What I was trying to say is that you can only authenticate someone
through biometrics because it is something that they are. I do not
dispute that technology can be subverted or that people can be
manipulated. What I am trying to say is that a label (name, ssn)
cannot be trusted, especially nowadays. I feel the same in that
regristration would have to be done in person but again that is
impractical. Again, I am not saying that the current biometrics
technology is an adequate solution. Just that the concept of
biometrics is the only way to validate someone's identity.
You seem to be very familiar with biometrics, can you provide some
examples of products that you have experience with that you would
consider to be a scam and what ones (regardless of expense) are
adequate?
On 6/30/06, Andrew van der Stock <vanderaj@greebo.net> wrote:
On 30/06/2006, at 4:03 PM, Tim wrote:
> the only way I see that you can accurately validate
> someone would be through biometrics (something you are)
This is not possible, as:
All devices in general are tamperable and not trustworthy when in the
hands of the attacker
Biometric devices have a long history of being little more than snake
oil or toys. The good ones are significantly more expensive than ANY
other form of actual 2FA authentication device
Many attacks against existing biometric devices are so trivial as to
be a complete joke. Check out this page:
http://www.heise.de/ct/english/02/11/114/
Lastly, trustworthy biometric registration requires an in-person
visit, thus negating any possibility of remote authentication.
No matter what 2FA device you use, evidence of identity is only as
strong as the registration process. I'd prefer to see the initial
registration (and recovery of registration) done only in-person.
Otherwise the process is open to abuse by definition.
thanks,
Andrew
-------------------------------------------------------------------------
Sponsored by: Watchfire
As web applications become increasingly complex, tremendous amounts of
sensitive data - personal, medical and financial - are exchanged, and
stored. Consumers expect and demand security for this information. This
whitepaper examines a few vulnerability detection methods - specifically
comparing and contrasting manual penetration testing with automated
scanning tools. Download "Automated Scanning or Manual Penetration
Testing?" today!
https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmm
--------------------------------------------------------------------------
