"Using our fingerprint is not a secure way to do [authentication]," Professor Susilo said. "It's just like a gimmick."Vein scanners are, in fact "more secure" in the sense that there is no latency. You can't leave vein prints behind. But that doesn't mean that fingerprints are a gimmick.
One of the main benefits of vein and iris scanning is that you don't tend to leave behind iris or vein prints, he said.
As most vein scanner sensors coming out this year require no physical contact, it means there are no residual biometric patterns that could be copied, preventing fraudulent use.
Fingerprints are notoriously easy to lift from surfaces and are not secure, he said, which has been demonstrated by researchers for more than a decade.
In 2002, Japanese researchers showed that fingerprint scanners could be fooled with about $10 worth of household supplies. They also found many fingerprint systems did not detect if someone was "live and well".
To take the professor in his own terms, how much money worth of household supplies are required to access an unsecured mobile device? How much money worth of household supplies are required to access a device secured by a password? How easy is it to apply the $10 worth of household supplies to cracking the phone? The answers: None, None, Not very. It really isn't that easy to spoof fingerprints without the participation of the person whose fingerprint is enrolled.
Vascular biometrics, on the other hand, have no latency. Nobody leaves behind vein prints. But hardware cost (too expensive) and form factor (too large) disqualify vein sensors' use in mass market mobile devices*. Until about 6 months ago this was true even for fingerprint readers.
*In mobile devices, power consumption is also a big concern. I don't really know if vein readers are power hogs or not. Perhaps the likely infrequency of vein sensor use compared to the screen or audio output means power requirements won't end up being the determining factor for vein reader deployment anyway.
