Biometrics: Security Concerns

Biometrics has been adopted by companies all around the world with open arms. Apple introduced biometric identification with the iPhone fingerprint sensor in 2013. Banks all around the world have also embraced the technology, with Bank of America startingto pilot a biometric system from Samsung that scans the iris to determine person identity and Wells Fargo and British bank TSB working on iris scanning for mobile banking as well. However, biometric security systems are not fool-proof contrary to popular belief.

Seemingly secure on the surface, biometrics are inherently public. Though it is prone to hackers, a password is still inherently private because you are the only one who knows it. However, the facial features used by biometrics are exposed. Fingerprint recognition, voice recognition, and iris recognition are easier to hack. Social media websites have your pictures and even some of the stores you visit records and saves your image in its database to identify you and analyze your buying habits.

This makes them easy to hack. Famous hacker Jan Krissler was able to beat the widely accepted biometric advancement, Apple’s TouchID just a day after the iPhone was released. He recreated German Minister of Defense Ursula von der Leyen’s fingerprint, showing how easy it is to steal a public figure’s identification. Obtaining high-resolution photos of the politician’s thumb from press conferences, he reconstructed the thumbprint using VeriFinger software. Researchers from the Chaos Computer Club created fake fingers to unlock iPhones too. Similarly, by placing a contact lens over a photo of a user’s eye, Hackers fooled the Samsung S8 iris recognition system.

Unlike passwords, credit cards, or other records, physical identifiers cannot be replaced. If someone has your photo, fingerprint or iris scan, you cannot replace those features of your body. In 2015, The Office of Personnel Management breach compromised 5.6 million people’s fingerprints.

Thus, biometrics may be the security measure of the future, but it isn’t time to discard your passwords yet.