Biometrics: New IDs that are uniquely you.


Forget fingerprints: In the near future eyebrows or heartbeats may become your new IDs

Scientists are developing new ways to identify people based on unique aspects of their anatomy, from muscles in their eyes to unchanging structural features on their face.

Savvides lab, Carnegie Mellon University

On April 18, 2013, the Federal Bureau of Investigation released blurry photos of two suspects at the scene of the Boston Marathon bombing. Marios Savvides and his team quickly tried to identify them.

Savvides works at Carnegie Mellon University in Pittsburgh, Pa., as a scientist specializing in pattern recognition and signal processing. He creates special software that can identify people in digital images. As he and his fellow experts began sifting through the FBI pictures, they faced a challenge. Even the best picture of one of the suspects “was extremely low-resolution,” Savvides recalls. “It was blurred, off-angle and he was wearing a hat.”

Still, the team worked through the night. Using their experimental face-recognition software, they enhanced the photo. In the morning, they sent it off to the FBI. By that time, law enforcement already had identified the two suspects. “Still, after the fact, we saw our reconstruction was pretty darn good,” Savvides says.

Today, he is working to make the software even better. To do this, he and his team are using something called biometrics. It’s a relatively new field of technology, Savvides notes. The name explains it all: “Bio means life,” he says. “Metrics is about measuring.” So biometrics measures features or characteristics — individually or in combination — that are unique to some person. No one else will share exactly the same features.

The four images at left show the same fingerprint. The images are all slightly different, depending on the wavelength of light reflecting back from the blood vessels below. Each image is combined to create an accurate fingerprint, shown at right.

LUMIDIGM

Fingerprints probably represent the best-known example of a feature useful in biometrics. Others include the iris (the colored muscle in the eye) and the face. Biometrics engineers are looking to find still more. Any feature of the body with a unique shape, size, texture or pattern — and that can be read by biometric technologies — potentially can be used to identify someone.Rapidly and accurately identifying people is useful. The police sometimes use biometric technology to ID criminals, disaster victims and missing children. Bank tellers may use biometrics to verify the identity of anyone attempting to withdraw money from an account. Because of the usefulness of biometric technology, governments are starting to include fingerprint and other biometric data in driver’s licenses, ID cards and passports.

Research on biometrics is advancing rapidly. Here we meet researchers behind three teams developing new ways to ID people. Their work is leading to the creation of electronic devices and security systems that one day may recognize us almost instantly and effortlessly.

Lego lessons

Savvides’ specialty is facial biometrics. He creates step-by-step instructions, called algorithms, for a computer program to follow. The instructions tell the computer how to fill in the parts of a face that either don’t show up in a photo or are too low-quality and blurry to recognize.

“Let’s say the face is made up of Lego blocks,” says Savvides. “You can create an algorithm that knows which Lego blocks to use at what location.” For instance, the first line in a set of mathematical instructions written by Savvides might tell the program to place two small, dark green blocks in the center. They would represent the eyes. The second line might tell the computer to add 103 large light beige blocks in an oval pattern around the edge. These blocks would represent the outline of the head. The result will be the building plan for a simple biometric signature of the face.

Using a powerful computer, Savvides designed one algorithm that can enhance a small and blurry face. It automatically generates a larger and more detailed image. He taught the computer program to do this by having it compare thousands of matched pairs of faces. Each pair included one blurry image and one sharp image of the same face.

Now, when Savvides scans a new blurry face into his computer, his algorithm applies the lessons it had learned earlier from analyzing those thousands of matched pairs of photos. In short order, the program pops out a sharpened version of the once-blurry face.

Iris scanning from up to 11 meters (36 feet) is possible with a system being developed by Marios Savvides’ team. A camera system in the silver cylinder (left foreground) collects details within four seconds on the face and the iris in each eye (green box shows covered area). The eye’s iris is unique to each individual and does not change with age, making it a great ID.

SAVVIDES LAB, CARNEGIE MELLON UNIVERSITY

The enhanced version may not be an exact likeness of the person in the photo. Still, it’s usually close. Certainly, it can be close enough for police to use in comparing against clearer photos of possible suspects.”We have a long way to go before we start trusting computers 100 percent,” says Savvides. “We still want humans involved in making the final identification.”

