Wednesday, November 26, 2014

Chip-level vs. App-level security

They're not the only ones — Intel, McAfee working to eliminate passwords by using biometrics (PC World)

Where one deploys a particular security feature can be an interesting call. For computers, most biometrics are deployed somewhere in the software at either the OS (operating system) or application layer. That makes a lot of sense in terms updates and trouble-shooting, but there are more secure approaches.

Is Intel/McAfee looking closer to the chip for the sweet spot to apply biometric ID for access to the computer? This would make a lot of sense, too. It's very secure but it does foreclose some user support options. If the security is in the hardware, it really has to be completely reliable.

A useful metaphor might be a Microsoft update versus a product recall.