Boura, A. (2015, March 19). Biometrics: The Hazards, and Mitigations, for Effective Use. andy.boura.uk. https://andy.boura.uk/blog/biometrics/
MLA (9th edition)
Boura, Andy. “Biometrics: The Hazards, and Mitigations, for Effective Use.” andy.boura.uk, 19 Mar. 2015, andy.boura.uk/blog/biometrics/.
Chicago (17th edition, bibliography)
Boura, Andy. “Biometrics: The Hazards, and Mitigations, for Effective Use.” andy.boura.uk, March 19, 2015. https://andy.boura.uk/blog/biometrics/.
Harvard
Boura, A. (2015) Biometrics: The Hazards, and Mitigations, for Effective Use. Available at: https://andy.boura.uk/blog/biometrics/.
IEEE
A. Boura, “Biometrics: The Hazards, and Mitigations, for Effective Use,” andy.boura.uk, Mar. 19, 2015. [Online]. Available: https://andy.boura.uk/blog/biometrics/
BibTeX
@misc{boura2015biometrics,
author = {Boura, Andy},
title = {Biometrics: The Hazards, and Mitigations, for Effective Use},
year = {2015},
month = {mar},
howpublished = {\url{https://andy.boura.uk/blog/biometrics/}}
}
As Microsoft announce they will be supporting Intel's biometric authentication in Windows 10 we should take a moment to think about whether this is a good idea. It's hard to argue with the convenience offered by biometrics. There's also little doubt that they are often going to be more secure than a poorly chosen, re-used, or just plain weak (or default) password. However they are no silver-bullet.
If implemented carefully robust to "pass the hash" style attacks (effectively preventing remote exploits).
Weaknesses
Automatically "re-used".
Kind of hard to change. (your fingerprints/iris images have been stolen, please change them)
Fairly easy to copy or spoof - and expect this to get commoditised in the form of a biometrics black market. Think of it as a bit like card "skimmers" that are inserted into cash points and copy your card, only what they are copying is your biometrics. Or lifting fingerprints from physical objects or high resolution photographs. Hacking poorly implemented biometric scanners could also yield this data.
A large scale example of databases of biometric information is the airports in the US capturing all your fingerprints as you enter.
The Solution
We have the answer already - in the form of strong asymmetric encryption with the private key held in a hardware security module. Now simply having access to something physically is not sufficient for many use cases (though we rely on it for securing many of our highest worth assets such as cars and houses). Unlocking the key using a local pin or biometric is not an unreasonable further precaution - and indeed I'd like to unlock my car or house that way! If a biometric is used for this anyone reasonably motivated with physical access is likely to be able to get in – which, though not perfect, is a huge improvement on what we often have today - but must be designed with great care and attention to detail.
So the bio-metric "answer you are looking for" is:
The key is protected in a hardened crypto-hardware module that does not allow the extraction of the key.
Bio-metrics or local pin / passphrase are used locally to unlock a key (implemented in hardware / firmware independent of the OS). A correctly implemented pin / passphrase being the more secure option in the right hands - ideally an option for both, potentially context dependent.
So bio-metrics are a complementary technology at best, and a placebo at worst.
I have a reasonable level of optimism this solution is what Intel / MS will actually deliver.
Cheers Andy
openclipart.orgOpenclipart, a library of free, public-domain clip art made by its users; the source of this article's image.
en.wikipedia.org/wiki/BiometricsBiometrics identify a person by a physical or behavioural trait, such as a fingerprint, face or iris, rather than by something they know or carry.
en.wikipedia.org/wiki/Entropy_(information_theory)In information theory, entropy measures how unpredictable a value is. For a password or key, more entropy means more guesses are needed to find it.
en.wikipedia.org/wiki/Brute-force_attackA brute-force attack tries every possible password or key until one works. Long, unpredictable secrets make it impractical.
en.wikipedia.org/wiki/Pass_the_hashPass the hash is an attack where a stolen password hash is used to sign in directly, without ever cracking the password itself.
en.wikipedia.org/wiki/Skimming_(fraud)Skimming is copying a payment card's details with a hidden device fitted to a cash machine or card reader, so the card can be cloned or misused.
en.wikipedia.org/wiki/Public-key_cryptographyPublic-key (asymmetric) cryptography uses a pair of keys: a public key anyone can use to encrypt or verify, and a private key, kept secret, to decrypt or sign.
en.wikipedia.org/wiki/Hardware_security_moduleA hardware security module (HSM) is a tamper-resistant device that generates, stores and uses cryptographic keys, so the keys never leave it.
en.wikipedia.org/wiki/Windows_HelloMicrosoft's sign-in for Windows using a face, fingerprint or PIN. The credential is a key kept on the device, which the biometric or PIN unlocks locally.
en.wikipedia.org/wiki/Trusted_Platform_ModuleA Trusted Platform Module (TPM) is a security chip built into a computer. It stores keys so they can't be copied off the device, and checks that the machine starts up untampered.
en.wikipedia.org/wiki/Passkey_(authentication)A passkey replaces a password with a pair of cryptographic keys. The private key stays on your device and is unlocked by a fingerprint, face or PIN, so there is nothing to phish or reuse.
Thanks for reading. For more on cyber security, technology and leadership, subscribe to the mailing list, follow me on LinkedIn or subscribe to this blog's RSS feed.
By Andy Boura