How Secure is a Fingerprint Sensor Versus a Standard Password?

Question

According to Apple, Touch ID the probability of a fingerprint matching is 1:50000 while the probability of guessing a four digit passcode is 1:10000. Statistically speaking, this would make Touch ID five times more secure. But the answer isn't that simple. Reconstructing a fingerprint is far easier than reconstructing a passcode. Although a fingerprint is unique, you are basically walking around with the security key on you at all times. I see have a fingerprint is like have the four digits of a passcode, just not in the right order (is this the right thinking though?).

Regardless, I'm not interested in a passcode. I'm interested in a password. Software applications allows you to login to social media, online transactions, and even bank accounts. Is a 1:50000 ratio really that secure when being compared to a password, especially when looking at such sensation data? I am more interested in after the attacker has the password or fingerprint, not so much brute forcing methods. With a strong password it seems as though the odds are much greater. Although a fingerprint is unique per person, a password is unique per situation. If I have your fingerprint I have your email, you social media accounts, and your bank information. Where as a password I may only have your Facebook.

Is fingerprint scanning being rapidly growing solely on convenience or is it more secure for the typical user? Advertisement claims is more convenient and more secure. However, is this normally the case?

Answer 1

The fingerprint does act as the sole means of authentication for accessing the device, but not for accessing secured services or sites. It therefore does not serve the same role as a password.

Typically the fingerprint authentication is used as a second factor of authentication, the first factor being physical possession of the device on which the fingerprint sensor is hosted. And there may be other factors too, such as the traditional password.

For example, if you have an online banking app, you will usually have to enter your user name and password first, then tell the app that you wish to turn on Touch ID. Later, when you wish to use the app, the device will authenticate the fingerprint, then retrieve the password from password storage and submit that to the server proper, which authenticates the password. If you don't have the device, the fingerprint is useless. And if the device doesn't have the password, the device is useless too.

Bottom line: You can't just use the fingerprint by itself. And no, it's not a secure as the password, unless the password is very very short.

Answer 2

Usability v/s Security Matrices isn't resolved with dependent Biometric Authorization & Authentication

For example, before I start - have a look at how the basic foundation of security is built in matrices:

It can be easily concluded that High Security unfortunately comes with low usability features.

How Do I know This?

I have been in ongoing research on secure architectural implementation of possible authorization & authentication mechanisms using iOS & Android - both. The framework isn't decided & with all the research experience, I have nailed down few points here which might be worth noting down.

Possible Risks

1. If it were to be primary security protection to access critical assets, there are traders, who can knock off an individual in person, chop off his thumb & login. It could be that simple for those who have finance data kept in secure login (primary use case) procedures.
2. Other threats could involve having the print collected using high resolution imaging & then apply image processing techniques to collect clone of the thumbprint & use it later having it imprinted on thin plastic filament. That way there is a second bypass possible here.
3. Materials used in building a phone might collect prints & afterwards the specific part can be physically taken apart to have it cloned & address security bypasses.

In contrary to using normal passwords, The latter - it could be in users mind solving the problem of physically not compromised. All it needs is user security level awareness of having the password & login strict to a compliant firm type e.g. PCI-DSS, etc (in cases of financial data fraud).

There's usability, but then there's security. Hence, more usability will lead to obvious broader security risk surfaces. Therefore, below is worth a consideration of using biometric devices such as the following:

1. iris (L)
2. termogram (L)
3. DNA (L)
4. smell (L)
5. retina (L)
6. veins [hand] (L)
7. ear (M)
8. walk (M)
9. fingerprint (M)
10. face (M)
11. signature (H)
12. palm (M)
13. voice (H)
14. typing (M)

Note: H for (High), M for (Medium) & L for (Low) risks.

Let's conceptualise the same in matrices as per basic construct mentioned earlier & see if it matches the criteria:

Overall Risks Factors:

The physical attack

Offer a clean glass of champagne to the target victim during a social physical event, and manage to recover the glass to get a high definition picture of the target fingerprints.

