Study: Device-side biometrics better for privacy, security

Government agencies and technology companies using biometric identifiers like fingerprints or facial recognition to replace passwords should eschew large databases of citizens' personal data, a study out Thursday says.

Government agencies and technology companies using biometric identifiers like fingerprints or facial recognition to replace passwords should generally eschew large databases of citizens’ personal data, a study out Thursday says.

‘Rather than storing everyone’s fingerprints in a huge database’ which would make a juicy target for hackers to steal, ‘do the authentication on the device, one-to-one,’ said Phil Dunkelberger, CEO of Nok Nok Labs, which commissioned the study from PriceWaterhouseCoopers Legal.

Essentially, there are two ways of using biometrics to confirm identity: server-side or one-to-many, and device-side or one-to-one. In the former model, the user’s biometric is transmitted from the device to a server, where it is checked against a database of many users’ details.

But this model can run afoul of laws or regulations limiting the offshore storage of confidential data, according to the study.

‘A global network of biometric authentication users will require international transfers of biometric data,’ the study reads. ‘The transfer of personal data out of a jurisdiction is generally restricted and most jurisdictions enforce stringent requirements’ for security and confidentially of such transfers.

The study’s author, British lawyer and PwC Legal partner Stewart Room, calls the use of biometric data for identity authentication ‘a double-edged sword,’ because of its sensitivity and the fact that — unlike a password or credit card number — a fingerprint can’t simply be changed or re-issued if it’s stolen.

‘Device-side matching of biometric data is a compelling approach to satisfy key privacy requirements on cross-border personal data transfers, as well as providing the benefits of individual choice and control around such personal data,’ according to the study.

Nok Nok Labs is a founder member of the Fast Identity Online, or FIDO, Alliance, which has developed technical standards for interoperable device-side authentication.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure