This seems like a bad idea. How do you protect against spoofing? Seems inferior to traditional smart cards and private key crypto.

Just read it, they explain - those MIT peeps are pretty smart. There is no stored secret to spoof or stored hash that could be accessed and to bruteforce, it uses hardware measurments that are in unique pairs due to the manufacturing process. Like two halves of a cracked stone, only the original two will fit together perfectly.

Its not intended for replacing every current security methodology, they give only a few examples of what it could be used for - or it might never come to market, it's just interesting research at this stage.

The technique could be useful in power-constrained electronic systems with non-interchangeable device pairs, like an ingestible sensor pill and its paired wearable patch that monitor gastrointestinal health conditions. Using a shared fingerprint, the pill and patch can authenticate each other without a device in between to mediate.

“The biggest advantage of this security method is that we don’t need to store any information. All the secrets will always remain safe inside the silicon. This can give a higher level of security. As long as you have this digital key, you can always unlock the door,” says Eunseok Lee, an electrical engineering and computer science (EECS) graduate student and lead author of a paper on this security method.