Posted 9:49 AM (0) comments

Does one finger beat two pins?

This story from India about a bank installing biometric ATMs, purportedly so that senior citizens who have difficulty remembering their PIN could have their fingerprint read instead, got me to thinking.

I have two different ATM accounts with my bank, one business, one personal. I use different PINs for each. I don't know why I use different ones, perhaps it's a belief that if one is compromised I'd still have the other. But suppose my bank offered a biometric ATM? Would I choose to use the same finger for each account or two different ones?

After all, chances are that if one finger is "compromised" my entire hand would be also. And simply remembering which finger works which account could be problematic for this "senior citizen." Still, it's deeply ingrained in me that different accounts need different authenticators. Maybe I'd choose to use a "strengthened" method - fingerprint+PIN. Then I could use the same finger (but a different PIN) for each account. Or different fingers plus the same PIN.

Using different fingers with different PINs is right out, though. No way I could remember those combinations. I'd need to carry around a picture of the correct finger with the right PIN written on it!

And, with all those people, especially all those old people, swiping their fingers on the ATM - wouldn't that be a health hazard?

Labels: authentication, biometrics

Posted 10:11 AM (4) comments

Biometrics: the mark of the beast?

The Wilmington, Carolina Star-News reports that "About a dozen employees of the City of Wilmington have filed religious protests against a new time-keeping system that uses finger measurements to track workers' hours." As one worker wrote:

"As my divine ... right, I request that you, my employer, accommodate my sincerely held religious belief by not requiring me to submit to the use of a thumbprint, DNA or any other biological identification device"

The article quotes David Alan Carmichael (who "successfully sued the Navy after it kicked him out for refusing to use a Social Security number," then established the American Christian Liberty Society) as saying that

the rise of biometrics is causing more people to think twice, especially with Revelation's reference to the hand and forehead suggesting hand and eye scans, he said. Those are stops on a slippery slope to imbedded computer identification chips, the ultimate mark

Wonder what he thinks about SecureID fobs?

Labels: biometrics

Posted 10:44 AM (2) comments

Biometric monkey Business

Kim Cameron has had a couple of posts recently on biometrics and some supposed flaws. There's the "Biometrics Dilemma" and the reversibility of biometric templates. But both of these posts appear to fall victim to the same fallacy, the same one that affected California Secretary of State Debra Bowen when she recently released her findings on electronic voting.

You may remember it in a different guise - the Infinite Monkey Theorem. Given enough time in an unfettered environment the electronic voting machines can be compromised, the biometric data can be reversed and the monkeys can type out the complete works of William Shakespeare. It's probably best illustrated in the theorem that Kim promotes aqs the "Biometric dilemma": "the more we use biometrics the more likely they will be compromised and hence become useless for security." We might even say this is a truism, but still note that the time necessary for the compromise to occur may be longer than the time we have left on earth!

Of course, an infinite number of monkeys with an infinite variety of paints could eventually re-create the Mona Lisa, so Kim might be on to something! :)

Labels: biometrics