Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Technology

NIST Standards for New Biometric ID Card Published 129

Posted by ScuttleMonkey from the new-face-theft-ring dept.
rts008 writes "eWEEK is reporting that NIST has published the biometric data specs on the new Federal ID cards for employees and contractors that will be issued in October. From the article: 'Specifically, the guidelines state that two fingerprints must be stored on the card as "minutia templates," mathematical representations of fingerprint images. [...] Guidelines require that all biometric data to be embedded in the CBEFF (Common Biometric Exchange Formats Framework) structure. This ensures that all biometric data will be digitally signed and uniformly encapsulated. This format will apply not only to PIV cards, but also to any other biometric records kept by federal government agencies.'" The published standards [PDF] are also available from the NIST web site.
This discussion has been archived. No new comments can be posted.

NIST Standards for New Biometric ID Card Published More

NIST Standards for New Biometric ID Card Published

Comments Filter:
  • I will be doing everything I can to not get one of these. If I decide to give out my information, fine. If I need to make a request from a department of the gov., fine (they already can cross-ref items). I really dont see a need for this, other then to find a way to spend more money.

    • Re:No thank you (Score:5, Insightful)

      by mcheu ( 646116 ) on Sunday February 05, 2006 @03:19PM (#14646696)
      According to the description, this card is for a new government employee ID. I'm Canadian, so I don't know for sure how this is for the US, but up here, if you work for the government, your government department is already going to have a lot of your personal information. While it's not required for all public service jobs, some positions require to get at least a minimal security clearance, and depending on how high a clearance you need to get, you might get fingerprinted. The only thing new here is that they're encoding all that digitally onto your staff ID card.

      It should be rediculously easy to avoid getting one of these cards: Just don't apply for a government job.

      • Re:No thank you (Score:2, Interesting)

        by Anonymous Coward
        Well that's great if you dont work for the government or work as a contractor. But if you do, like me, it puts you in a terrible predicament. I've been a contractor for several years now, and have talked with my contracting officer about this extensively in the past. He said he won't make me do it,and that he'll resist doing it himself (he's a fed, I'm a contractor). If worse comes to worse, I'll just quit. My job has nothing to do with national security or defense, there's no need for them to have thi
        • The world needs more people with your understanding and convicition. I too will not be getting another passport (when my current one runs out) or any biometrically - linked ID card if the current trends continue. I will chose not to drive to avoid this.

          This is yet another example of where technology advances will support inflexibilty in rule enforcement. (other examples include red-light camera, DRM, etc.) In each example, human judgement is being taken out of the loop in the enforcement of a particular

      • Re:No thank you (Score:5, Insightful)

        by drDugan ( 219551 ) on Sunday February 05, 2006 @06:21PM (#14647240) Homepage
        Just don't apply for a government job

        Sorry, it's not that easy. Two problems with this. First, the class of workers that work for/in the gov.t is a huge group, and we have every reason to believe that this class will grow in size.

        Second, you run a slippery slope accepting things you disagree with, even if they don't affect you personally. If it's OK for gov't workers, next it will be OK for everyone. Next everyone will need a biometric ID to use a bank, or travel. Next if you have an outstanding issue with the government, -- oops, no money, can't travel, you're outta-luck buddy. Next Canada will say -- it's OK in the US, we should do that here. etc etc etc...
        • Hold up. Why would it not be "OK" to use biometrics for a government ID? What could "they" do to you if you have a biometric-based ID that "they" couldn't do if you just used a driver's license-type ID?

          The photo on your license is just another type of biometrics...
        • Ah.. u already need a Biometrical ID for Traveling to the US. or at least u will need one as of 8.2006 So.. not big news there. If we need Fingerprints and so on as RFID-Chips to get into ur country, u could just have them yourselves.
    • Move to New Hampshire, if this passes: http://generalcourt.org/bills/2006/HB1582 [generalcourt.org]

      And if you're up for it, join the Free State Project [freestateproject.org].

      I'm so glad I live here... and so glad that that bill is on the table, and has a lot of support.
    • If you read the story more closely its only for Federal employees and contractors, for now.

