To: Buck who wrote (8452 ) 5/22/1998 10:58:00 AM From: David Respond to of 26039
Completing the "smart card" biometric market cycle . . . I want to take this thought one step further. As noted earlier, biometrically protected smart cards are being produced in pilot with generic minutiae-based fingerscans. It shouldn't present a privacy problem at the early stage of the market -- point of sale terminals and ATMs -- but can be problematic when smart cards are integrated into computer networks. Ironically, IDX is producing new Touchsafe Personals with a smart card reader option where the biometrics are kept in the Touchsafe and the PC itself, rather than on the network the PC is connected to. In that situation, not only are APIs not needed (since the digital certificate process doesn't care what biometric is being confirmed), but non-minutiae based fingerscans are also not required to achieve a high degree of security. In other words, the PC-based system is not far removed from the "pocket" those Fort Sill recruits are using in the Identicator pilot. You could still only crack the biometric one at a time, computer by computer, and that just isn't a security threat. However, when smart cards become more universal, each card will be used in POS and ATM terminals, and both PC-based and network server-based environments. Then, the user will have to worry about the greater risks of server-based e-commerce biometric solutions. In other words, the ultimate need in smart card biometrics, despite a lot of use outside computer networks, will be to have the most secure algorithm possible. Again, IDX will be able to promote its pattern recognition technology. I think we are catching up to Fowler's thinking on this subject. While Identicator may have a price and availability advantage at the moment, by the time the market is maturing IDX will come to the fore.