In our Orwellian modern era of NSA surveillance and spyware, it’s hard to blame tech users for worrying about their online privacy. In an effort to dissuade fears of hacking, Google recently released a list of common — and therefore insecure — password topics: these include birthdays, holidays, sports teams, pet names and, of course, the word “password.”
These days, most attempts to join a site like Facebook or Twitter will be met with security measures that require your password to be a certain length, and to be comprised of a healthy mix of letters, numbers and obscure symbols.
However, with the announcement of their upcoming iPhone 5S, Apple has announced an alternative to passwords: their new phones will feature Touch ID, a fingerprint scanner which will allow users to log in to their phone, as well as purchase items from the iTunes Store and the App Store, without having to remember anything.
With biometric authentication, you’re leaving potential copies of your password everywhere you go.
No more numbers, and no more fear of thieves peering over your shoulder. As long as you buy the iPhone 5S — and not its less expensive counterpart, the iPhone 5C — all you’ll need is the touch of a finger.
It’s easy to see why Apple chose to implement fingerprint identification technology: unlike other forms of biometric authentication, such as voice or facial recognition, fingerprints are more difficult to fake and the currently existing technology is far more sophisticated. “Your fingerprint is one of the best passwords in the world. It’s always with you, and no two are exactly alike,” Dan Ricco, Apple’s Senior Vice President of Hardware Engineering, boasts in a video on the company’s website. But this may be a design flaw: since fingerprints never change, your ability to switch your password is restricted.
Other issues with biometric authentication shed light on why this seemingly intuitive technology is only now surfacing. When you deposit a cheque at the bank, they compare your signature with the copy that they have on file. Though no two signatures are a perfect match, they employ experts who are able to ensure with near certainty that the penmanship matches. Similarly, no two scans of a fingerprint are exactly the same, even though the fingerprint is.
But even that assurance is questionable: fingers that have been burned or cut will not retain the same print, and damaged, dirty or temperature-sensitive sensors may lose their capacity to accurately read the grooves of an individual print.
The upside here is that you’ve got ten potential passwords — possibly even twenty, as Touch ID can read toeprints — but it’s still a little bit nerve-wracking to have your pool of potential codes limited to a few digits (pun intended).
Numerous studies have confirmed that built fingerprints are able to fool sophisticated authentication technology; some can be tricked by a photocopy, while others require a gelatin mold or a fake finger. Either way, you’re leaving potential copies of your password everywhere you go. Your password is a secret, but your fingerprint is not.
Naturally, debate has already begun over whether the era of password protection is nearing an end. Many have hypothesized that it’s only a matter of time before PIN numbers are replaced by biometric authenticators — of course, this technology is expensive, and banks would need assurance not only that this technology actually works, but that users would be willing to trust it.
Your fingerprint is one of the best passwords in the world.”
– Dan Ricco, Senior Vice President of Hardware Engineering at Apple
To be fair, the early reviews for the Touch ID feature have been almost universally positive. The new iPhone requires an additional security code — a standard four-digit numeric PIN, as previous iPhones have featured — in case biometric systems should fail. Of course, this is a little ironic, since the feature was likely designed to minimize the micro-annoyance of numeric codes in the first place.
Apple has done one thing right: once the iPhone recognizes your fingerprint, an algorithm converts the information into a numeric value which is stored on an A7 chip inside the phone. No iCloud, no central database. Users won’t have to worry about their most sensitive personal information being accessed by Apple bigwigs — this is especially reassuring given the recent controversy behind Google’s terms of service for its Drive.
But what about others? If biometric authenticators take off and passwords become obsolete, a stolen fingerprint could mean a one-way ticket into your bank account, smartphone and social networks, all at once; and there’s no doubt that some companies will be less careful than Apple has been.
Consider UPEK Protector Suite, a Windows software that allowed users to log on to their laptops via fingerprint. Elcomsoft, a Russian-based password-cracking software, found that the passwords were being stored in plain text, without any encryption. “Having physical access to a laptop running UPEK Protector Suite, we could extract passwords to all user accounts with fingerprint-enabled logon,” they advised in 2012.
The main takeaway here is that, until we can be sure that the technology is bulletproof, fingerprints and other biometric measures should be used with passwords and codes, not instead of them. It’s hard to deny that they’re more convenient, and have a sci-fi coolness factor that makes the nerd in me foam at the mouth. But with computer hackers remaining a serious threat and government surveillance invading our day-to-day routines, we just can’t be too careful.
