https://shkspr.mobi/blog/2021/01/falsehoods-programmers-believe-about-biometrics/ Terence Eden's Blog Falsehoods programmers believe about... Biometrics 2021-01-09 by @edent | #design #falsehoods #policy #security | 3 comments --------------------------------------------------------------------- (For the new reader, there is a famous essay called Falsehoods Programmers Believe About Names. It has since spawned a long list of Falsehoods Programmers Believe About....) Everyone has fingerprints! The BBC has a grim tale of a family with a genetic mutation which means they have no fingerprints. It details the issues they have getting official ID. In 2010, fingerprints became mandatory for passports and driver's licences. After several attempts, Amal was able to obtain a passport by showing a certificate from a medical board. He has never used it though, partly because he fears the problems he may face at the airport. And though riding a motorbike is essential to his farming work, he has never obtained a driving licence. "I paid the fee, passed the exam, but they did not issue a licence because I couldn't provide fingerprint," he said. The family with no fingerprints Even if this genetic issue didn't exist, it should be obvious that not everyone has fingers, or hands. Some people are born without hands, some people lose them later in life. Policy is about the edge-cases. It's easy to design something which works for the majority of people - the real challenge is how we deal with the fringes. Everyone has a unique face / unique DNA Ever heard of twins, dumbass? OK, it is a little bit more complicated than that. It is easy to revoke a biometric indicator Even if you assumed that everyone has ten fingers - that means you can only change your ID 9 times. If you're using iris recognition, that's one change you're permitted before you have to grow new eyeballs. Biometrics can't be copied Back in 2002, Tsutomu Matsumoto copied fingerprints using Gummy Bears . Researchers can consistently fool iris scanners 3D printed facemasks can defeat facial recognition systems. The thing about biometrics is that they are not secret. You leave your fingerprints everywhere. If a camera can read your face, it can copy your details. Biometrics can't be changed Will having a "nose job" stop your iPhone from recognising you? Probably not. But there are a range of surgical procedures which can be done. People who have Facial Feminisation Surgery can be given a letter from a doctor to explain to border guards why a person's face may no longer match their biometrics. Oh they did. I have formal letter stating that I might not pass biometrics anymore. -- Charlie Don't Surf (@sonniesedge) December 3, 2020 What are they good for? Biometrics are not passwords. Nor are they a universal 2nd factor. Biometrics are, at best, usernames. For the average user, it's probably fine to use your fingerprint or face to unlock your phone. If you think an enemy state is going to devote considerable resources to steal copies of your biometrics, consider changing to a different password mechanism. Or, if you have kids. Friend's 5-year old daughter started unlocking his phone with his fingerprint while he's asleep so that she can play games. He now sleeps with gloves on. #lifeisblackmirror -- Pushkar (@Pushkarr) September 24, 2018 Or if you're cheating on your spouse. A Qatar Airways pilot was forced to make an emergency landing after a passenger found out her husband was cheating on her and had a violent reaction in midair. The woman reportedly used her sleeping husband's finger to unlock his phone and discovered his cheating ways. Eyewitness News In a safe-ish environment, biometrics are a good convenience mechanism. If your phone is snatched by an opportunistic thief, they're unlikely to have the means to spoof your ID. But they are not a perfect security measure. --------------------------------------------------------------------- More posts from around the site: 3 thoughts on "Falsehoods programmers believe about... Biometrics" 1. [] Tony Finch says: 2021-01-09 at 13:26 Another falsehood: a person has one genome (there are chimaeras and genetic mosaicism) Reply 2. [NrEeD1Q9] HN Front Page says: 2021-01-09 at 15:14 Falsehoods programmers believe about Biometrics L: shkspr.mobi/blog/2021/01/f... C: news.ycombinator.com/item?id=257000... Reply 3. [FURegbHs] Douglas Dollars [?] says: 2021-01-09 at 17:30 A good time to remind folk in tech that faces, fingerprints, etc. should not be used as a password. "At best" they can be considered a username, with even that being eventually a problem: