Bad Science: Biometric security is weak.

[da]

http://www.badscience.net/2007/11/make-your-own-id/

Biometric fingerprint data's not as secure as you might hope. Not only can it be foiled by a gelatin cast of your finger, or even a digital photo of your fingerprint turned into a geletin cast of your finger, but apparently the numeric conversion of your finger's data, stored in the biometric database, or on your ID card, or what have you, can be translated back into your fingerprint according to a paper by mathematicians at MSU. Check that link for details- and a MythBusters episode where they make a gelatin fingerprint and go around foiling locks with it.

(As it happens, my cousin Simon is a sociologist who writes about the unreliability of forensic fingerprinting. It's a neat topic!)

Thanks to rhythmaning for pointing to the article and reminding me about Ben Goldacre's blog / Guardian column, bad_science. I used to read his column, back before RSS feeds. :)

Speaking of awful security, I can't imagine how angry I would be if my data (or my children's) were on those lost CDs in the UK post. Angry and scared, most likely.

Indeed, I wonder who's stupid enough to send around unencrypted CDs by the non-registerd postal service here in North America.

Comments

[mskala.livejournal.com]

Preventing that translation back from the database to the fingerprint is the topic I wanted to do for my PhD. We have strong cryptographic hashes used for things like passwords that must match exactly: it's possible to make the computer check whether the password is right without giving it enough information to actually reconstruct the password short of testing them all until one matches. There's very little known about how to do something similar with something like a fingerprint where a fuzzy match is needed - a secure robust hash, where "robust" means it can still match under small changes. At the moment, about the best we can do is store a reconstructible copy of the fingerprint to compare against.

The topic I've ended up actually doing, though, is quite a lot different from that.

[da-lj.livejournal.com]

I guess storing the fingerprint itself is a bit less than optimal.

Your upcoming seminar talk abstract seems to have much more information complexity than the topic you didn't use for the PhD, so it must be a better topic. ;)

[rhythmaning.livejournal.com]

There was a case in Scotland recently - the last couple of years - which has thrown the fingerprint section of the Police forensic science labs into turmoil.

I can't remember the full story, but they accused a police officer of being at the scene of a crime on fingerprint evidence despite evidence to the contrary, thereby ruining her career.

The police refused to apologise, the Scottish government refused to apologise, until the whole case crashed down around them in court. A large out-of-court settlement was paid.

Some of the details are here (should you be interested!) - though I suppose if you are interested, you'll already know the story! http://news.bbc.co.uk/1/hi/scotland/5310246.stm

[da-lj.livejournal.com]

In point of fact I'm interested enough to look, but nowhere near informed enough to have already heard of it, so thanks. :)