A typical human body may go through a broad range of experiences, and these cause visible changes. The body may be hot or cold due to changes of weather or clothing. Daily activities may make body parts unusually damp or dry. Fashion decisions can affect skin color, facial or body hair, or even the amount of the body that is visible to sensors.

A successful biometric sensor must be largely immune to these changes. People don’t want to select clothing or decide on hand washing based on the needs of a biometric system. In any case, the biometric sensor must be able to adapt to a broad range of appearances.

A biometric sensor must always balance itself between being too strict and being too tolerant. If too strict, the sensor won’t correctly recognize the people it was programmed to recognize. Authorized users will put their fingers on readers and not be authenticated. Such users may be able to succeed by trying again, but regular failures can lead a site to abandon the system. On the other hand, if the sensor is too tolerant, it may recognize one user as another or allow an unauthorized person to masquerade as someone else.

These errors play an important role in testing and assessing biometric systems. The two types of errors lead to these two measurements:

1. False rejection rate (FRR)—the fraction of readings that should match an existing credential template but do not match it.

2. False acceptance rate (FAR)—the fraction of readings that match an existing credential template but should not match it.

In the first case, false rejections, the system rejects an authorized user. Although these don’t immediately compromise security, a high false rejection rate reduces the computer’s availability. In the second case, false acceptances, the system authenticates the wrong person. The second measurement, the FAR, gives us a basis for estimating the average attack space for a biometric.

With a biometric, it doesn’t really make sense to calculate a search space, per se. Because the FAR represents a statistical estimate, it makes more sense to calculate the average attack space from it. For simplicity, we assume that the entire population uses the biometric. We take the FAR statistic as a fraction, A_FAR, and use this equation:

For example, if the FAR is 1 percent, the fraction A_FAR is 0.01. The average attack space is the inverse of 0.02 or 50. This suggests that, on average, we will trick the biometric sensor in one out of 50 readings from the wrong people.

Many people find biometrics fascinating, and some will buy and use them if the price is right. This has produced a marketplace in which there are many low-quality products. Vendors of such products might speak proudly of a “99 percent” or “99.9 percent” accuracy rate, suggesting a FAR on the order of 1 percent or 0.1 percent. Neither of these are especially impressive when compared to passwords.

Biometric systems often include a “sensitivity” setting that we can adjust to try to achieve particular FAR and FRR levels. The two settings, unfortunately, exist in a balance; when one goes up, the other usually goes down. Some operators seek an ideal point in which the FAR and FRR achieve the same rate.

Let us look at the five types of authentication vulnerabilities listed in Section 6.1 and apply them to biometrics. Each vulnerability also indicates whether it often poses a risk in practice.

1. Clone or borrow—Often a risk in practice.

   This vulnerability has been very popular in motion pictures; the hero or heroine collects a fingerprint, a scan of an eye, or spoken conversation and uses it to clone the appropriate physical feature. In fact, this can often work with commercial devices. Researchers, technical magazine writers, and television experts have cloned fingerprints, faces, and even irises to fool biometric readers. In 2013, a Brazilian physician was charged with fraud for using cloned fingerprints so that coworkers did not have to show up at work. Some clones required special work, while others were depressingly easy. In all cases, though, it would require a strong threat at least to carry out the attack.

2. Sniff the credential—Often a risk in practice.

   Most biometric readers connect to the protected system through a cable, usually USB. If attackers have access to the hardware, they may install a sniffer like those used with keyboards. Later, the attacker could transmit a sniffed credential down the same USB connection. This is more challenging if the biometric reader is physically built into the computer’s case. For example, some laptops have a built-in fingerprint scanner. This attack would, at the very least, require a strong threat.

3. Trial-and-error guessing—Slight risk in practice.

   In this case, we present a series of biometric readings in hopes that one matches the legitimate user. For example, a group of five people can provide 50 fingerprints. This makes success likely if the fingerprint system has a FAR of 1 percent. An attack team of five people, although small, still would indicate an extreme threat.

4. Denial of service—Possible but less likely in practice.

   When we try to adjust a biometric system to reduce the FAR, the FRR often increases. Thus, as we try to reduce the likelihood of allowing the wrong person in, we increase the likelihood that we won’t let the right people in. This is a self-inflicted difficulty, caused by trying to make the system too safe.

5. Retrieve from offline—Possible but less likely in practice.

   If an attacker intercepts the credential pattern database, it may be possible to forge biometric credentials, which then could be transmitted across a USB connection, pretending to be from the actual biometric reader. Some biometrics vendors argue that this is impossible or at least impractical. In practice, it appears to be a real possibility. However, there are no simple tools to do this, so it would only be the province of an extreme threat.

None of these attacks are the province of a weak threat. There are a few attacks that a strong threat might carry out, and a few that would only be mounted by an extreme threat. Therefore, biometrics are clearly usable in the face of a weak threat, and possibly in the face of a strong threat.

Biometrics should not be used for remote authentication. The biometric reading must be collected by a sensor residing within the authentication mechanism’s trust boundary. Credential sniffing poses a serious attack vector.