This is a Letter to the Editor that I sent in a while back, and I am finally putting it on my blog. Enjoy.
The November 9th edition of the Daily Journal featured an article describing Greenwood Community School Corporation's use of fingerprint scanners to secure its computers. The article quoted Joe Huber, GCSC's director of information systems, saying, “there's no combination of letters or numbers to try to crack”.
That statement is false. As any knowledgeable computer user knows, all information that goes into and is stored by a computer gets converted into a series of ones and zeros. The same goes for a fingerprint that is scanned by a computer. Thus to a computer a fingerprint is no different than a combination of letters and numbers. Just because an attacker can't crack the “password” doesn't mean that a biometric system is more secure.
Using one's fingerprint as a password only gives the appearance of security because it's a fingerprint. It is no more secure than using a single, really long password. It's actually much less secure than a different password for each system because every system would be using the same “password”. An attacker would either have to capture the raw fingerprint data to gain access to all the information that that fingerprint is allowed to access or get a hold of the entire database of fingerprints. Either way using fingerprints alone only decreases the overall security of the information it's trying to protect.


