When will biometrics take over from passwords?

ANGELA SASSE

Professor at Universty College London and director of the UK Research Institute in Science of Cyber Security

People are fed up with battling to remember dozens of passwords. Entering them several times a day on various devices disrupts users’ flow and wastes time. Employers and service providers have started to realise this and are offering alternatives in the form of sensors and biometrics. Fingerprint biometrics have been available on mobile phones for a while, but the addition of Apple’s Touch ID marks a point of no return in the second coming of biometrics. While some security experts may be concerned about the use of fingerprints on their own, for customers it is a welcome escape from the struggle with passwords and the widely disliked two-factor authentification the banks inflict on them.

RAMESH KESANUPALLI

Founder of Nok Nok Labs and vice president of Fido Alliance, an industry body that seeks to standardise authentication methods beyond passwords.

We are at an inflexion point where biometrics are ready for consumer-scale adoption both from quality and cost standpoints. You will see more and more Fido-enabled services in the field in the next 18 to 24 months. However, for a considerable amount of time, passwords will still be there as a recovery process. You will see Fido not only addressing the business pain, but also addressing the user pain. Each one of us has 20-25 accounts. We all use two or three passwords. Every one of us is accessing our emails and financial accounts using cell phones, where typing user names and passwords is not much fun. The server-side hacking to harvest accounts is a major problem. There will not be any server-side global attacks possible if you deploy Fido. There is no single type of authenticating solution that is going to be number one in the market. There is going to be a heterogeneous environment. Fido alliance brings all of them together.

DR STEVEN MURDOCH

Principal research fellow, University College London, and security architect at the Vasco Innovation Centre, Cambridge

Biometrics show promise, but only as part of an authentication solution which optimises security, privacy and convenience. Biometrics let you authenticate without noticing you’re doing so, but this strength can also be their weakness. Your biometrics are continually exposed: your fingerprint to everything you touch or your face to every camera; and your biometrics can’t be changed (whether they’ve been compromised or for privacy). You can have a different password for each service and change them when compromised, giving control of who you authenticate to. We need to ensure that authentication solutions accept only biometrics shown by a real person (not recorded ones), that individuals can choose who they authenticate to and for what, and that everyone’s privacy is protected.

STARBUG

Security researcher at Telekom Innovation Laboratories, Berlin, Starbug showed how to hack Apple’s fingerprint sensor in 2013.

It seems with Apple introducing fingerprint to their iPhone and the integration of face and iris recognition into Windows 10 the triumph of biometrics cannot be stopped. And for most users it’s better to use those features than weak or no passwords. But you have to keep in mind that biometric systems are not that much more secure than long passwords and if your biometric feature is stolen or lost you can’t get a new one. You leave biometric traces on things you touch and show your features in public.

Source : #theguardian.com