MS FingerPrint Reader..and security!

[Riv]

Has anyone used the new Microsoft fingerprint reader... The main question is dose the software that comes with it have good encryption with it in 'hinding' the user names/passwords, etc. There appears little info on this with the package or the MS site? Another point of concern is MS's disclaimer in the EUA re don't use it as a security device...? Your thoughts...

 

[MichealC4]

I'm not an expert on biometrics, but the one I'm testing actually modifies the schema (Active Directory, SAM, etc.) and doesn't actually use username/password. As for their claiming not to use it as a security device, well, that defeats the purpose of biometrics, does it not? Offtopic, could you preview post before posting and correct the grammar? Thanks.

http://www.microsoft.com/hardware/mouseandkeyboard/features/fingerprint.mspx

for anybody wondering about linkage.

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[rn4it]

Finger print security is one of the least secure of biometrics. I read an article a while back about I person who has an 80 or 85% ability to crack finger print security. He uses common supplies, basically he lifts a fingerprint and etches the fingerprint into a finger prostectic. I read about him in a security newsletter I think searchsecurity.com. I'll see if I can find it again and post it.

 

[rn4it]

Here's a white paper on what I mentioned above.

http://cryptome.org/gummy.htm

 

[MichealC4]

rn4it: I've heard of that. I agree fingerprint security has its problem, but I've tested and have been assured that the fingerprint scanners I'm using are not vulnerable to that. With regards to that paper, I may have missed it, but I did not see mention of which scanners were tested. Of course the scanners I'm testing do not do this, but there are scanners that check for pulse and such. As for Microsoft's scanner, if it cannot be trusted to do anything that would be useful, why use it? Are they marketing to the home user? The average home user probably couldn't be bothered to set it up. Business? It can't be trusted to do anything. So, where do things stand?

----------------------------
"Will work for bandwidth" - Thinkgeek T-shirt

 

[rn4it]

If you go to appendix B it has the list of scanners used in this test. I would check who made them for MS.

 

[2ffat]

I've seen some of the biometerics bypassed by spraying cooking spray onto the device. This "lifts" the last fingerprint used. Then wearing latex gloves, very carefully press your finger onto the device. Works very well on cheaper devices.


James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]