On 2005-06-07, Tim Hobbs <
[email protected]> wrote:
> I believe fingerprint readers have already been cracked, although
> whether this is all technologies or one specific system I couldn't
> say.
It's a mix. Some capacitive readers (solid state ones on things like
laptops and USB keys) can be fooled just by breathing on them, others
need more work, e.g. photographic etching of a fingerprint into a fake
finger (all doable with stuff from stores like Maplin). Some have
their tolerances so low to ensure that they "work" and don't keep
rejecting people that they are easily fooled. It depends on the
individual device and the market it's aimed at.
Iris recognition is one of the best cheap technologies, fingerprint
technology isn't very good as a machine doesn't do as good a job as a
trained human at recognising a damaged or greasy print. Manual
workers or people who've just had lunch often cause problems for
fingerprint readers.
Also there's a difference between whether a reader is used to
authenticate someone or identify someone, i.e. enter a username and
verify using a fingerprint (authenticate mode), or put your
fingerprint on a scanner without a username and it identifies you and
logs you in (identify mode). Using a typical fingerprint scanner's
error rate, I calculated that with a database of 1,000 users a scanner
working in identify mode would log you into the wrong account 10% of
the time. With 10,000 users you'd be lucky to get the right account!
> As we become more and more dependent on biometrics the prize for
> fakers gets higher and the criminals will put more and more effort
> into cracking it.
The best thing about faking biometrics is that the fake will usually
work over a wide range of devices. If your iris or fingerprint is
faked, how do you change it? It's not like changing a password.
--
For every expert, there is an equal but opposite expert