The storage attack

All these fingerprints have to be stored either locally or centrally. Steal the Phone5 of the target victim and through physical interfaces get the internal content and attack the stored and crypted fingerprint. If they are stored centrally, since we aren't in the magic space time where 0 probability live, this central storage will get broken sooner or later.

The algorithmic attack

As any other authentication technic, fingerprint reading, storing and comparing will use algorithms. Hence this authentication is also exposed to algorithmic attacks.

The aforementioned methods have risks. There's an important point about biometric authentication that many of the commercial installations respect, but which is not immediately obvious: Banks should never rely on biometrics to supply both authentication and identification. Biometric measurements are useful, but they're in no wise unique. Two people may not have the exact same fingerprint, hand geometry, or iris patterns, but the measurements are often lossy enough to allow for collisions. Biometrics need to be just one part in a multi-factor authentication system & hence can be fit when 2FA & Biometric go side by side.

Other Usability Limitations:

Aside from these risks, other limitations include the following:

1. Error rate - false accepts and false rejects are still unacceptably high for many types of biometrics.
2. User acceptance - still not widely trusted by users; The various privacy concerns are still quite high, and the idea that a part of your body is now a security mechanism is still not relevant to some citizens.

OP's question compares the same with traditional password - hence traditional password schemes are less probable & have lesser exposure to threat surfaces than the prior Biometric Security Mechanisms. Using more compliant keeping the traditional passwords & biometric optional post prior login methods have been successful - might be the take-away.

Answer 3

A fingerprint should never be used as a password. It might be used as a identifier. You cannot change your fingerprint. If it is your password and your account has been compromised, no way to set a new 'password' because you can't get new fingerprints. But it might not be ideal as a identifier either. I didn't know, but apparently fingerprints aren't that unique like you said in your initial post.

Answer 4

A password of any length is much more secure than a fingerprint, at least in the US.

You can't be forced to divulge a password (most of the time). You have no such protection against being forced to give up your thumbprint on your locked device.

Yet those tiny skin ridges we all share were at the heart of a Virginia court case last week in which a judge ruled that police, who suspected there was incriminating evidence on a suspect’s smartphone, could legally force the man to unlock his device with its fingerprint scanner. While the Fifth Amendment protects defendants from revealing their numeric passcodes, which would be considered a self-incriminating testimonial, biometrics like fingerprint scans fall outside the law’s scope.

“If you are being forced to divulge something that you know, that’s not okay,” said Marcia Hofmann, an attorney and special counsel to digital rights group Electronic Frontier Foundation. “If the government is able through other means to collect evidence that just exists, then they certainly can do that without stepping on the toes of the constitutional protection.”

Not just state, a federal court affirmed this just this year.

Of course, this depends on the laws of your country, as the UK recently made it so not even a court order is required to force you to disclose a password.

---

To address one of your points:

Although a fingerprint is unique per person, a password is unique per situation. If I have your fingerprint I have your email, you social media accounts, and your bank information. Where as a password I may only have your Facebook.

Not quite. A fingerprint scanner can track multiple fingerprints, and sides of the same finger. Swipe one way, or on the side, and you have a new data point. I can easily provide 100+ fingerprints on a press type scanner. Much more on a swipe style scanner. And of course, the typical person only has a handful of passwords used, so from a social aspect, a fingerprint and password from the same average person are the same in practice in terms of how much you could expect to access.

Answer 5

As mentioned in the comment above, fingerprint is a 'convenient' security control; however it is not reliable for remote access control.
When dealing with bio-metric authentication in general, there is one factor that infosec people tends to ignore: the proximity of the bio-sensor device and the system that uses that device to control access.

you are basically walking around with the security key on you at all times

So you are leaving your fingerprint traces randomly on any places, which means your fingerprint could be retrieved and used the same way a stolen password could be. That being said, a system that uses fingerprint to authenticate remote user is exposed to the same risk as the one which use password. The remote system can't check if that a legitimate user or not who is being authenticated.

However, even this might not address the question, but when a bio-metric access is used onsite, we can physically identify the users, so we are safe that only the right users are being authenticated and/or authorized.