He has used the same compare-and-match technique to teach a computer to turn a two-dimensional photo of a face into a three-dimensional one. That means instead of seeing a face just from a single angle, law enforcement officials now can rotate and turn that head on a computer screen. This allows them to view the face from any angle — including the same angle as the face in some photo. Now the police can make a 2-D view of this rotated face and see if it matches the person in the original photo.

Savvides even has a strategy for taking into account how faces change as people age. Imagine the police are looking for a young man missing since childhood. The only photograph they have was taken when a boy was just 12. Now he is 25 — and police think they have spotted him in a recent photo.

Savvides’ research shows that eyes and eyebrows stay the same over time, so he asks the computer to match just those features in the two pictures. Since the computer is not looking at the entire face, any match may not be foolproof. But it could narrow down the number of candidates.

And if the photos reveal a clear image of the iris, a computer will have even better luck in matching the man to his 12-year-old self. The colored muscle surrounding the pupil of the eye is much more detailed. It also is unique — and won’t have changed as the boy grew into a man.

In fact, the pattern of light reflected by the iris never changes. That is why its pattern forms the basis of some security locks. (The technology often shows up in movies and television programs.)

Putting your heart into it

Biometric programs that rely on facial features are among the most common ways to identify people. But Foteini Agrafioti and Karl Martin are developing a system that would work even if no part of the body were visible. You might say they are taking biometrics to heart. Their technology works by measuring a heart’s electrical patterns.

Readings of the electrical signals given off by the hearts of three different people. The Nymi wristband includes sensors that read these patterned signals. Since your heart rhythms are as unique as you are, the wristband can use it as a biometric password.

COURTESY OF BIONYM INC.

In 2011, the two engineers created a wristband called Nymi (NEE-me) that measures the electrical signals created by its wearer’s heart. The signals match the rhythm of the heartbeat. And these are unique to each of us. That makes them useful as a sort of biometric password — the type that can allow someone to log onto a computer. No need to remember a complicated password that contains a string of letters, numbers and other symbols.The engineers came up with the idea when they were getting their PhDs — Agrafioti in electrical and computer engineering, and Martin in engineering science — at the University of Toronto, in Ontario, Canada.

Their wristband includes sensors that read the electrical signal a heart gives off each time it beats. That reading is called an electrocardiogram, or ECG. It’s the same test that hospitals use to monitor a patient’s heart.

The ECG measures the shape of a heart’s electrical signal. When your heart beats fast — such as after a run — the signal will constrict and repeat faster. But its shape stays the same.

When you sit down to work, the wristband can wirelessly transmit that shape to your computer. There, a computer program can compare the pattern to one previously stored on its hard drive. Only if the two match will the computer log you on. And you stay logged on until you take off the wristband — or walk away.

In 2011, Agrafioti and Martin founded a company in Toronto called Bionym to sell the wristbands. Sales should start late in 2014. The $79 wristbands are being designed for use with tablets, cell phones and computers.

In the future, the engineers hope their wristband will open all sorts of doors — literally — for wearers. One day it might allow homeowners to unlock the door to their house or their car. It even could be used to withdraw cash from an ATM.

The Nymi wristband has sensors that read the unique electrical signal your heart gives off each time it beats. That signal can let you to log onto your computer without having to type a password.

BIONYM INC.

Martin says the goal is to create a single wearable item to replace all the smart cards, keys and passwords people now use. All of these tools allow us to let technology know who we are, Martin says. “It’s not only easier, but also more interesting to create a single technology that a person can wear on their body” to replace all of those separate objects.And finally, stealing the wristband would do a thief no good. That’s because it is someone’s heartbeat, not the wristband, that would actually unlock something.

‘Fingerprints’ from blood vessels

But using a heartbeat to identify someone is a relatively new form of biometrics. Fingerprints have a much longer history. Police have relied on them to help catch criminals for at least a century.

The ridges on our fingertips create unique patterns that don’t change, even as we age. These ridges contain tiny pores through which we sweat. That means each time we touch something, we leave behind a little sweat in the pattern of that print.

When investigating a crime, police often look for fingerprints. Investigators can capture an image of a print by taking a picture of it. Or they can transfer a print to a piece of sticky tape. Later, if a fingerprint lifted from the scene of a crime matches one on file, police know that person was at the scene. Then they can start investigating whether that person might be the criminal.

