Possible to use thumb scanner to login to web application?

Question

Is it feasible to allow users to login to my web application (php/mysql) using thumb scanner? USB scanners seems available and not too expensive, but has anyone got experience with it? How to make it work with php so users instead of filling in regular username/password fields would actually be able to login by scanning thumb. Are there any opensource/relatively cheap solutions available? So far I found http://www.m2sys.com/ which looks pretty decent but is a bit expensive, considering I would need to provide initially ~400 users with scanners and all that.

Answer 1

This would be quite a bit less secure than what they're normally used for, though it could be useful.

You would have to write a client-side app that could communicate with the scanner, or some way for the scanner to get the fingerprint data and then pass that to the server.

However, this is where you really want (need) to do some security. You don't want to just send someone's fingerprint across the internet - that's like sending a password in plain text. Now anyone who was listening can tell you the fingerprint data and hey! logon!

A "better" way would be to have a client-side app that reads the scan data, performs some type of fingerprint analysis, then encrypt either that data or a hash and then send that information across the net.

It's probably a lot more difficult to do a secure bio-key authentication in this scenario - there are others in which it's a better fit. User/pass pairs are ubiquitous so that everyone is used to them (and 90% of your users probably use the same pair everywhere they go), and security to keep them confidential is fairly robust and relatively simple. That's what I'd stick with - it's easier for you, and easier (more familiar) for your users.