CODEWITHSUNDEEP
authenticationwebsecuritybiometrics
user93353
user93353

Reputation: 14039

Biometric fingerprints for logging into a website

Is there a way to authenticate to a website using fingerprints?

I was thinking of the following scenario.

However, this seems very insecure. It's not difficult to get a jpg of someone elses fingerprint and convert it into ISO 19794-2 template of the same. Then programmatic-ally one can login to the website by sending the userid & template to the website.

Is there a secure algorithm/design for allowing people to login to a website using fingerprints?

Upvotes: 5

Views: 7685

Answers (2)

Ravanan
Ravanan

Reputation: 586

Reading fingerprint and authenticating from client-side is very much possible. But this has to be supported by the manufacturer of the scanner. The link: http://camsunit.com/application/javascript-based-fingerprint-scanner-for-website-authentication-and-attendance.html shares the javascript API for communicating with the fingerprint scanner. One of the operations is CaptureAndVerify which validates the encrypted existing template with newly captured one and passes the response to the server directly, with ensuring the authentication shall be done securely.

Upvotes: 0

damiankolasa
damiankolasa

Reputation: 1500

It's an issue of a Trusted path between fingreprint scanner, and your website's verification logic. If someone could disguise as a valid client and submit login requests to your application, your scheme would be broken.

I think the best you can do is to use two factor authentication, I would request a users password, and provide it as input to some PKDF, and encrypt login request with it, this way if someone get's users fingerprint, he won't be able to forge a login request without knowing users password. Besides, biometric is mostly done as additional authentication factor, not the only one.

If you don't wan't to do this, you could obfuscate application code, issue it with one time key, which would be valid for very short time, to minimize risk of reverse engineering, and sign request with this key, but it's not very secure, it requires a lot of husstle without any significant security increase.

Upvotes: 4

Related Questions