Using fingerprints to identify someone has its limits. It can be hard to get a good print from people who have worn down the skin on their fingers after years of working with rough materials, such as brick or stone. It also can be hard to get good fingerprints from young children. Their ridges are just too tiny and narrow.

Rob Rowe has designed a hand-held fingerprint scanner that solves these problems. An optical physicist, Rowe studies light and how it interacts with things.

Light travels through the skin to the blood vessels below. The blood in them scatters and absorbs the light in different patterns, depending on its wavelength (color). The pattern of those blood vessels matches the fingerprint above them.

COURTESY OF LUMIDIGM

The scanner looks like a tall computer mouse with a finger-shaped pad on top. When someone places a finger on the pad, different colors of light illuminate it from below.

Each color (wavelength) of light travels harmlessly through the skin into the finger. The light travels all the way to the blood vessels. Those vessels scatter and absorb the light in different ways, depending on the wavelength of light that had been used.

As each wavelength of light bounces back to the scanner, it creates a pattern tracing out the blood vessels within the finger. The scanner then puts together all those separate images to produce a single, master pattern.

“It turns out blood vessels and other structures below the skin have the same shape as the fingerprint on the surface of the finger,” says Rowe, who helped found a company to sell the scanners. So an image of those vessels is just as good as a fingerprint, if not better.

Beyond law enforcement

VaxTrac is an organization based in Washington, D.C. It works around the world to help poor and developing countries do a better job of vaccinating children. In 2013, it started using Rowe’s fingerprint scanner in the West African country of Benin.

Health workers there have so far scanned the fingers of more than 20,000 children. The kids are not suspected of crimes. Instead, their prints reveal whether they already have received vaccines against life-threatening diseases.

The fingerprint scanner sends a message to a central computer. Inside the computer, a database contains information about what vaccines a child has received and when. The “username” for each medical file is the child’s fingerprint. Health officials tap into this file, using the fingerprint scanner, to accurately identify which children still need vaccinating — and which don’t.

“Without a record of a child’s vaccination, we usually re-vaccinate them,” says VaxTrac project manager Meredith Baker. “Using the scanner, we don’t waste vaccine.”

A health worker prepares to scan the finger of a Ugandan boy to find out if he has been vaccinated. The device reads the pattern of blood vessels underlying the arches, loops and whorls of the boy’s fingerprint. The technology uses that biometric information to determine whether children have already received life-saving vaccinations.

COURTESY OF VAXTRAC

Using biometrics to keep kids healthy, log onto electronic devices and catch criminals are important applications. But all three teams already are looking to other uses. They want to refine their research for use in exciting new applications.

Savvides, for example, dreams of smart robots that do our bidding, before we even ask.

“We eventually want to use facial recognition in robots that can identify who you are. How cool would it be to have a robot that could say, ‘Hi Marios, how are you doing today?’” It also would know your every preference. After recognizing you, a robot butler could let you into your house, adjust the air temperature and put on your favorite music.

“That’s how I see biometrics being used in the future,” he says. “It may seem far away. But some day it will happen.”

Power words

algorithm  A group of rules or procedures for solving a problem in a series of steps. Algorithms are used in mathematics and in computer programs for figuring out solutions.

ATM  (short for automated teller machine)  It is a stand-alone machine communicates with banks over the Internet. Depending on the ATM unit, some just dispense cash from a person’s account or from a line of credit offered to them by a credit-card company. Others accept cash deposits and give read-outs of how much money an individual has in a checking or savings account.

biometrics  A group oftechnologies used to identify people on the basis of measuring biological features that are unique to them. Fingerprints are a prime example of a biometric technology.

electrocardiogram  A test (or the readout of that test) that records electrical signals moving through your heart. This assay is usually abbreviated as an ECG or EKG test. Special cells in the upper right chamber of the heart emit these signals, which trigger the heart to beat.

iris  The colored part of the eye, surrounding the pupil. The iris is a muscle.

optical physicist A scientist who studies electromagnetic radiation and how it interacts with matter. Visible light is a form of electromagnetic radiation.

tablets  (in computing)  A small, hand-held computer that can connect to the Internet and that users can control using a touch screen. An Apple iPad, Samsung Galaxy and Amazon Kindle Fire are all examples of tablets.

two dimensional(or 2-D)    Something that is portrayed on a planar surface, meaning it has height and width, but no depth. A photo, for instance, is a two-dimensional representation of something in the three-dimensional world.

vaccine  A biological mixture that resembles a disease-causing agent. It is given to help the body create immunity to a particular disease.

wavelength  The distance between one peak and the next in a series of waves, or the distance between one trough and the next. Visible light — which, like all electromagnetic radiation, travels in waves — includes wavelengths between about 380 nanometers (violet) and about 740 nanometers (red). Radiation with wavelengths shorter than visible light includes gamma rays, X-rays and ultraviolet light. Longer-wavelength radiation includes infrared light, microwaves and radio waves.