      That will of course be expanded in the future, but for now just avoid being employeed at the federal level and you are set.
  • Great, does this mean I have to get another CAC card?

  • Implications for British ID cards? (Score:4, Insightful)

    by pjt33 ( 739471 ) on Sunday February 05, 2006 @02:53PM (#14646610)
    Maybe this will kill Tony Blair's "We have to have biometric ID cards first so that we can create the de facto standards" argument. Or maybe that's wishful thinking on my part.
    • an atricle here: http://www.theregister.co.uk/2006/02/03/clumsy_id_ card_study/ [theregister.co.uk] on the subject of Uk ID cards, it seems like they might not be that useful for stopping theft... I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA, although in this example it seems to only be the prints.

      • I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA

        The police take a DNA sample from everyone they question. They keep this on record whether or not it leads to a charge. So they already have a very, very big database with DNA and fingerprints [telegraph.co.uk] of all the usual suspects and then some.

        It's worth remembering that the the ID card scheme was one of Mr Blunkett's pet ideas. Every gov't job he gets he seems to feel he has to do something

      • "I still think that they are useful for stopping low level crime if they are linked to a national register of fingerprints and DNA"

        Well, you might as well have said "I believe turning the UK into a police state would be useful for stopping low level crime" - because that's what this amounts to.

        So what if ID cards can stop low level crime? Why should it be at the expense of the liberty of the rest of the millions of completely innocent, law abiding people living here?

        We wouldn't accept CCTV in every

    • Maybe this will kill Tony Blair's....argument.

      i sincerly doubt it, everytime I see him make any argument he seems to really believe it. I think that if he convinced himself that black was white, he'd carry on believing it to the grave. Even if we don't get ID cards he'll remain convinced for the need for them. The fanatical force with which he puts his arguments, and the way he seems so exasperated with anyone who disagrees scares me at times.

  • Fingerprints? (Score:4, Interesting)

    by Old Spider ( 948471 ) on Sunday February 05, 2006 @03:05PM (#14646641)
    But... fingerprints can be stolen. How does storing someone's fingerprint on these cards make them better than any other form of ID? If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints... and likely a fake card with thier photo on it and with your fingerprint data. I mean, if they stored your retina patterns and maybe even a snapshot of your brain structure, then I could believe these cards are worth the trouble, but something tells me these new cards are nothing more than a way for whomever is making them to get some government cash by way of a false sense of security. What a joke.

    • Re:Fingerprints? (Score:5, Interesting)

      by cdrguru ( 88047 ) on Sunday February 05, 2006 @03:18PM (#14646694) Homepage
      Making "fake" fingerprints isn't all that simple.

      Sure, if you need a fingerprint that withstands some sort of cursory optical examination, that can be done without too much trouble.

      But, if they are actually using any of the better techniques, like a guy with an ink roller or a sensor that isn't optically based, you can forget about faking it.

      Actually, even just having someone watching as your fingerprint is read is going to deter about 90% (maybe 99%) of fake attempts. You don't get to use a fake finger or most things on your finger if someone is actually watching and looking for that. Not 100% certain, for sure, but nowhere near as weak as you seem to think.

      • Re:Fingerprints? (Score:5, Insightful)

        by MrAnnoyanceToYou ( 654053 ) <dylan@dyRABBITla ... minus herbivore> on Sunday February 05, 2006 @03:49PM (#14646785) Homepage Journal
        Unfortunately, as soon as fingerprints are on cards, along with other biometrics, the cards themselves become much more trusted. One of the dangers of security is the appearance of things being more secure than the actual method. Ergo, much more trusted despite only marginally more effective security. This means that when you get the key to the castle, you have one to all the doors. Not good. This is a case of the added value of having such identification on a card being trumped by the reality that if someone gets their hands on it and the ability to use it your financial life is not going to go well for a seriously long time.

