Slashdot Mirror

Thing is it's already been tried on a phone. And as most people recognized, this is just tech from the laptop fingerprint scanner company that Apple bought, then unceremoniously dropped support for all the laptop manufacturers who had originally bought the tech from Authentec.

That's not to say Apple won't figure out a way to make this tech "easier" or more useful. But this isn't an open-ended problem like user interfaces - all you can really do with this is slide a finger across it. The best use I could think of for it was an idea that's already been done on laptops - scroll the display without blocking the display with your finger, by sliding your finger along the scanner.

I have no idea what type of fingerprint scanner is used in the Dell and Sony laptops but the more sophisticated scanners read fingerprint below the surface layers; so copying latent prints usually doesn't work. For example: http://www.authentec.com/technology.html

I have no connection with these guys. YMMV etc etc.

Most of the comments (and the article) are ignoring the current state of the art and future directions in finger biometrics (notice I didn't say fingerprint).

Until recent developments with biometric spoofing, biometric sensor companies were not focused on preventing spoof attacks, gummy fingers, and other forms of compromise. But now they are. The current generation of fingerprint sensors just being deployed now are much more difficult to spoof. The next generation will be close to impossible to fool because they are collecting and matching finger data below the surface of the skin.

This means that latex/gummy fingers can be detected, dead fingers can be detected, and people with difficult fingerprints (none fingerprints or individuals with low pitch fingerprints) can be uniquely identified.

Sub-dermal structures are not "left around" and 3 dimensional structures will be extremely challenging for even an advanced attacker to duplicate. At that point attackers will find other less challenging weaknesses in the security structure.

I continue to believe that the most useful application of biometrics is in unlocking a cryptographic credential in a USB device (or smart card) format. Two-factor, security, and convienience in one device.

Some references. Unfortunately many biometric sensor vendors are not willing to tout their anti-spoofing technologies for fear of being attacked.

Authentec's True Print technology
http://www.authentec.com/technology.cfm

Lumidigm's multispectral imaging (MSI)
http://www.lumidigm.com/antispoof.html

Or, they get their information by bashing Microsoft.

Microsoft about a year ago released a rebadged optical fingerprint reader from Digital Persona. It is a horrible device that can easily be fooled. It also wears out quickly because the sensor relies on a coating on the glass to image fingerprints. Once the coating rubs off, the sensor is useless. Needless to say, this isn't anywhere near the state of the art.

A better technology is based on capacitive sensors. They work much better and are extremely difficult to fool. I.e., Play-Doh doesn't work. Gummi Bears do not work. However, the sensors tend to wear out and can be fooled by cadaver fingers.

Look at sensors from Authentec. That is http://www.authentec.com/. They make sensors that use RF reflection to measure the patterns beneath the first layer of skin. They also have integrated thermal sensing. Cadaver fingers do not work. Neither does Play-Doh or anything else. Fooling these sensors, which are far better than the junk referred to in the original article, is extremely difficult. So, just how much does this military-spec technology cost? $32, quantity one retail.

Can we please send a copy of this to Ms. Schuckers so she can write papers based on the current state of the art, rather than utterly outmoded Microsoft-distributed optical scanners? Please?

Is this gummi bear (or any other method) effective against the sensors from Authentec? http://www.authentec.com/

These devices use low power RF to probe the saline at the dead/live skin interface instead of the surface seen by capacitive and optical print scanners. I've found that these RF sensors are substantial more immune to problems with dry prints, and worn prints (where the dead surface skin has no discernable patterns at all).

And what about sensors that check for a pulse? Presumably those would be immune to gummi bears or removed digits, unless you took efforts to reanimate them.

While all the points you mentioned are valid concerns, especially False Acceptance Rate (FAR) & False Rejection Rate (FRR), there is technology that overcomes most of these limitations.

Have a look at AuthenTec's TruePrint Technology. In summary, "TruePrint Technology uses a patented radio frequency (RF) imaging technique that allows the sensor to generate an image of the shape of the live layer of the skin that is buried beneath the surface of the finger." This makes spoofing of fingerprints nearly impossible.

In fact, AuthenTec are quickly dispelling the myth that biometrics are inherently insecure. Have a look at the Fujitsu's hot-off-the-factory-line F900iC [Japanese]. This is the first phone to fully encorporate mobile commerce (m-commerce), and all authentication is performed via that tiny AES2510 AuthenTec swipe sensor.

DoCoMo (think: user base in the millions) would be mad to trust a technology that you suggest is "not really ready."

And yes, I work for AuthenTec ;-).

Actually, severed fingers won't read on a capacitance sensor, but then again the would-be thief wouldn't know that until after he "borrowed" your finger. Thankfully, if nothing else this means they'll leave it behind so the doctors can re-attach it.

a recent email response from a rep for the Authentec line of fingerprint scanners regarding use of their scanner via a "stolen" finger:
... "I checked into your question regarding the fingerprint scanner. The fingerprint scanner requires a live layer of skin to work. A finger that has been cut off will still be "live" for a certain period of time and will therefore work in the scanner. The actual time frame has not been determined as no one has volunteered to be a test subject." ...

According to the Acer site the chip is made by Authentec, Inc. (based in Florida); here are some more tech specs: Products; and some other details are in their Media Coverage Archive.

According to the Acer site the chip is made by Authentec, Inc. (based in Florida); here are some more tech specs: Products; and some other details are in their Media Coverage Archive.

According to the Acer site the chip is made by Authentec, Inc. (based in Florida); here are some more tech specs: Products; and some other details are in their Media Coverage Archive.