|
Posted by Unruh on February 22, 2007, 2:39 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>Juergen Nieveler wrote:
>>
>>> I KNOW the documentation with MS Digital Persona fingerprint reader sez
>>> "Don't use for security purposes", BUT if I am using TrueCrypt, and an
>>> adequate strong password, then utilize the fingerprint reader in place
>>> of the typed password, how secure is my TrueCrypt file?
>>
>> Far less secure than with just the password. The fingerprint reader is
>> just a convenience tool that removes the need to type...
>>
>> Remember, all the fingerprint reader checks is wether something that
>> looks like your fingerprint is visible to the little camera inside. And
>> something that looks like your fingerprint can easily be created by
>> using the sample fingerprints you leave on everything you touch :-)
>>
>> Juergen Nieveler
>OK, thanks all, but-
>I guess my real question is how does whatever the fingerprint reader
>generates compare to, say, a "properly constructed" 25 character typed
>password? I'm not DOD or hi-tech research, just a working shmuck that
>needs to keep an opportunistic, and generally lazy, thief from accessing
> key personal or transaction information of mine or my clients.
VEry very poorly
>The potential value of the information to a thief would be either A)
>absolutely unknown, or B) reasonably expected to be limited to the value
>of personal ID info for unknown number of individuals, or possibly one
>or more specific individuals, therefore it would seem attack resources
>would be fairly limited.
Assume your files will be targeted by the worst enemy that your clients
have.
>My thinking is that if a specific file, or (scenario #2) possibly the
>entire hard drive is encrypted, AND you need to either utilize internet
>accessible cracking software to brute force the 25 character password OR
>the string generated by the reader, OR be smart enough and have the
>proper equipment and time to find the single fingerprint needed to
>match, I have a more than reasonable expectation that the info is,
>realistically, not at risk.
He knows which fingerprint-- yours. He knows when he steals them that your
fingerprints are all over the laptop, the computer and anything else in the
office or home he steals from. That is trivial.
>What say you?
HOw much insurance are you willing to buy to compensate your clients when
their information gets stolen bytheir worst enemy, and you are found at
fault.
| 
XML site map