Here we go again (from Will biometric security harm users?):
Most worrying is the fact that biometric parameters are largely permanent. This is a limitation, not an advantage – if someone learns your password, you can change it, but you can’t change your fingers if a criminal manages to replicate your fingerprint.
This is probably the biggest fallacy about biometrics – that the authentication strength of biometrics comes from the same source as passwords. But anyone who watches CSI knows that biometrics are not secret (which is the source of the password’s strength). In fact, biometric evidence is everywhere (it can get pretty disgusting if you think too much about it).
Biometrics get their authentication strength from uniqueness. That is, if one can present his or her biometric information to a system securely, then it can be used as an authenticator. No need for secrecy – just a system that has accounted for any of the various approaches to "stealing" biometrics. And (here’s the kicker), if a new compromise is identified, then once the system is fixed, the biometric becomes "strong" again.
Obviously, this brings up a different type of problem unrelated to "stolen fingerprints" – that of system failure. Of course, password authentication solutions have this same problem.
I’m not quiet clear about your argument against “stolen fingerprints.” Suppose someone stole your fingerprint and can duplicate it at will. How would you fix the system?
First, they don’t have to “steal” my fingerprints – I am happy to leave them lying around on anything I touch.
But It’s the “can duplicate it at will” part that is a dubious point. What happens is that forgeries are made using jello molds are whatever. The system that is interpreting my fingerprint, then, must be able to tell the difference. If it can’t, then the whole idea of biometrics must account for the potential for forgeries, not because of secrecy, but because of the ineffectiveness of the solutions.
My point is against the silliness of suggesting that “you can’t reset a fingerprint like you can a password” – if you go into it thinking that this stuff is secret, then your system design is going to be off anyway.