News for hackers. Stuff that matters.

A comment on Goodbye, Password. Banks Opt to Scan Fingers and Faces Instead. Parent comment

Re:Goodbye, Password. Banks Opt to Scan Fingers and Faces In... by zo1 on Tuesday June 21, 2016 @07:33PM (#11950346)
They store "minutiae" (sort of like keypoints) of the scanned fingerprints. As far as I know, there are no known methods of reliably hashing fingerprint/iris data.

The problem is the scanner/input-device. Unlike a password, the "input" is not always constant in what it gives you. So the resulted "hashed" value is not something you can "hit" again in order to do matching.

[ Parent | on HN ]
Re:Goodbye, Password. Banks Opt to Scan Fingers and Faces In... by _red on Tuesday June 21, 2016 @07:42PM (#11950391)
Some fingerprint drivers (like DigitalPersona) allow you to change a preset value that acts as a "salt" for the minutiae.

Obviously this salt must be shared among all installations of the driver for the results to be consistent.

However the end result is that you are not storing raw minutiae but its salted variant.

[ Parent | on HN ]