Biometric authentication growing for mobile devices, but security needs work
Connecting state and local government leaders
Hacks of phone-based fingerprint readers and facial recognition software underscore the need for multifactor identification.
Mobile device manufacturers are working to secure their devices with a range of biometrics, considered by some to be the gold standard for authentication. As implementation expands, however, so do the exploits.
According to a recent report by Juniper Research, over 600 million mobile devices will have biometric authentication by 2021, up from an estimated 190 million mobile devices in 2016.
Of the variety of biometric authentication technologies -- fingerprint, iris scanning, facial recognition and voice recognition -- facial and voice recognition will grow in use the most, because they are easiest to implement and don’t require additional hardware (unlike fingerprint biometrics).
“As a result, biometric security will be expanded to a new audience in markets with lower-tier smartphones, with fingerprinting remaining common in more affluent regions,” Juniper officials said.
Biometrics, however, are not fail-safe and could create a false sense of security for users.
“We may expect too much from biometrics. No security systems are perfect,” Michigan State University computer science professor Anil Jain told the Associated Press.
Jain helped a local police department crack a fingerprint-protected Samsung phone earlier in the year using lifted prints.
“The phone’s owner was dead, but police had the owner’s fingerprints on file. Jain and two associates made a digital copy of the prints, enhanced them and then printed them out with special ink that mimics the conductive properties of human skin,” Jain said. “We tried the right thumb and it worked right away.”
Face detection technologies also have been tricked using enhanced three-dimensional images created from social media photos. Researchers at the University of North Carolina used 3-D facial models based on Facebook photos and displayed with mobile virtual reality technology to defeat facial recognition systems, Wired reported.
Because facial-recognition systems check for motion and depth, the VR-style face fooled four out of five authentication systems. The fake face did not work on cameras with infrared sensors, which Microsoft’s system uses, leading the researchers to conclude that “robust facial authentication systems will be able to operate using solely web/mobile camera input.” Strong facial authentication systems will also require “non-public imagery of the user that cannot be easily printed or reconstructed.”
It’s not just a hack that can compromise biometrics. These systems have cybersecurity vulnerabilities that include untrusted user interfaces and malware on the user side and compromised USB peripherals and encryption for the enterprise sector, according to a Connected World blog.
And unfortunately, if a biometric system is cracked, users can’t change their fingerprint or facial features as they can a stolen password, making the consequences of a compromised biometric far more severe.
Others see legal and civil liberty issues with biometric authentication. While U.S. courts have ruled authorities can’t require individuals to give up their password because the Fifth Amendment protects people from being forced to testify or provide incriminating information against themselves, the same can’t be said for biometrics. In the last two years, judges in Virginia and Texas have ordered individuals to unlock their fingerprint-protected phones. The issue hasn’t yet been tested in higher courts.
The law distinguishes between something you know and something you possess, such as a physical key or fingerprint, Marcia Hofmann, a San Francisco attorney specializing in privacy and computer security told AP. The Supreme Court has ruled that individuals can be required to turn over a physical key to unlock a door.
Biometric authentication is still more secure than weak passwords today. The best approach, though, say experts, is combining the technology with other protections, such as a strong password or PIN.
“It’s good to see biometrics being used more, because it adds another factor for security,” Jain said. “But using multiple security measures is the best defense.”
NEXT STORY: Open IT, security key to smart city future