What's wrong with biometrics

Banks need to implement two-factor or multi-factor authentication for online banking by the end of the year. What concerns me is the idea that biometrics is somehow going to solve the problem of identity theft and bank fraud. Let me lay it out for you.

Identity theft is the problem of the customer. Seriously. The customer is responsible for guarding his or her personal information while it resides in their possession: on a laptop or home computer, in a wallet, in a briefcase, in a PDA, etc. The customer is also responsible for ensuring the security of that data over the Internet (that is why we have personal firewalls, anti-virus, anti-spyware, and only send our information over encrypted sessions - https://).

Identity theft is also a problem for the bank because it leads to bank fraud. Someone charges thousands of dollars to your credit card or uses your ATM Visa/MC card to deduct same from your bank accounts. Someone approved those charges. Recent reports tell us that most of these fraudulent charges occur over the web, after the information has been stolen using a variety of methods. The bank has to give you your money back if they offer this type of security guarantee.

Transaction authentication is a huge problem for vendors and that is another topic altogether. Stay with me.

Bank fraud occurs when someone defrauds the bank of money. This might take the form of having to reimburse a customer for stolen funds without being able to recoup the loss.  There are many examples of bank fraud, but not pertinent to the point I'm going to get to. Suffice it to say that biometric authentication has been touted as solving both problems: identity theft and bank fraud.

The problem with authentication in general is that any customer supplied credentials can be spoofed by a criminal, especially a sophisticated one. It doesn't matter if it's your user name (login), password, pin, thumbprint, retina scan, or your mother's maiden name. It's all the same - information stored in a database. The "authentication" occurs when what you enter is succesfully matched against a database record. Sounds like database security becomes the paramount security focus, doesn't it?

So let's pick on that little fob you have to carry around too. A randomly generated number is provided when you push a button on the fob or hardware token. You enter that number within a certain time period. If that number matches the same number generated by the server, you're in. I slightly understated how it works, but the point is the same. If I get your fob, I get to push the button.

Authentication is not the only problem. There are several factors that come into play in this discussion.
The security of the banking infrastructure
The security of online banking
The security "behavior" of the consumer

Let's take the first one - banks understand how to protect their networks, servers, databases, ATM machines, and facilities. Check. Insider threats are their biggest concern.

Now, the second one - banks have absolutely no control over what goes on in the World Wide Web. Banks have to do something, so they might send their customers a hardware token, a thumbprint scanner, or institute some type of challenge-response question type of scenario. In any case, this is not going to cut the mustard.

The security behavior of the consumer is improving - vastly. Thanks to news stories and security awareness campaigns on every front.

The only thing biometrics brings to the table is another layer of authentication. One security colleague of mine refuses to participate in any type of biometric authentication. He says that you only have one thumbprint, one retina profile, etc. Once that information is compromised - it's compromised for life.

I am not sure what the answer is. But, I am afraid that confidence is being lost, if there was any. I am also investigating some alternative ways of solving the problem with the security of online banking. I think we may be looking at the problem backwards.