        Making a security system more complex does not disallow it from being broken, it simply puts more complex holes in it. The reason anyone wants biometrics on a card is to take advantage of the gathered information, and has nothing to do with wanting more effective fraud reduction.
      • That doesn't rule out the 1% of very good fingerprint forgeries and copies which any competent spy would make use of, and that's the primary reason to use these cards. There are better ways to foil a spy is what I'm saying. Try a retina scan. It's a lot harder to copy one. Or a brain scan; that is, using an MRI scan of a person's brain structure. Try copying that. And then all three of these methods could be doubled-up by also scanning to see if whatever is being used as the object for scanning is act
        • > There are better ways to foil a spy is what I'm saying. Try a retina scan. It's a lot harder to copy one. Or a brain scan; that is, using an MRI scan of a person's brain structure. Try copying that. And then all three of these methods could be doubled-up by also scanning to see if whatever is being used as the object for scanning is actually alive

          Agencies are allowed to pack whatever other biometrics they like on the PIV card, and are allowed to use whatever additional security measures they like on

      • Making "fake" fingerprints isn't all that simple.

        I guess if you're really that desperate to commit crimes you'll figure out a nice easy way to do it, won't you?

        Score 5 Interesting, not hardly.

    • Re:Fingerprints- Come on read the summary at least (Score:1, Informative)

      by Anonymous Coward
      They don't store the actual fingerprint. They store what ammounts to a hash of your fingerprint.

    • Re:Fingerprints? (Score:5, Informative)

      by Reaperducer ( 871695 ) on Sunday February 05, 2006 @04:02PM (#14646825)
      But... fingerprints can be stolen. How does storing someone's fingerprint on these cards make them better than any other form of ID? If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints

      It doesn't sound like they're storing the actual finger prints, but a mathematical representation of them. Which could mean some kind of one-way mathematical hash, like many computers have for passwords. I'm not saying it's perfect, but I don't see how it's possible to take a set of numbers and create someone else's fingerprints. Sounds like someone's dishing out warm steaming bowls of FUD for breakfast.
      • The minutia used by AFIS and most other fingerprint sistems is just a list of points in the loops, whorls, and other curves in your fingerprint. I've seen systems using 34 and 64 such points.

        The way fingerprint authentication works is that the image from your fingerprint is analyzed, and the minutia points are extracted and compared to the stored minutia, and a match score is assigned to this comparison. If the score surpasses a certain threshold, then the match is deemed as positive.

        More points and higher
    • > If the image of your fingerprints is on the card, then anyone who has stolen your card can make fake fingerprints... and likely a fake card with thier photo on it and with your fingerprint data.

      They're fingerprint minutiae templates, not fingerprint images. And they're digitally signed and protected by a PIN. Plus the applicant's original biometrics are kept in a secure database as a backup check, and lost PIV cards can be blacklisted and rendered useless very soon after being reported.

  • Why store them on the card? (Score:3, Insightful)

    by EnsilZah ( 575600 ) <.moc.liamG. .ta. .haZlisnE.> on Sunday February 05, 2006 @03:07PM (#14646644)
    If i wanted to verify someone's information, i'd rather do so from a secure database rather than a card he gave me.
    Or am i missing something?
    • well you seem to be putting a lot of faith in the "security" of the database, I'm reminded of those 35,000 or so patient records which were stolen from an employees car which were supposed to be being held "securely"... at least if someone robs your card they only get one person's data... alhtough it'll probably have a coresponding database anyway, in which case they are just creating more potential problems

    • Re:Why store them on the card? (Score:5, Insightful)

      by Agelmar ( 205181 ) * on Sunday February 05, 2006 @03:20PM (#14646699)
      You're missing the fact that the biometric data (actually, likely all data on the card) is signed. Think of it this way:

      The issuer of the card has a certificate issued for that purpose. When the card issuer creates your card, they store your biometric information and a signature of that information on the card. If anyone tries to change the biometric information, the signature is no longer valid. Assuming that the certificate uses strong encryption and that the private part of the certificate's signing key is protected (which are both reasonable assumptions), then the data integrity is ensured.

      This makes a lot of practical sense. If you want to pull everything from a centralized database, then your readers all have to be networked. This means that each reader next to every door in the building must be networked, and while that's fine for many situations, in some areas it's not practical. With the signed data on the card, the user can present their card which contains their biometrics and access credentials, the reader can verify this locally, and then act accordingly. Of course you still need to have a way to publish the root certificate and CRLs from time to time, but it does give you more flexibility.