Answer 6

It can be as secure (conditions apply)

A four digits PIN or a fingerprint are very good provided that there is something clever in place to mitigate their small keyspaces.

Typically this would be a throttling mechanism which increases the time between the login attempts following a failed authentication. For current iOS versions, the first three attempts are not throttled, then this is a minute, 5 minutes, etc. When you reach 10 attempts (after 1 hour 36 minutes if my calculation is right), you can have the device wiped (if configured so).

_source

This covers the online attack. What about offline?

If it was just a matter of encrypting with a key derived from your short key-spaced key (PIN, fingerprint), then offline attacks would be easy. The solution was to go though a TPM (which Apple calls Secure Enclave) which

• generates long (2048+ bits) keys for encryption
• makes this key available (normally to the OS, but that could be an attacker requesting the key) only after a successful authentication (via the fingerprint/PIN), which is throttled per above.

Answer 7

Neither is more secure. It all depends on the circumstances, as other answers here explain.

What is better is to use both. This is two-factor authentication, a.k.a. "Something you have and something you remember".

A fingerprint on its own is useless if all it allows is a few attempts at guessing a fairly secure password. A stolen password is hard to use if it cannot be entered without being validated by the matching fingerprint.

Personally I detest fingerprint security, because there are brutal people out there who will cut your finger off first and think later. When it doesn't work, you are still minus a finger. If there is a financial account or valuable equipment behind it, I shall always refuse to offer my fingerprint. My bank gave me a battery-operated widget for online banking. To log in I insert my card into the widget and enter my PIN to activate the widget. Then I identify myself to the bank's online site and it gives me a number which I type into the widget. The widget calculates another number which I give to the bank. If that number is as expected, I'm in.

Hacking my computer won't help because the challenge and response are different every time and depend on secret (and time-varying?) logic inside the widget. So a thief has to obtain both my bank card and my widget (normally one is at my house and the other in my wallet), and also obtain both my PIN and my logon ID. It's vulnerable to a burglar breaking into my house and threatening me, but hard to break in any other way.

If you are rolling your own system, here's a free plug for the Google Authenticator app (which lets you combine a password with a smartphone as widget for logon security, at no added cost).

Answer 8

Apple's "1 in 10000 for a four digit passcode" comparison seems a little disingenuous. Poppycock, I say.

Every extra character you add to that passcode increases the security exponentially. Get it above 10 or 12 digits and guessing it becomes quite a large task, certainly much more secure than 1 in 50000. 10 or 12 digits is hard to remember, you say? 10 digits is just a phone number. 20 digits is just two phone numbers.

Touch ID is about convenience, not security. Also bear in mind that somebody can always forcibly place your thumb on that Touch ID button, even if your thumb is dead.

The issue is that a 4-digit passcode is not at all secure. In that case, the thumbprint reader is going to be more secure, although still not actually secure.

The longer the passcode, the stronger the security. The search space for a 4-digit number-only passcode is 11,100 permutations. That's in line with Apple's 1:10000 estimate. Presuming only 1,000 guesses/second, that passcode is compromised in 11 seconds, while the thumbprint gets you about a minute.

A 5-digit passcode gets you almost 2 minutes, 6 digits buys 20 minutes, 7 digits buys over 3 hours, 8 buys almost a day and a half, 9 buys 2 weeks, 10 buys 4.24 months, 11 buys 3.5 years, 12 buys 35 years, 13 buys 3.5 centuries and 14 buys 35 centuries. A 15 digit, all-number passcode would require up to 35,300 years to crack. 16 digits could take up to 353,000 years. Of course, random chance means it's also possible that any given algorithm will guess the right code within the first 4 attempts, but it's extremely unlikely.

Of course, modern computers using GPU's can perform billions of comparisons per second, so take those years and centuries and tens of centuries with a grain of salt. 16 digits, being guessed at one-hundred-billion guesses per second (government-level resources) would last about a day and a half. You would improve the security of that 16-character password by increasing the key space (using letters in addition to numbers, upper-case letters in addition to lower-case letters, etc.)

But you get the idea.