Why Biometrics Cannot Replace Passwords

Just as the tech industry is turning its attention from passwords to biometric identification, so are hackers. It may come as a surprise – or maybe not – that with the abundance of photos we share about ourselves on various platforms, hackers don’t need some sci-fi technology to hack our body or steal our physical characteristics in order to fool biometric identification systems. They can do it without even having physical contact with us.

Take Touch ID, for example, which was introduced by Apple with the iPhone 5s. To those who may be unaware, Touch ID is a fingerprint recognition system that has been added to iPhones, iPads, and more recently to MacBook Pros with Touch Bar. The white-hat hackers of Germany-based Chaos Computer Club were able to find a workaround shortly after the device hit the shelves.

What raises a red flag is that they were able to hack Touch ID simply by photographing the fingerprint of the phone owner. The aim of the experiment was to demonstrate that fingerprint biometrics are not suitable for controlling access to personal devices and should be avoided.

While photographing a fingerprint may require some skills not all hackers have access to, a new biometric solution, iris scanning, has made things easier for them. Especially when considering that social media platforms are flooded with high-resolution images showing users’ faces.

In another experiment initiated by the same CCC, security researcher Jan “Starbug” Krissler has found that an attack can be carried out against some iris-scanning kits by simply making use of images found in Google searches. The only condition pictures need to meet is that they are vivid and a high enough resolution. That means it’s possible for hackers to simply print copies of the target’s eyes and bypass biometric authentication.

Starbug first showed off a clone of the thumbprint of Ursula von der Leyen, Germany’s defense minister. That was in December 2014, but a few years later he showed that it was possible to do the same with eyes simply by doing a Google search. If the image was clear, vivid and in high-resolution, bypassing the biometric authentication was possible.

Still, there is an issue that all users need to be reminded of, and Starbug’s experiments highlight once again that you can’t hide your body’s physical characteristics: your face, your eyes, your fingerprints. Passwords, on the other hand, can be hidden and encrypted. Relying on biometrics as the only authentication method is like being off-guard all the time. Enable two-factor authentication and use strong passwords combined with a good password manager to ensure you have access to all your passwords in an instant.