      • If you want to pull everything from a centralized database, then your readers all have to be networked.

        There are also potential security and privacy problems with having a centralized database. I don't know about this particular application, but many systems that employ biometrics put them on smart cards specifically to avoid the security, privacy and potential legal issues associated with having such a centralized database.

    • You're also missing that you probably won't 'give' anything to anyone. The British ID cards will probably include RFID in the spec now, though this has been very under-reported.

      http://www.theregister.co.uk/2005/07/25/id_card_go es_icao/ [theregister.co.uk]
      http://www.telegraph.co.uk/news/main.jhtml?xml=/ne ws/2006/01/28/nid28.xml&sSheet=/news/2006/01/28/ix home.html [telegraph.co.uk]
      http://management.silicon.com/government/0,3902467 7,39131459,00.htm [silicon.com]

      I suspect this will apply to the US version too we'll have to see. Politicians are very cage

    • I think you are absolutely right. Biggest problem with having biometrics "on-card" is that it is impossible to guarantee authenticity of the data. We are comparing person finger with finger stored on the card. Without communicating with some sort of centralized facility, we only can confirm that these two fingers match. One may argue that data can be signed with some really long certificate/key. But then you will need to verify certificate, which in turn will require "... communicating with some sort of

  • India's richest temple has already implmented this (Score:5, Interesting)

    by ravee ( 201020 ) on Sunday February 05, 2006 @03:09PM (#14646659) Homepage Journal
    Biometrics is widely used in India's richest temple at Tirupati [balaji.net](which is also worlds richest one). Infact, if the devotees have to get into the temple, they have to get their finger print copied to a database using biometrics and they are alloted a time to enter the temple. This is because over quarter million people daily visit the temple and crowd control is a big job for the administration.
    • This is because over quarter million people daily visit the temple and crowd control is a big job for the administration.

      I rather doubt that it works very well. The American Association of Motor Vehicle, in a 2004 policy document, noted that the best fingerprint scanning equipment (used to just take one fingerprint and compare it to a fingerprint already in the database) can, at their best, work at a ratio of 1 to 10,000. (Meaning that once you get over 10,000 fingerprints, you incur the wrath of Type I and

  • Brilliant idea! (Score:5, Funny)

    by David Horn ( 772985 ) <david&pocketgamer,org> on Sunday February 05, 2006 @03:13PM (#14646672) Homepage
    I know, let's make people carry around a card with copies of their fingerprints and retinal scans on it. You know, just in case they forget to bring along their hands or eyeballs.
    • BLACK KNIGHT:
              'Tis but a scratch.
      ARTHUR:
              A scratch? Your arm's off!
      BLACK KNIGHT:
              No, it isn't.
      ARTHUR:
              Well, what's that, then?
      BLACK KNIGHT:
              I've had worse.

  • I am more concerned (Score:3, Interesting)

    by binkzz ( 779594 ) on Sunday February 05, 2006 @03:17PM (#14646690) Journal
    That one day these will be mandatory, and that they will be placed as a chip under the skin of the hand or the forehead. If you don't have one of these chips, you won't be able to pay for anything or even buy food.
    • Doomed, doomed,

      Just cos you cant buy bread, doesnt mean you won't get bird flu!

    • Think how much prices will go down when retail theft is eliminated.
      • Not one pence.
        The price of goods is what people will pay, not what they cost to sell.
        This is called the Elasticity of Demand.

        • So the signs I see in Wal-mart: "Keep prices down, don't shoplift." are a lie?
          • Yes. Companies will sell at the highest possible price they can get you to pay. If they don't have to lower prices, they certainly won't. Shoplifting causes considerable dents in profits to companies like Walmart, but if all shoplifting stops, Walmart's prices would remain the same.

            One certainty in life is a company like Walmart's greed.

            For another thing, why should you care about keeping the price down when you shoplift?
          • Good boy, keep doing what they tell you and you'll be okay.
    • We should *NEVER* allow the government to collect finger prints of citizens en-mass.

