Today, we'll look at the privacy issues that surround the use of biometrics as an authentication method for directory services.
Last issue, we learned that the data stored by at least one biometric reader, Biometric Access' One-on-One facial recognition product, could not be used in any way other than to verify identity for access to network resources. So, it is possible to prevent biometric objects from being used in police-state digital lineups. Not all biometric readers and systems work like this, but you should demand it of the systems you use. Theft of data "on the wire" can also be overcome by encrypting the data at the reader - a feature supported by many of today's devices - then using one-way hashing so that even if the packets are intercepted, they're useless. Another objection, and one harder to overcome, is the unalterable nature of biometric data. You can change your password at will. You can, with a bit more difficulty, change your smart card. But your fingerprints, irises and face - those you're stuck with forever. So the argument goes that, should it become possible to steal a reusable version of your biometric data, all of your secrets can be laid open with no chance of resecuring them. The answer is to use a combination of biometrics with either passwords or tokens (smart cards) - or both. In fact, the combination of smart cards and biometrics could enforce the strongest security while also allowing the strongest privacy. Simply store the biometric data on the smart card. Use a biometric reader to authenticate to the card, and then use the card to authenticate to the directory. This way, no biometric data ever leaves your possession, yet it's still impossible for someone to impersonate you. Biometrics holds great promise for authentication. Just be sure that any biometric devices you use are secure without compromising privacy - and private without compromising security.RELATED LINKS
Dave Kearns is a writer and consultant in Silicon Valley. His most recent book is "Peter Norton's Complete Guide to Networks" published by SAMS. Dave's company, Virtual Quill, provides content services to network vendors: books, manuals, white papers, lectures and seminars, marketing, technical marketing and support documents. Virtual Quill provides "words to sell by..." Find out more at Virtual Quill or by e-mail at info@vquill.com
Directories archive
Past newsletters.
Network World, 05/08/00. Biometrics eyes the enterprise
Network World, 05/08/00. Archive of Network World on Directories newsletters
