A good point. But one way to counter the "stolen fingerprint" scenario is to couple the biometric with a second or third form of authentication (a secret pin code, password, or voice print, for example). Periodic (voluntary or enforced mandatory) pin changes can be made by users to ensure the integrity of their biometric signature(s).

Compromised users could even re-enroll their fingerprimts and attach this new enrollment to a new pin number, to ensure validity. Like frequent password changes, it is an old, but trusted and effective, technique for periodically refreshing the authentication status of valid users and denying access to the bad guys.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11339/32615#32615