      Why? Because once they are in a database, you WILL be a suspect EVERY time a fingerprint is run at every crime scene. It *WILL* be used to track your movements, eventually, whether you believe it or not. And once they are collected, they will *NEVER* be removed from the database, regardless of any change of law.

      Fingerprints are left all over the place all the time. They can be searched without the person's knowledge or
      • Minority Report actually featured iris scans, not retinal scans (which are scans of the retina, not retena). But by all means, feel free continue to lecture the "sheep".

  • 4th Amendment violation? (Score:4, Insightful)

    by Antony-Kyre ( 807195 ) on Sunday February 05, 2006 @03:23PM (#14646710)
    I'm not so sure if it's legal to mandate that the employees give up their fingerprints like that.

    Below is the part of the 4th Amendment in which I am referring. Aren't our fingerprints considered to be part of our property? Isn't mandating that they collect our fingerprints without being suspected of a crime an unreasonable search? (It's one thing to do a background check and ask for fingerprints. It's another thing to require your fingerprints be on a card you have to carry around.)

    The right of the people to be secure in their persons, ... against unreasonable searches and seizures, shall not be violated,

    • Re:4th Amendment violation? (Score:4, Insightful)

      by NewbieProgrammerMan ( 558327 ) on Sunday February 05, 2006 @03:55PM (#14646803)
      I'm sure there's a good chance that the 4th amendment can be reinterpreted by the Supreme Court to find that the federal government is empowered to require almost anything of federal employees. And an even higher chance that a team of federal lawyers can write reams and reams on how there's nothing to worry about unless you're a terrorist.

      <dons flame-retardant suit>

      Of course, even if it doesn't officially get interpreted that way, US Presidents seem to be able to get away with doing things that they aren't empowered to do (except receive blowjobs in the Oval Office and tell G. Gordon to break into Democrat headquarters). After all, it's just a goddamned piece of paper!
      • Wow, yet another Slashbot who apparently has never read the U.S. Constitution. What a shock. For your education, and hopefully hundreds of thousands of other clueless Slashbots worldwide:

        Amendment IV

        The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or
        • Actually, the word unreasonable was meant to apply to the standard required to obtain a warrant.

          The theory in the constution was that NO search would be carried out by the federal government without a warrant.

          This has, of course, been thouroughly perverted today.
          • Actually, no it wasn't, it was meant to apply to the searches and seizures themselves. It was ten left to juries to determine if teh search was unreasonable or not. The language is very clear here, as it is throughout the entire doucment, being argued completely before all state delegates would agree to its terms. There was no spirit of the law because there was no room at the time the Constitution was written for spirit of anything. If it wasn;t spelled out clearly then it was gong to fail utterly. Th
      • Well, it's not really the President; he just signs the laws. Congress can pass whatever law they damn well please, constitutional or otherwise. The strength/weakness of judicial checks are such that the S.C. can only review laws, and only when a legitimate case is brought before it. The effect is that it can take years (although it can be much quicker) for an unconstitutional law to be struck down. Further multiply that with the difficulty in bringing a suit against the government to court at all, and t
    • You are not 'giving up' anything. You are simply recording your identity, like you already have several different ways just to be hired in the first place.

      They are not requiring this to live in the US, or a certain posh suburb. They are requiring this to work for the government and be party to some information, regardless of how public that information actually is. If you don't want to record your fingerprints (an utterly harmless and costless procedure for the participant) then you can just not work the
      • Is there a point that invades privacy too much? I'm sure there is. Fingerprints, retical scans, and other harmless, non-intrusive collections of data are not in that list. They aren't consenting to a wiretap or letting the government read their mail/email, they are just proving they are who they are, daily, with little hassle.

        I heard almost that exact quote said to me almost 15 years ago, only they were saying they were sure that updating your residence info to the DMV wasn't it, after all it is not lik
    • They aren't making you do it. You can do it if you want to participate in the government job, which would be a privilege, not a requirement.

