Fingerprint authentication on a remote server

Robotex2011-01-10 19:28:50

Open ID

Robotex, 2011-01-10 19:28:50

I want to write such a system (I saw it on the Internet, but they did not suit me - only windows and a small list of devices). As I see it myself: the user downloads a utility on a PC that will scan the fingerprint and send it to the server. The server will provide the API to third-party sites for authorization.

But here it is interesting how to be with safety. If you send a fingerprint, then it can be intercepted and used for their own purposes. If encrypted, then the cipher can be cracked by breaking the desktop utility. In addition, with each scan, the print will be slightly different (the finger turned a little when swiping, for example). Anyone have any ideas how this can be done?

Answer the question

In order to leave comments, you need to log in

9 answer(s)

Dmitry Sidorov, 2011-01-10
@Doomsday_nxt

Such protection will be weaker than password protection ... If you can change the password as many times as you like, then you have only 10 fingers ... And yes, such protection makes sense only locally (when it is difficult to slip something between the reader and the protected system).
Well, this is my IMHO, because. I saw scanners like this only in the shop window where I work :-)

TimTowdy, 2011-01-11
@TimTowdy

If you send a fingerprint, then it can be intercepted and used for their own purposes. If encrypted, then the cipher can be cracked by breaking the desktop utility

Use asymmetric encryption .

uadeveloper, 2011-01-10
@uadeveloper

I don't think it will be popular. For example, for 12 years, sitting at a computer, I have never seen this scanner live.

Robotex, 2011-01-10
@Robotex

I'm not popular, I'm for myself.

Robotex, 2011-01-10
@Robotex

For example, in the same Enum there is fingerprint authorization according to the method that I described. Is that how they do it?

niko83, 2011-01-10
@niko83

I saw a video of how, having a fingerprint on a glass, they made a dummy and went to the computer without the knowledge of the owner
Look for those who are interested, it should probably be on YouTube

Mikhail Davydov, 2011-01-10
@azproduction

For example, in the same Enum there is fingerprint authorization according to the method that I described. Is that how they do it?

which will scan the fingerprint and send it to the server

As far as I know, Enum recognizes locally (without sending data to the server) if there is hardware support for scanning fingerprints (the fingerprint matches the standard or not, says the driver of the scanning device).

Now they sell usb scanners and they build them in every third laptop.

1. Built-in hardware support for finger scanning is minimal (minimum laptops and smartphones). Will ordinary users buy usb scanners for such purposes - no.
2. Photograph your finger? Which, in my opinion, is perverted and will not give the necessary accuracy of the finger drawing, and focusing on portable photo-video-webcams leaves much to be desired. goto 1

Gleb_Sevruk, 2011-01-11
@Gleb_Sevruk

Make a web service + client in Flash/Silverlight.
Through WCF on .Net, you can indulge, for example, you can send and receive an XML file.
In general, it is better to do something useful.

Jabberwok, 2011-01-11
@jabberwok

Read how SSL/TLS works. Asynchronous verification + certificates make the chain resistant to interception.