Vein Patterns Could Replace Fingerprints

Death Metal writes "Companies in Europe have begun to roll out an advanced biometric system from Japan that identifies people from the unique patterns of veins inside their fingers. Finger vein authentication, introduced widely by Japanese banks in the last two years, is claimed to be the fastest and most secure biometric method. Developed by Hitachi, it verifies a person's identity based on the lattice work of minute blood vessels under the skin."

Comments

How about using it as a "username"?

[mlts]

Maybe its me being pedantic, but I consider biometrics something that is intended to replace typing in a username, as opposed to being both pairs of the username/password combo. Ideally, one would have biometrics to ID which user is wanting access, then have a contactless smart card and/or a PIN for the "password" part that confirms the user is whom he or she said they are.

Re:How about using it as a "username"?

[cjfs]

Agreed. Single-factor authentication based on something that's not reissuable is a recipe for failure.

Eventually people will run out of non-compromised fingers ;-)

Re:How about using it as a "username"?

[jonaskoelker]

I consider biometrics something that is intended to replace typing in a username

And wisely so. Biometric data is an identifier--it's something with a one-to-one mapping to an identity (here: a pile of cells). Other common identifiers are SSNs, usernames, user IDs, RSA public keys and sha1 hashes [the one-to-one-ness works well in practice for sha1, but of course not in theory].

Identifiers are not authenticators. A good authenticator for any given identifier requires that only the identified thing can produce the authenticator; except in one-time schemes, performing the authentication should not allow anyone else to authenticate as you later on. It also requires that they one you're trying to prove something to can verify what you're claiming.

A good authenticator for a public key is a signature on a random string. [make sure the one validating you knows how the signature looks before you send it; use a commitment scheme].

A bad way to authenticate is by sending a copy of the private key [or for sha1 hashes, the string that hashes to the given hash].

Biometric authentication "works" by having the identifier be the authenticator, and the authentication protocol works by sending a copy of the authenticator:

You put your iris in front of the scanner and it does a "SELECT permissions FROM users WHERE iris = %s" [without the horrible SQL injection possibilities, of course]. What's to stop those who look up your iris from creating a replica? If you work by fingerprints, I send my goons to follow you around. When you open or close a door, they take your print and produce a rubber replica.

An analogy would be that you learn a word that only you can pronounce, and the authentication works by you saying the word aloud, such that everyone in your vicinity can hear it. "Only you can pronounce", I don't buy that.

Re:How about using it as a "username"?

[ld a,b]

Exactly. Biometrics are the DRM of the 21st century. They are broken already. What keeps anyone from recording the patterns and playing them back to the machine? It's not like a machine cannot replicate pressure changes and heat.
Sure, it is more difficult than scanning a fingerprint or cutting a finger off a person. A long yet still memorable password is exponentially more secure than a very long password that you have to carry around exposed all the time for others to copy.

Replacement veins in case of fraud?

[irexe]

Until someone figures out how to revoke and replace biometric properties in case of fraud, I don't see why we should even be considering them as a serious replacement for good old passports.

Re:Replacement veins in case of fraud?

[phoenix321]

It would be very necessary to mandate a "duress PIN" or password for every authentication point. A silent alarm whenever someone is forced to enter credentials against their will.

This should be mandatory for all authentication systems anyway, it would certainly hinder these ridiculous one-day kidnappings and ATM muggings.

Re:Replacement veins in case of fraud?

[aadvancedGIR]

One key element of that method is that fraud is harder to perform than with other method of biometric identification methods. You leave fingerprints and DNA samples all the time and they are easy to copy or displace, and yet they can and are used as strong evidences in criminal cases. At least, with vein patterns, no one can copy yours from an indirect transfer on a regular surface of from a photo of you.

Re:Replacement veins in case of fraud?

[Hellies]

And how would a duress pin help anything? As if the cops could jump onto the scene during the short time that an ATM transaction takes...

Seriously? In the case that a duress code is entered, the police have a lot of information to work with. As opposed to someone reporting the crime possibly hours after is happened. 1. The cops are informed that a kidnapping is in progress right now and have the exact location of the kidnappers. 2. They know the person who has been kidnapped by the bank account that is being accessed. 3. They have the images from the ATM camera, which may indicate how many kidnappers there are, how they are dressed, what state the victim is in, etc... 4. The duress code could cause the ATM to display a "This account had insufficient funds" or some other error message. It's far from a perfect system. But having a "a crime is happening at this location" alarm would be a boon to law enforcement.

Hacking (in more ways than one)

[hcdejong]

The gruesome possibility that criminals may hack off a finger has already been discounted by Hitachi's scientists. Asked if authentication could be "forged" with a severed finger, the company says: "As blood would flow out of a disconnected finger, authentication would no longer be possible."

So you'd need a contraption that feeds blood through the finger. It's an extra obstacle, but if you're desperate/psychopatic enough to sever someone's finger, rigging a blood supply is no big obstacle.

Re:Hacking (in more ways than one)

[abigsmurf]

That is incredibly difficult. you'd need to hook up each individual vein and artery (with the flow going in the correct direction) and get the pressure spot on else you'll either damage the veins or just fill up the finger like a balloon.

Finger prints are never gonna disappear

[floydman]

For the plain simple fact that they leave traces behind. Police work, you know!

Re:Am I just paranoid or is anyone else....

[squoozer]

We sort of already do carry around a barcode - in our DNA. While we aren't even close to being able to process it fast enough to make it viable at the moment I could easily imagine we will be able to in the future. Welcome to the world of Gattaca only we won't be able to get round the checks as easily as he does in the film.

Re:I've got a unique vein for them...

[Flendon]

I'm sure it wouldn't require too much sophistication to replace the blood with injected dye after using a cheap sealant on the severed end.

Re:What else can you see? Handedness!

[silentsteel]

I would also like to point out that left-handed people are, typically, closer to ambidexterity than right-handed people. I was extremely left-side dominant as a small child, but, now I approach many tasks right handed. This would be a result of the estimation that ~90% of the world is right-side dominant.

As an example, biomechanically, using a screwdriver to drive a screw in left-handed is inefficient so I naturally at this point turn a screwdriver clockwise right-handed and counter-clockwise left-handed.

Just my 10 cents.

Re:Least secure, not most secure

[MrMr]

I don't see the contradiction: I would consider the least reliable metric the most secure.
Or are we talking about the security of the bank?

And as with every other Boimetric they have missed

[Big Hairy Ian]

Look Ma no hands!! Just as there are people out there with no finger prints or hands even (Remove biometric body part of choice) there are certainly going to be people with blood flow conditions that would render this method useless.

.....................

If you mod me down well lets face it who really cares

Re:Stability of biometrics

[Lemmeoutada Collecti]

Messing up a fingerprint requires nothing more than a sharp object and several horizontal lacerations in some cases... I know this from personal experience. On of my fingerprints was permanently altered enough that the whorls were distorted when I got a simple cut that became infected. The regrown print now has a section across it stretched to the side, distorting the shapes enough that most systems don't recognize it as the same fingerprint anymore.

Of course, there is still enough that a human can identify it, but the limited data sets used in most biometrics can't find sufficient matching markers.

In the case of another finger, I also have vertical wrinkles that come from aging, so now that fingerprint is segregated like looking at it through blinds.

There are many everyday events that can cause enough change in fingerprints to mess up most biometric readers. These range from short term events like having a cut or blister, to permanent changes like slicing a fingertip off and the doctor not lining it back up perfectly.

There is nothing about the human body that is immune to change. It is that elastic ability to adapt that has made homo sapiens a viable species.