[10267] in cryptography@c2.net mail archive
Re: biometrics
daemon@ATHENA.MIT.EDU (David Honig)
Sat Jan 26 15:25:12 2002
Message-Id: <3.0.6.32.20020125175800.00839b00@mail.orng1.occa.home.com>
Date: Fri, 25 Jan 2002 17:58:00 -0800
To: "cryptography@summitsecurity.org" <cryptography@summitsecurity.org>,
cryptography@wasabisystems.com
From: David Honig <dahonig@home.com>
In-Reply-To: <200201252253.OAA14841@shell4.bayarea.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
>There is no such thing as a "tamper proof" device, and that goes
>double for anything distributed to consumers and left in their sole
>possession for indefinite periods Alice cannot be sure it is Bob if
>Frank can spend time physically attacking the reader so that he can
>send Bob's iris print whether Bob is there or not.
The lesson I learned from the excellent reverse engineering of
various smartcards is this: if the device is in someone's possesion,
*they* should be interested in not tampering with it. (E.g., When a bank's
card is in a cracker's wallet, this is not the case.) Which party the
sensor should belong to depends on the app. For some apps the other party
may insist that you use their sensor; for some, you might insist on
keeping your fingerprint (etc) in your smart card.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@wasabisystems.com
