[trevo]

Are there any good readers out there for mac?

[ast3r3x]

I'm not sure, but seriously don't waste your money on that. They are such a novelty item and don't provide real security.

[Brad]

Not quite, ast3r3x. I know for a fact that certain branches of the military use fingerprint readers at key terminals. Also, a close friend did a co-op senior design project with a firm that implemented such a device and it proved to work very well.

[LoCash]

Well, the ones that the OP can afford probably aren't as secure as military grade devices

[Brad]

Ah, I suppose I should have mentioned that my buddy was using an off-the-shelf commercial-grade USB fingerprint reader. His project and the military comment aren't related.

[ast3r3x]

Well I'll see if I can find it, an article I read basically said, it's no more secure than a regular password...now if I can just find it. I think it was in print though

Edit: This isn't where I read it, but it's basically saying the same thing. Here is a RedNova Article that says close to what I read. I just did a google search and got this article, I'm do not just go to sites with 'nova' in the name

Curiously, Microsoft warns that the Fingerprint Reader should not be trusted to secure access to corporate networks or to protect sensitive data, such as financial information. Basically, the company says it's about convenience, not security. That seems to rule out password-protected Web sites for credit cards, utilities, banking and others for which I might want to be spared having to remember and type a litany of passcodes.

This might be just with regards to a MS finger print reader, or it could be the technology it uses with Windows. Either way, the article left me with the same thing that the quote says, they are for convenience, not security.

[Brad]

Well, of course it's not more secure than a regular password. Essentially, all it's really doing anyway is generating a key based on a set of coordinates. The level of security entirely depends on the key length (and choice of encryption scheme, but that's another discussion). Of course, if you can get the key that is generated by a fingerprint, that's not going to do you a whole lot of good unless you can physically alter the scanner to accept your special input. If you've penetrated a system so far as to do that, the method of password retrieval isn't going to make any difference anyway.

I'm not disputing that there are obvious flaws. Molds of fingerprints or even pictures of fingerprints can trick the less sophisticated devices. The advantage lies in that fingerprints are generally much more difficult to forge (and get away with it) and that they can be used as an extra layer of security in conjunction with traditional passwords.

edit: I just skimmed that article you edited in there, ast3r3x. It looks like that's at least partly just a case of really crappy software.

[Kestrel]

Originally Posted by Brad The advantage lies in that fingerprints are generally much more difficult to forge (and get away with it) and that they can be used as an extra layer of security in conjunction with traditional passwords.

To elaborate on this, fingerprints as an extra layer can be useful because they add a new dimension of security; access is then based on both something you have (fingerprint) in addition to something you know (password). This is in some cases superior to simply adding an extra layer (like a second password) because it requires a different approach to bypass.

Using a fingerprint is actually a very poor method of implementing the "something you have" side of security - the primary benefit is convenience. It is, after all, very difficult to lose one's finger by accident. Unfortunately, many sophisticated fingerprint scanners can be fooled by relatively simple methods (gummi bears, for example). Especially with hardware a consumer can afford, there is a good chance that anyone insterested enough to bypass your password is also willing to make that minimal effort to bypass your fingerprint. You may have more success with a hardware dongle that plugs into a USB port, such as the Aladdin eToken (http://www.security-mart.com/product...5aec561d8452e4).