to be physically present to get at data. If you want privacy and security, disconnect. Don’t use the technology. If you want to keep cash and coin in circulation, don’t use credit/debit cards or these horrible smart phone debit apps.

    Reply
  12. QuarterBack

    I have been working in information technology and security for over 30 years, and would like to point out that in biometric identification and authentication, it is not the physical biologic feature that is used, but more precisely, it is the digital representation of the feature. This is important because it is not necessary to have access to the feature (say a fingerprint) if the digital representation is available. The sensor doesn’t even have to be available to be “tricked” in the fist place if it possible to just pass the digits that a sensor would pass for a given feature. The ramifications are that if someone steals this digital sequence , it ends up being a password token that can be reproduced and distributed at will, but can’t be replaced.

    Further, for sensors to be used on large scale, they must be relatively simple and inexpensive, which tends to have them be less precise, therefore a certain acceptable statistical margin of error is necessary to make the technology practical. This also makes it easier to algorithmically guess or reconstruct by someone with partial data (particularly multiple partial samples), or someone looking to counterfeit by adding simulated noise or variability that would still effect a positive match.

    Bio markers are good for reducing time in processes by leveraging identification, but they have significant shortfalls for the job of authentication.

    Reply
  13. Jeff N

    When I was in college in the early 1990s, our social security numbers were our student ID numbers. We would write our SSN on every piece of paper we turned in (assignments, papers, tests, quizzes). When/how did SSN’s become weaponized?

    Reply
  14. Eureka Springs

    Ask yourself if you would feel better with biometric voting machines?

    I would feel the same as I did last Nov when I refused to vote at all in no small part because of voting machines being the only option.

    Reply

Leave a Reply

  • Keep it constructive and courteous
  • Criticize ideas, not people
  • Flag bad behavior
  • Follow the rules

Please read our Comments Policies here.

Your email address will not be published. Required fields are marked *