      For instance, I worked on an Airforce base, and had to get a security clearance, they took plenty of fingerprints and other things, as well as interviewing family, girlfriends, teachers, etc. They also monitor your credit, and other such things.

      Of course I was giving up almost privacy, but this was a choice I made to work on a peice of software which was classif

  • Static bad; biodata static :. biodata bad. (Score:4, Insightful)

    by Errandboy of Doom ( 917941 ) on Sunday February 05, 2006 @03:25PM (#14646715) Homepage
    Aren't static keys always inferior to dynamic keys?* (Isn't that why we're supposed to regularly change our passwords?)

    Isn't biometric data static?

    So why is anyone interested in biometric security?

    Isn't it (perhaps counterintuitively) an inherently insecure means of indentification, by its very nature?

    I must be missing something.

    *(Maybe this is because anything [www.ccc.de] can be duplicated and forged, given enough time. Changing your key a lot makes forging impractical?)
    • The only advantage biometric data has is that the user cannot lose it or forget it.

      Other than that, if someone is watching you authenticate, it might be possible for them to see you using a fake finger or something.
      • i love it when people keep missing the difference between data and physical things.

        to "lose" a physical thing mean you don't have it and (maybe) someon else does, or it's missing

        to "lose" data means you do or don't still have it but someon else certainly does have it

        this an important, and subtle difference, and why there is such a huge series of arguments over IP

        saying that one "can't lose" biometric data misses the OP's point. one certainly can lose biometric data. if I put my fingerprints on the glass t
    • Simply, this is better than a card without the fingerprints. See:
      http://it.slashdot.org/comments.pl?sid=176330&cid= 14646699 [slashdot.org]

      for why it is more 'trustworthy'. As long as the data is signed and the data stored isn't sufficient to generate fingerprints from, a biometric card like this does a pretty good job of ensuring that the card was issued to a person with matching fingerprints.

      As far as biometrics providing 'static' versus 'dynamic' keys, if the card stores a salted hash of the actual data, then the k
    • Actually, some biometric data, fingerprints included, is not static, at least as far as much as the current reading technology is concerned.

      Over time, our fingerprints do change -- the lines become broader, for example. A system which is required for the entire population (children included) needs to be able to compensate for the fact that for nearly the first two decades of life, our hands are physically growing.

      In fact, many fingerprint systems start to fail after 6 MONTHS of deployment due to changes in
  • If you are, how is this any different than for example the generic attire/monkey-suit your employer expects you to wear?

    If you are not a federal employee and/or contractor, please have a sit and keep your mouth shut.

    Thank you.

    P.S. Why does everything on slashdot has to be blown out of proportions?
    • P.S. Why does everything on slashdot has to be blown out of proportions?

      Because whether the information is right or wrong, Slashdot makes money on the page views. They're not the drug dealer. They're not the cop. They're the informant that makes money from both sides.
    • Yes, I am a US government employee, and this does bother me. I can honestly say that I was not aware of this change to ID requirements before reading this thread, and will distribute this thread to my colleagues at work, whom I believe would also be bothered by it.
  • NIST has published the biometric data specs on the new Federal ID cards

    So much for security by obscurity! C'mon people, haven't we learned anything from Microsoft's security model??? /end_sarcasm
  • What happens if someone reverse-engineers the technology to get my fingerprints out of my card? Am I going to be charged for any crimes this person then goes and commits with my prints?
  • Shoot... people are still the weakest link in any security system involving semi-intelligent primates. Even if TFA is talking about merely ID'ing someone accurately, there will always be a system to circumvent "the system."

  • Minutia Templates (Score:5, Informative)

    by Epicyon ( 777863 ) on Sunday February 05, 2006 @04:01PM (#14646818)
    What is being stored is the mathmatical representation of the fingerprint, not an image of the fingerprint itself.

    It is not possible to recreate the image of a fingerprint from the template. [identix.com]

    • What is being stored is the mathmatical representation of the fingerprint, not an image of the fingerprint itself.

      True. To get the image of the fingerprint, it is much easier to actually lift it from the surface of the card, since the owner has probably touched it before you stole it.

