On: Identity and Authentication are Separate Things: Why Fingerprints Shouldn't be Passwords

[te_platt]

Nothing is "wrong" with doing that. What advantage to you hope to get by combining metrics?

[gravitycop → te_platt]

>>> False positives and false negatives are part of the system.

>> What is wrong with combining diverse metrics

> What advantage to you hope to get by combining metrics?

Reduction of false positives and false negatives, i.e. increased recognition-accuracy.

[statictype → gravitycop]

The problem with using biometrics at all is that you're conflating authorization with authentication. Those are fundamentally different (at least in the society we live in).

Biometrics are used for authentication - proving who you are (whether it works and can be duplicated is a different issue).Useful for a passport or driver's license.

Car keys, passwords, ATM pin numbers are a form of authorization.

For example, you may want to let your daughter withdraw money with your card or use your car. Biometrics can't be used for that purpose.

[gravitycop → statictype]

For example, you may want to let your daughter withdraw money with your card

That would be an example of a generic (unpersonalized) key. It's a poor example because:

1. People don't lend out ATM cards.

2. Why wouldn't I simply transfer funds into her account?

3. Physical cash is unlikely to exist for much longer.

or use your car.

The generic (unpersonalized) key, again. Why wouldn't I simply tell my car to let my daughter use it?

[statictype → gravitycop]

1) Not even to their own family?

2) Because I had to go to shop to pick up some Foo and meanwhile wanted her to get some money from the machine that was next door..?

3) um, ok. If you say so.

There are tons of reasons. I'm talking about how the world works right now. Not a hypothetical world that may or may not exist in the future.

[gravitycop → statictype]

Because I had to go to shop to pick up some Foo and meanwhile wanted her to get some money from the machine that was next door

If you were buying something from a physical shop, you wouldn't need money from a machine next door, because shops can give cash at the register from the customer's bank account. http://www.google.com/search?q=%22would+you+like+cash+with+t...

[statictype → gravitycop]

Man, you're really reaching. Forget it, you win.

[gravitycop → statictype]

Where did you get the idea that people lend ATM cards? http://www.google.com/search?q=%22lend+your+atm+card%22

http://www.google.com/search?q=%22lent+my+atm+card%22

[wmf → statictype]

To put it another way, biometrics can support ACL-based authorization, but not capability-based authorization. However, since the entire world is using ACL-based authorization anyway, it's not a practical limitation.

[te_platt → gravitycop]

Ok, but I think that would just make the other issues worse. Mind you, I'm an old cynic who couldn't get it to work, and you should never listen to old cynics. If you think there's something there I'd like to see what you come up with.