Hello, is that really you?


Big business wants your voice – not for customer feedback, but to tackle fraud.

Voice biometrics – the recording and analysis of unique voiceprints for authentication purposes – is one of the latest technological weapons being deployed in the war against fraudsters, thought to be pilfering at least £52bn from the UK economy each year, according to the National Fraud Authority (NFA).

Man in mask

UK financial services companies alone are conservatively estimated to be losing more than £5bn annually, the NFA says.

But the real figures are likely to be two or three times higher than this as so much fraud goes unreported.

Identity theft and account takeover are a big and growing problem, particularly in a digital era that has been a boon to fraudsters by presenting them with many more ways to harvest personal data.

Dynamic

The main advantage of voice is that it is much harder to spoof and steal.

“Voice is a dynamic form of biometrics, rather than static like a fingerprint, so it is harder to replicate and copy digitally,” says Emmanuelle Filsjean, global head of marketing for ValidSoft, which advises retail banks on security and helps European governments tackle cross-border benefit fraud.

Digital voiceprints contain over 100 identifiable elements. And, by using complex mathematical algorithms and the latest high-definition audio equipment, voice biometric companies believe they can now identify people accurately more than 97% of the time.

Even identical twins, who share the same DNA, can be told apart from their voiceprints, making the technology reliable enough to be used as evidence in courts of law.

Failing

Voice is crucial because call centres are still the main way we interact with companies, despite the rise of online banking and shopping.

“Start Quote

Most financial institutions and big service providers around the world are actively considering adopting voice biometrics”

Almog Aley-Raz Nuance

Traditional authentication measures, involving personal identification numbers (PINs), passwords, and “memorable” answers to stock questions, have proved fallible, largely because we are fallible – we keep forgetting them.

This is why we choose ludicrously simple PINs and passwords that are easy for us to remember – and therefore for others to guess.

Fraud investigators have found that about 10% of four-digit PINs stolen by fraudsters are simply 1-2-3-4, while banks report legitimate customers failing call centre authentication procedures 10% to 20% of the time because they cannot remember their security details.

“You can’t forget your voice,” says Prof Levent Arslan, chief executive of Sestek, a technology company that helped Turkish mobile phone company Avea register one million voiceprints in a year.

Your voice is also easy to use.

Heads and babble
No two people sound alike – not even identical twins

“Using our voice is the most intuitive way of interacting,” says Ms Filsjean.

Test

While no biometrics security system is totally foolproof, fraudsters using high-definition recordings of someone’s telephone pass phrase should still be caught out, voice biometrics companies maintain, because even the highest-quality recordings use some form of compression that blunts the highest and lowest frequencies.

Even a slight mismatch with the customer’s voiceprint will trigger a “live test” conversation that is almost impossible for fraudsters to spoof, particularly if they’ve only got a recording to use.

Barclays‘ private banking arm, Barclays Wealth, claims great success after implementing voice biometrics.

Before introducing the technology, it found that 25% of fraudulent phone calls to its agents were able to bypass the bank’s security systems. Fraudsters using “social engineering” techniques – or blagging in the vernacular – were able to elicit security details from agents.

The bank would not disclose how much money was being lost as a result.

“Start Quote

This has profound implications for fraud detection

Richard Newton OP3NVoice

Barclays says that now the number of successful fraudulent calls is zero, because it uses technology from the company behind Apple iPhone’s Siri speech recognition system, Nuance, a leader in the field.

The voiceprints of suspected fraudsters are kept on a watchlist so they can be identified if they try again pretending to be someone else.

Tricky

Slovakian Tatra Bank is currently rolling out a voice biometric system that will authenticate customer identities while they are speaking to call centre agents.

About 10 to 15 seconds of natural conversation is enough to match the voiceprint with the one the bank has on record.

Turkish mobile phone operator, Turkcell, now has about 10 million customer voiceprints on its database.