      Since you leave your fingerprints on anything you touch, are you going to wear gloves 24/7 when you get your biometric card to try to keep your fingerprints "secret"?

  • You can't get the fingerprint out of the card (Score:1, Informative)

    by Anonymous Coward
    What is stored for biometric data is not an image of the fingerprint or anything like that. It's actually a hash of your fingerprint. Ideally, it would be a one-way hash (such as a cryptographic hash of your password stored in the .shadow file on a linux box). It should be "hard" (in the CS/math sense of the word) to find an actual fingerprint that will recreate the hash.

  • Project website (Score:5, Informative)

    by Midnight Warrior ( 32619 ) on Sunday February 05, 2006 @04:53PM (#14646982) Homepage
    For those seeking to follow the actual PIV program for federal employees/contractors, check out their home page [nist.gov].
  • It really doesn't matter how secure the card system is. Why would I try to crack the card when I could just offer a small sum of money to the nice lady working the security desk, and making the cards?

    Or if she's got too much integrity for that, I suppose I could just kidnap her son/daughter? I'm quite confident she'd make me a card then. And I didn't need any technical skills either.

    Maybe I just catch all the security guards while they are at lunch and bribe them to go ahead and let me in without a
    • > Why would I try to crack the card when I could just offer a small sum of money to the nice lady working the security desk, and making the cards? Or if she's got too much integrity for that, I suppose I could just kidnap her son/daughter? I'm quite confident she'd make me a card then.

      Because the PIV system is designed so that a single corrupt person in the chain can't wind up issuing a valid credential. The person who sponsors your application is different from the person who collects your biometric

  • Just the fact that such a standard even exists is rather scary.

    Who wants to take odds on how long before these ID cards are made manadatory for all US citizens? "for our safety".
    • Here, for perhaps the first and only time, you may be lucky that your country is run by fundamentalist Christians. The same logic that drives them to kill abortionists and ban good science also tells them about the Mark of the Beast. Whatever the mark was supposed to be, its aim was exactly the same as the aim of a mandatory ID card: centralisation of control.
    • Like Drver's Licenses are now? Oooooo, no Big Brother is watching me.
      • At least those are state based, and not used to track your day to day movements.

        Yes i know there is talk of going to a federally based ID instead, with realtime tracking of citizens. But we arent there, yet.

  • Cart before the horse (Score:2, Insightful)

    by schwit1 ( 797399 )
    This card is supposed to contain fingerprints as an important part of ensuring a person's ID, but as far as I know there is NO federal standard for matching/comparing fingerprints. The boondoggled Mayfield case should be proof enough that as fingerprint IDs are not ready for prime time.

    Lessons From The Brandon Mayfield Case [nacdl.org]

    • > This card is supposed to contain fingerprints as an important part of ensuring a person's ID, but as far as I know there is NO federal standard for matching/comparing fingerprints.

      There's no mandated matching algorithm, but there are minimum performance requirements for fingerprint authenticators before they can be certified. See NIST SP 800-76 [nist.gov] [PDF] for details.

  • What stops me from making a fake ID card, that says I'm somebody else, but with MY fingerprints encoded in the card. So, when I go to use the card, they look at the fingerprint data on the card, compare to my actual fingerprints, and suddenly I've "proved" I'm the right guy.
    • > What stops me from making a fake ID card, that says I'm somebody else, but with MY fingerprints encoded in the card.

      The fingerprint minutiae templates are digitally signed and protected by a PIN, and the cards are only issued by approved PIV Issuers who have to get all of the data used on the card through a secure network that you wouldn't have access to. And even if you did, you'd have to corrupt at least two of the major players in the issuance process in order to create a fake card.

  • I think biggest problem with having biometrics "on-card" is that it is impossible to guarantee authenticity of the data. We are comparing person finger with finger stored on the card. Without communicating with some sort of centralized facility, we only can confirm that these two fingers match. One may argue that data can be signed with some really long certificate/key (as they are in NIST standard). But then you will need to verify certificate, which in turn will require "... communicating with some sor

  • It's nice to see our government working to make this vision [theonion.com] a reality.

  • They can put my two middle fingers on the card.

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close