Half-baked Discussion

Some friends directed my attention to this news report -   “Biometric auth bypassed using fingerprint photo, printer, and glue” https://www.bleepingcomputer.com/news/security/biometric-auth-bypassed-using-fingerprint-photo-printer-and-glue/

It looks like correct in saying "A fingerprint should not be considered a secure alternative to a strong password. Doing so leaves your information — and, potentially, your cryptoassets — vulnerable to even the most unsophisticated of attackers".   

But, it’s a half-baked discussion;  the above messages comes with such a non-sensical remark as “Fingerprints are a convenient biometric authentication method, but when it comes to critical applications, they should only be used as 2FAs in conjunction with a strong password.”   

A very similar argument is found in this report as well – “Your Fingerprint Can Be Hacked For $5. Here’s How”   https://blog.kraken.com/post/11905/your-fingerprint-can-be-hacked-for-5-heres-how/

What kind of 2FA?   

In the real world, two authenticators are mostly deployed in a security-lowering multi-entrance formation for the sake of availability. I have never seen the two deployed in a security-enhancing multi-layer formation (real 2FA) since the availability would have to be sacrificed (What about the users who can feed correct passwords and yet get rejected by probabilistic biometrics?)   

For more, please refer to “Biometrics is to Password what Back door is to Front door” 

Key References 

Biometrics is to Password what Back door is to Front door

Removal of Passwords and Its Security Effect 

Negative Security Effect of Biometrics Deployed in Cyberspace

External Body Features Viewed as ‘What We Are’

Additional References
 

For Achieving Solid Digital Identity on Information Security Buzz (Mar/2021)

What We Know for Certain about Authentication Factors

Digital Identity for Global Citizens
 Image-to-Code Conversion by Expanded Password System

Summary and Brief History - Expanded Password System

Proposition on How to Build Sustainable Digital Identity Platform

Account Recovery with Expanded Password System 

 History, Current Status and Future Scenarios of Expanded Password System 

Availability-First Approach 

Update: Questions and Answers - Expanded Password System and Related Issues 

 < Videos on YouTube>
 

Slide: Outline of Expanded Password System (3minutes 2seconds)

Digital Identity for Global Citizens (10minutes - narrated)

Demo: Simplified Operation on Smartphone for consumers (1m41s)

Demo: High-Security Operation on PC for managers (4m28s)

Demo: Simple capture and registration of pictures by users (1m26s)

Slide: Biometrics in Cyber Space - "below-one" factor authentication