shkspr.mobi/blog/2021/01/f... Reply Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment[ ] Name * [ ] Email * [ ] Website [ ] [ ] Notify me of follow-up comments by email. [ ] Notify me of new posts by email. [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] [ ] To respond on your own website, enter the URL of your response which should contain a link to this post's permalink URL. Your response will then appear (possibly after moderation) on this page. Want to update or remove your response? Update or delete your post and re-enter your post's URL again. (Learn More) [ ] [Ping me!] Subscribe to Blog via Email Enter your email address to subscribe to this blog and receive notifications of new posts by email. Join 11,834 other subscribers. Email Address [ ] Subscribe Search for: [ ] [Search] Explore The Archives 2021 January 9 posts February March April May June July August September October November December 2020 January 31 posts February 29 posts March 31 posts April 30 posts May 31 posts June 30 posts July 31 posts August 31 posts September 30 posts October 31 posts November 30 posts December 31 posts 2019 January 31 posts February 12 posts March 17 posts April 12 posts May 12 posts June 10 posts July 7 posts August 5 posts September 6 posts October 14 posts November 30 posts December 17 posts 2018 January 8 posts February 4 posts March 6 posts April 14 posts May 5 posts June 6 posts July 6 posts August 13 posts September 14 posts October 8 posts November 30 posts December 4 posts 2017 January 12 posts February 9 posts March 8 posts April 4 posts May 10 posts June 5 posts July 5 posts August 6 posts September 3 posts October 4 posts November 30 posts December 2016 January 10 posts February 10 posts March 11 posts April 9 posts May 8 posts June 9 posts July 6 posts August 9 posts September 4 posts October 2 posts November 30 posts December 14 posts 2015 January 8 posts February 11 posts March 10 posts April 4 posts May 9 posts June 3 posts July 7 posts August 9 posts September 10 posts October 2 posts November 30 posts December 4 posts 2014 January 13 posts February 13 posts March 14 posts April 13 posts May 7 posts June 7 posts July 9 posts August 5 posts September 5 posts October 1 post November 30 posts December 20 posts 2013 January 25 posts February 17 posts March 15 posts April 18 posts May 11 posts June 14 posts July 6 posts August 14 posts September 6 posts October 4 posts November 30 posts December 14 posts 2012 January 14 posts February 8 posts March 13 posts April 15 posts May 10 posts June 16 posts July 8 posts August 8 posts September 6 posts October 6 posts November 30 posts December 31 posts 2011 January 13 posts February 11 posts March 11 posts April 12 posts May 8 posts June 8 posts July 6 posts August 5 posts September 11 posts October 7 posts November 30 posts December 17 posts 2010 January 6 posts February 15 posts March 12 posts April 13 posts May 4 posts June 3 posts July 15 posts August 8 posts September 11 posts October 9 posts November 30 posts December 9 posts 2009 January 1 post February 5 posts March 3 posts April 7 posts May 12 posts June 8 posts July 10 posts August 10 posts September 12 posts October 22 posts November 31 posts December 15 posts 2008 January 2 posts February March 2 posts April 3 posts May 2 posts June July 1 post August 3 posts September 1 post October 3 posts November 2 posts December 1 post 2007 January February March April May June July August September October November 4 posts December 5 posts 2006 January February March April 1 post May June July August September October November 1 post December 2005 January February March 1 post April May June July August September 1 post October November December 2004 January February March April May 5 posts June 3 posts July 1 post August September October November December 2003 January February March 2 posts April May June July August September October November December 2002 January February 1 post March April 3 posts May June July August September October November December 2001 January February March April May June July 1 post August September October 1 post November December 2000 January February March 1 post April May June July August September October November 1 post December 1999 January February March April May June July August September 1 post October November December 1 post 1995 January February March 1 post April May June July August September October November December 1987 January February March April May June July August September October November December 1 post * (c) Terence Eden * Contact Me * Subscribe * Citations * About Me