Reasons not to use fingerprint authentication

[ewx]

This article, about a women demonstrating that biometrics can be faked (although she got caught in the end), reminded me of this one, which ought to be trotted out any time anyone suggests using fingerprints to protect anything even slightly valuable.

(I read that fingerprints don't match between identical twins, so the other obvious objection to the immigration control system using fingerprints might not stand.)

Comments

[fanf]

Isn't it possible (and much cheaper!) to fake fingerprints using a layer of latex or glue?

[ewx.livejournal.com]

Perhaps their immigration officers are already trained to look for that l-)

[armb.livejournal.com]

It's certainly possible to defeat many sensors like that:
http://www.theregister.co.uk/2002/05/16/gummi_bears_defeat_fingerprint_sensors/
http://www.engadget.com/2005/12/11/play-doh-fingers-can-fool-90-of-scanners-sez-clarkson-u/
(And http://www.techdirt.com/articles/20051212/110218.shtml has a comment from someone who did it with latex)

But as ewx said, it might be harder to fool the immigration officers watching.

[fanf]

I was thinking of a layer on top of a real finger, not a whole fake finger :-) The silly putty plus latex method sounds like a plausible way of doing it.

[armb.livejournal.com]

I was assuming that too, but it probably wouldn't be trivial to make such a layer both robust and inconspicuous.

[bellinghman.livejournal.com]

One of the more interestingly prophetic aspects of the film Gattaca is that of attempting to do biometric identification using a blood sample DNA scan. As the fingertip is applied to the sensor, a tiny blood sample is taken from it.

The trick? A false fingertip with not only the fake fingerprint, but with a tiny sac of the real person's blood under it.

(The title GATTACA itself is a reference to an arbitrary DNA sequence.)

[k425.livejournal.com]

(The title GATTACA itself is a reference to an arbitrary DNA sequence.)

And you don't want to know how far through the film I was before I made the connection!

[bellinghman.livejournal.com]

You and probably the majority of the rest of the audience.

(At least, I hope that's the case, otherwise I feel dumb too.)

[ewx.livejournal.com]

It took me a while too l-)

[lnr]

I needed someone else to point it out.

[pm215]

Yes, this Yomiuri article mentions near the bottom somebody using that trick. The other hole in their system is bribable immigration officials...

(You could argue that since Japanese immigration control is more about public demonstration that foreign workers are being kept out than actual security, it doesn't matter that they use a slightly dodgy biometric system :-/)