Messages in this thread | | | From | Bodo Eggert <> | Subject | Re: Driver for Microsoft USB Fingerprint Reader | Date | Thu, 06 Jul 2006 23:39:44 +0200 |
| |
Alan Cox <alan@lxorguk.ukuu.org.uk> wrote: > Ar Iau, 2006-07-06 am 00:48 -0400, ysgrifennodd linux@horizon.com:
>> As far as I can tell, the only thing you want is AUTHENTICATION - you >> want proof that you are getting a "live" scan taken from a user >> who's present, and not a replay of what was sent last week. > > Read the papers on the subject. If I can get copies of the unencrypted > data I can use those to make fake fingers.
Copies like the one on the glass I used in the restaurant ...
> A finger print is personal data, arguably sensitive personal data. That > means there are lots of duties to store it securely.
That's why every waiter will assiduously clean your glass. won't he?
> It is also very > hard to revoke a fingerprint so theft of data is highly problematic as > it will allow me to generate fake fingers.
That's the problem: You can't know who is acting responsibly and who isn't. Therefore you can't reuse your fingerprint on different sites.
> Theft of encrypted data might > allow replay attacks on one PC. Big deal.
ACK. It should be protected by a nonce, too, as long as you depend on encryption. You should also authenticate the reader before prompting for a fingerprint, otherwise the replacement device might store the image to a secondary location. And don't forget to prompt for cleaning the scanner, I have heared rumors about scanners erroneously authenticating the previous user. You should also install a camera preventing an attacker to place his own scanner on top of yours. -- Ich danke GMX dafür, die Verwendung meiner Adressen mittels per SPF verbreiteten Lügen zu sabotieren.
http://david.woodhou.se/why-not-spf.html - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |