Why Are Biometrics Secure but Still Vulnerable?

TL;DR

Biometrics reduce authentication friction and resist common problems such as weak passwords, unnoticed token theft, and transferable phone numbers. Their central weakness is permanence: fingerprints, irises, and other physical traits cannot be made more complex or replaced easily, while computing and replication capabilities improve. Biometrics are therefore reasonably secure, but they should not be treated as an infallible authentication method.

Transcript

Good afternoon, everybody. Welcome to, uh, Biometrics: Sexy, Secure, and Stupid. Uh, my name is Adam Englander. I am the Chief Architect for MFA Products. Uh, what that means is I, uh, I get to make all the decisions about what we do for security, encryption, biometrics for the Ivation multi-factor authentication product called LaunchKey. So most p... Read More

Key Insights

• Biometric authentication is attractive because it reduces friction during purchases, bank transfers, and other mobile transactions. Showing a face or touching a sensor is faster than entering a password, which helps businesses encourage immediate transactions and move customers toward less expensive mobile service channels.
• Biometrics are established identifiers rather than genuinely new technology. Thumbprints appeared on ancient accounting records to identify the person responsible, while police work and fictional spy systems used physical identification long before biometric sensors became common features in consumer devices.
• Biometric traits are statistically distinctive physical characteristics. Fingerprints, retinal patterns, and facial features can help distinguish people in practical settings, although similarities such as those between twins show that biological identification should not be interpreted as absolute uniqueness or perfect certainty.
• Passwords are weakened by predictable human behavior. People dislike difficult credentials and often choose familiar, memorable patterns, while information from social profiles can help attackers classify individuals and estimate the kinds of passwords they are likely to create.
• Biometrics cannot be taken without any observable physical consequence in the same way that a written password or hardware token can disappear unnoticed. However, the information represented by a biometric can still be copied, so physical possession of the original trait does not eliminate compromise.
• Phone numbers are transferable identifiers and can therefore create authentication risk. A convincing attacker may persuade a carrier to move a number or SIM access to another device, allowing interception of authentication messages without possessing the legitimate user's original phone.
• Biometric characteristics cannot be strengthened through ordinary complexity rules. Security systems can improve how precisely they capture and compare a fingerprint or iris, but they cannot instruct a person to develop a more complicated physical trait when existing recognition methods become vulnerable.
• Compromised biometric data can preserve its value because the underlying physical characteristic remains stable. Computing, duplication, and cracking capabilities may improve while the person's fingerprint, face, or iris remains substantially unchanged, making replacement far more difficult than changing a password.

Questions & Answers

Q: Why did biometric authentication become popular?

Biometric authentication became popular because it removes friction from common mobile transactions. Instead of pausing to type a password, a user can present a face or touch a fingerprint sensor. That convenience supports faster purchases and bank transfers. It also encourages customers to use mobile applications instead of websites, call centers, or branch visits, which can reduce service costs for businesses.

Q: How are biometrics more secure than passwords?

Biometrics can be more secure than ordinary passwords because they are inherent physical characteristics and are statistically distinctive. Passwords are chosen by people who often favor simple, memorable patterns, making their choices predictable. A fingerprint, retinal pattern, or facial characteristic is not selected according to those preferences. Even so, biometric information can be copied, so the advantage is meaningful but not absolute.

Q: Why are human password choices predictable?

Human password choices are predictable because people tend to prioritize convenience and memory over resistance to guessing. Many users repeat simple sequences or construct credentials from familiar personal interests. Public social information can reveal those interests and help an attacker place someone into a behavioral group, then estimate the password patterns that person is likely to choose. Biometrics avoid this particular selection bias.

Q: Can biometric credentials be stolen or copied?

A physical biometric cannot be removed unnoticed in the same manner as a written credential or hardware token because the user would recognize the loss of a body part. The information represented by that characteristic can nevertheless be observed, captured, and copied. The presentation therefore distinguishes taking the physical trait from duplicating its usable representation, which remains a serious authentication risk.

Q: Why is SMS authentication vulnerable to account takeover?

SMS authentication depends on a phone number, and a phone number can be transferred from one device or person to another. An attacker who convincingly impersonates the subscriber may persuade a carrier to move the number or SIM access. Authentication messages can then reach the attacker's device. This makes the phone number less inherently bound to its legitimate owner than a physical biometric characteristic.

Q: Why can biometric security not evolve like password security?

Password policies can respond to stronger attacks by demanding longer or more complex credentials, and compromised passwords can be replaced. A fingerprint or iris cannot be instructed to become more complex. Recognition technology can improve its measurements and comparisons, but the underlying physical characteristic remains substantially the same. Biometric security therefore depends heavily on protecting stored representations and improving the surrounding authentication system.

Q: Why is permanent biometric data a long-term risk?

Permanent biometric data creates long-term risk because its underlying source cannot be changed easily after exposure. Computing capabilities, duplication techniques, and methods for attacking stored data can improve while the person's physical characteristic stays the same. A captured biometric record may therefore remain useful to an attacker over time, unlike a password that the account owner or service can invalidate and replace.

Q: Should biometrics replace every other authentication method?

Biometrics should not be treated as infallible merely because they are convenient and reasonably secure. They address weaknesses such as predictable password choices, unnoticed token loss, and transferable phone numbers, but they introduce the serious problem of permanence. Since biometric information can be copied and cannot readily be replaced, the surrounding authentication process must account for compromise rather than assuming the physical trait is perfect proof of identity.

Summary & Key Takeaways

• Biometric authentication became popular because it makes mobile transactions faster and easier. A face, fingerprint, or iris can replace the effort of entering a password, encouraging customers to use mobile banking and purchasing applications while reducing the operational burden associated with websites, call centers, and in-person service.

• Biometrics offer useful security properties because they are inherent physical characteristics and statistically distinctive. They avoid predictable password choices, cannot disappear without the owner noticing, and cannot be transferred between devices as easily as a phone number. However, biometric information can still be observed, copied, duplicated, or used to fool recognition systems.

• The fundamental weakness of biometrics is that physical traits do not evolve with security threats. A person cannot add complexity to a fingerprint or replace an iris after compromise. Meanwhile, computing power and replication techniques improve, so captured biometric data can retain value for attackers instead of becoming obsolete like a changed password.