“Most financial institutions and big service providers around the world are actively considering adopting voice biometrics,” says Almog Aley-Raz, head of voice biometrics for Nuance.

The tricky part is enrolling customers in the scheme, as different jurisdictions have their own privacy laws governing voice recording.

girl with bubble
Voice and speech analytics are finally getting a voice

“In many cases there is ambiguity around the collection and use of biometrics,” says Mr Aley-Raz. “But our best practice recommendation to our customers is to obtain consent for using the technology.

“Regardless of whether a given jurisdiction has specific provision for the use of biometrics, biometric data is personal, private, and should be treated with the same care as any other data of that type.”

Voice biometrics alone is not enough to combat fraud, however. Other technologies, such as communications data analytics, must come into play.

‘Profound’

All UK financial institutions have had to record phone calls for years, and this has led to gargantuan amounts of data sitting in servers, largely ignored. But now audio and video search software, coupled with sophisticated analytical tools, is making this data mountain much more easily accessible and useful.

“The enormously sophisticated technologies that dig into written communication are now being switched to the spoken word,” says Richard Newton, co-founder of OP3NVoice, a technology company specialising in searchable audio and video recording.

biometrics word cloud

“This has profound implications for fraud detection. Analysis of emotions, stress, sentiment, and meaning is a fast-developing area.”

What you say, how you say it, when, where and to whom, can all be weighted by algorithms that learn to spot suspicious or anomalous patterns of behaviour.

As Glenn Perachio, forensics specialist at accountancy firm Ernst & Young, says: “It’s like searching for a hay-coloured needle in a haystack, so you need to adopt techniques, such as machine learning, topic modelling, and geo-spatial mapping, to help narrow down the search for that evidence of malfeasance.”

Voice biometrics and speech analytics, it seems, are finally striking a true – and productive – note.

Time to forget your online passwords?


Passwords are either too hard to remember or too easy to crack. Paul Rubens considers some of the technologies that could replace them – including an edible, electronic capsule.

pw

The days of storing passwords in your brain are numbered. In a few years’ time you may be able to log into your online bank account using anelectronic tattoo on your arm, or a pill that, once swallowed, broadcasts a password through the wall of your stomach.

Functional prototypes of these products already exist. The tattoo has bendy and stretchy components—sensors and an aerial that lie flat on your skin. It works by the aerial transmitting your password to an electronic reader when you pick up your phone or sit at a computer. Stomach acid in place of battery acid powers the pill. This tiny device is being designed to pulse a code that would be picked up by a sensor in a laptop, shortly after it exits the oesophagus.

The motivation for developing such bizarre technologies comes from a widespread and growing problem: the existing authentication systems that log you into online services rely on passwords, and passwords aren’t really up to the job.

‘Nonsensical and unrealistic’

There are many reasons why. Passwords can be ‘phished’, which happens when users are tricked into revealing them to fake sites made to look like legitimate ones. About 50,000 unique sites get phished each month, which leads to online thefts totalling an estimated $1.5 billion each year. People also tend to choose passwords that are easy to remember. This means they are easy to guess. Of 32 million passwords revealed during one security breach, more than 290,000 turned out to be ‘123456’, according to Imperva, a Californian security company.

Moreover, when criminals hack into a online storeroom of passwords – a

service provider’s encrypted list of all of its users’ entry codes – they can crack potentially many thousands of passwords at once with the aid of special software. A password containing six lower case letters takes just a fraction of a second to crack in this way. But a longer and more complex one with 11 random upper and lowercase letters, numbers and special characters could take hundreds of years. It presents many orders of magnitude more combinations for the software to work through. The rule with passwords is simple: the more complex it is, the better the level of security it provides. But expecting people to remember long, nonsensical combinations is unrealistic.

Often, users pick the same password for many different services, which is ill-advised. If you sign up for an account on an unimportant website and that website gets hacked, your password could find its way into the hands of criminals who would then be able to access your online bank account. The problem is that people simply have too many passwords to remember, says Michael Barrett, Paypal’s chief information security officer. “When I talked to consumers ten years ago, they would tell me that they had four or five usernames and passwords to remember. Now they give me a glazed look, and tell me they have 35 of the damned things.” A typical adult between 25 and 34 years of age has 40 online accounts, according to a 2012 study by credit-checking firm Experian.

