FaceID, thumbprints, Iris scans… they are all so convenient. Nothing to remember, always present and they work… most of the time. And they must be secure… well aren’t they?
Sad fact. Biometrics are getting hacked. And at an increasing rate. But aren’t biometrics far more secure and harder to hack than passwords or other forms of identity verification?
Yes. For the time being, but the day is coming that they will become a prime target for armies of hackers armed with powerful weapons. All of them zeroing in on huge stores of biometric data held in corporate identity silos. That eventuality is the day we should all be very very concerned about.
Why? Because biometrics are "immutable" (meaning they can’t be changed over time). Once spoofed or stolen, forever stolen.
Let that sink in. Anything you protect with your biometric data WILL be hacked. Not may, but WILL.
Sure, Apple is detecting "liveness" and AI to ensure that 2D or even 3D representations of facial features can’t fake a real person, but that path has nowhere to end but the technological dead-end where a persons unchangeable fingerprint or their face or eventually their DNA is compromised. It is inevitable.
And then starts the long and arduous path of trying to repair your reputation because you put all your identity eggs in the biometric basket.
What will that mean? Just ask the millions of American’s who have had their Social Security Numbers (SSN’s) compromised and have to spend months and sometimes years undoing damage to their credit rating because SSN’s are assigned to be "life long". They are just like biometrics. Immutable.
Personally, I feel that Apples strategy of using biometrics only as a convenient surrogate for usernames and passwords on their devices actually makes a lot of sense:
The biometric data is not centrally stored. Its only present on the device the customers owns and uses.
Biometrics (ie thumbprint or Face ID) are only used as a convenient enabler of the real identity verification data, namely the password.
This strategy means that it will take a lot of effort to harvest biometric data from each and every device… this is a hackers nightmare. This is also a world apart and better than the growing interest in using centralised biometric data linked to users accounts as either an addition to or as a substitute for passwords.
We are living in a world where hackers are only months and sometimes days behind the very latest most powerful security technologies as they are rolled out. Can we afford to go down a path that has no way of allowing us to back out of it?
As a security technology professional of over 29 years, I started my journey by working out how to fingerprint computers. How to turn RAM manufacturers, configurations, hard drive damage and serial numbers as well as network card configurations, into a unique fingerprint that could be used to stop people from sharing software illegally. When I first found out that hard drives had a unique serial number that could not be changed by end users I was tempted to just lock any new software title installation to that drive number… but I knew better. Drives fail, people upgrade. Stuff happens. You cant put all your security eggs in one basket.
I plead to the security community today, don’t make the same mistake with biometrics. They may work today, but tomorrow they become a bigger nightmare than a password ever was.
So what is the alternative?
That is for another article but between new new flavours of quantum resistant public key systems and classic powerhouse algorithms such as Shamier’s secret sharing, well crafted and easily upgradeable identifier systems are definitely doable and have infinite potential when compared to biometrics.
Please don’t let the biometric dead end take hold of our destiny.
For more information about distributed client side key pair systems contact Haventec who pioneered powerful public key authentication in combination with human friendly and easy to remember PINs