(1) Unknown
Nature of Biometrics (2) Overlooked Security in Cyberspace (3) Ignored Nature of Humans’
Identity
1.
Unknown Nature of Biometrics
It is getting known that NIST
no longer allows biometrics to be used on its own but requires it to be used
‘only as part of multi-factor authentication with a physical authenticator
(something you have)’ in view of the inherent vulnerabilities of biometrics as
stated in 5.2.3 ‘Use of Biometrics’ of Digital Identity Guidelines 800-63B.
Privacy issues of biometrics
are relatively well known. Not a few people are aware that it will be
catastrophic when biometrics data are leaked, since it is impossible to change
or cancel biometrics data. (‘when’ rather than ‘if’ in view of the long lists
of data breach by sophisticated attacks.)
But the security aspect of
biometrics brought by the co-use with a fallback password is unknown. It is
probably due to the indifference of the participants to those facts as quoted
below.
FAR, FRR & Threshold explained
with graphs
- False Acceptance Rates and
False Rejection Rates are in a trade-off relation, not independent from each
other
False acceptance of 1/1,000,000
is not necessarily better than that of 1/50,000 in biometrics
- We need to know the
corresponding false rejection rates before judgment.
‘Unique’ is not ‘Secret’
- Identification is not
authentication. Convenience is not security.
Cinderella challenged by foot
recognition (Published 2005)
- False Rejection vs False
Acceptance
NIST requires that biometrics “SHALL
be used only with a physical authenticator” (NIST 800-63B 5.2.3)
Turn off biometrics where
security matters
- Biometrics is a good tool to
achieve a good convenience, not a good security.
2.
Overlooked Security in Cyberspace
The
security we need is for safer life of good citizens. We do not need such
security measures that help criminals and tyrants.
Password-less Life - It is a Dystopia.
- What we need is a new breed
of password to succeed the conventional password.
Two entrances placed in
parallel provide nice convenience to criminals
- This is what we witness in so
many biometrics products in cyberspace
Behind the unsuccessful
password guidelines are security experts’ indifference to humans’ cognition
The password written on a memo
is ‘‘what we have’, not ‘what we know’
3.
Ignored Nature of Humans’ Identity
Having our identity
authenticated is for social activities in human communities, in which our
identity is not separated from our volition and personal memories.
Volition & Memory
- Shall we discuss our
‘identity as citizens living in society’ rather than that of ‘a chunk of bone,
flesh, fat and skin’?
What is expected of a successor
to the password?
- What has to be used with a
password is not qualified.
We could be more rational in
defining our identity as a citizen in human society
- Our autobiographic memory, not
our body features, makes our identity as a citizen
Smartphone Security –
Intuitive, easy and reliable
- We could make use of autobiographic/episodic
memory
Identity Assurance in Emergency
- Episodic memories enable
intuitive authentication that stands panicky situations
Amazing Security Comics
(Published 2005)
- Homo sapiens versus
NIST-backed security professionals
Appendix – Related articles published on
Media
Unnecessary
Deaths Presumably Brought By Faulty Biometrics
Biometrics
as additional access route weaker than password-only protection
Make sure not to mix up ‘Identification’
with ‘Authentication’
Mitigation of Password Predicament
Virtual Strategy Magazine - Intuitive
Passwords: Passwords to Succeed Passwords
Comments
Post a Comment