Regular readers may know that I detest passwords as a method of authentication and have leaned towards tokens and biometric authentication as more secure, less expensive solutions for identification, authentication and authorization. However, my friend and colleague Frank Platt, a distinguished expert in physical security and emergency management for the last 40 years, sent me an interesting e-mail message recently and I asked him if we could publish it for the readers of this column.

The remainder of this column is Frank's (with minor edits):

* * *

The U.K. is planning to launch a national biometric identity card next year, along with a national database to include all the citizenry. This card will certainly be convenient when purchasing or banking or to quickly authenticate one's identity. But the whole idea may be deeply flawed.

On June 8, the London _Daily Mail_ carried an article whose headline was "Mafia will steal millions of biometric identities, MPs warned." The article covers a report to Parliament by Ross Anderson, professor of security engineering in the Computer Laboratory at the University of Cambridge in England and a well-known contributor to the security community. His point is that criminals can easily steal biometric scans.

Once that happens, it is not possible to re-enroll the person whose identity is compromised. You can't issue someone a new fingerprint [although MK notes that you can enroll another finger], or a new retina, or a new face. So once a person's biometric data are compromised, they will have to be out of the proposed system forever. There are much better ways for secure authentication, he suggests – for example, using chips within an ID card, PIN numbers, and perhaps random keypads.

I too offer a suggestion (not knowing exactly what the U.K. has in mind): two-factor authentication. If a PIN is required when using the national ID card and also a keypad with random key locations, the PIN can then seed an encryption process. Since the authentication process will first assign each 0-9 number to randomly selected keys on the keypad, the encrypted packets will be different each time. Then, if an identity is compromised, the PIN can easily be reissued. The person recording the biometric scan does not know the PIN, so simply changing the PIN can reestablish security. A new finger won't be necessary.

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services. CV online.