Random data

One way around these drawbacks is to beef up existing password-based authentication systems by providing more than one kind of hoop for users to jump through. This already happens when you use a number-generating security token, or have to input a random number that was sent via SMS to your phone. Paypal has offered this ‘two-factor authentication’ for some years. And recently, many other high profile internet companies such as Google, Apple, Facebook, LinkedIn and Twitter have included it for those who choose it.

Some companies are trying biometrics as a second authentication factor, taking advantage of the cameras and microphones in smartphones to carry out face or voice recognition—or even for iris scans. But many users worry that biometric data brings its own suite of concerns. Unlike passwords, which can be changed, voice prints and faces cannot. The worriers say that if cybercriminals were to hack a website and steal biometric information, the same information could forevermore be used to break into other accounts that rely on biometric authentication. This is unlikely, however, because fingerprint data is typically combined with random data to create a biometric based on your fingerprint. So any hacker that gained access to a scan of your fingerprint would not be able to break into a biometrically secured site.

But there’s a problem, even with two-factor authentication. While is makes life harder for criminals, users don’t like the extra hassle. “What we have found at PayPal with our security key is that if you market it hard you get a take-up rate of about 1-2%. If you don’t market it then only about 0.1% will take it up,” says Barrett. “Consumers just want to go out and buy things and they expect you to take care of security.”

Here, Fido

In the hope of making life easier for users, a few companies have created a consortium called the Fast Identity Online (Fido) Alliance. PayPal, Google, and PC-maker Lenovo, are among its founders. First and foremost, Fido aims to reduce reliance on passwords.

The Fido system’s specifications are still being developed, but what is clear is that it will work using a piece of hardware called an authenticator. Users will be able to enrol this at each website that they wish to log into. The enrolment process will involve the Fido authenticator and the website exchanging digital keys that will allow each to recognize the other.

As the user, when you visit a site from a PC with an authenticator connected—or perhaps a mobile device with an authenticator built in—you will still have to identify yourself. What’s different is that you will do so to your Fido authenticator, not to the website that you wish to visit. Once that is done, the Fido authenticator can vouch for you. Effectively, the device will tell the site “you know me because I can present a digital signature that proves who I am, and I can vouch for who is using me because I have authenticated them at my end”.

The researchers developing Fido authenticators intend them to work with all kinds of authentication: a simple PIN number, a fingerprint reader on a USB stick, or the camera on a mobile phone. The major benefit of this system is that no information will be stored remotely: the biometric data, or the PIN number, will remain on the Fido authenticator. And because it won’t be transmitted over the internet, this data won’t be stored on a remote site from which it could be hacked. The arrangement also avoids the need for a long and complex password to provide good security. If the wrong PIN is entered more than a handful of times on a Fido authenticator, the device would simply lock itself, as an ATM at a high street bank does today. Crucially, phishing could become a thing of the past because no one will ever need to enter a password on a website again.

Or would it? There are, of course, weaknesses in any system. In Fido’s case, the most obvious vulnerability is during the set up. To work properly, the Fido system will rely on you enrolling your authenticator at a genuine site. But what if you mistakenly enrolled it on a phishing site? “You have to go home or somewhere you trust when you register, and you need to be paying attention,” says Mayank Upadhyay, a security engineer at Google. “When you are fixated on another task and not paying attention, that’s when you end up getting phished.”

A second drawback of Fido is that it provides no easy means of revoking an authentication device that gets lost or stolen. A user would have to contact each site separately to cancel it, Upadhyay says, which would lead to the possibility of a hacker locking you out of your own accounts by impersonating you and revoking your device.

Creatures of habit

Perhaps Fido’s biggest criticism is that it still doesn’t achieve what PayPal’s Michael Barrett says users really want: for websites like PayPal to take care of security for them. For this to happen, online services may have to more frequently employ behavioural analysis. This kind of security can help verify that a password is being typed by the appropriate person, explains Kevin Bailey, a security analyst at IDC. Such systems examine vast amounts of data about people to recognize them based on their usage habits.

Your location, the internet address of the computer you tend to connect from, and even the time of day that you normally sign in, are all details that could be fed into an authentication analysis. Even your click stream—how quickly you type and how long you stay on different web pages for—could become a telling detail about you. If any of these factors gave a website reason to doubt that you are who you claim to be, it could block you from doing anything sensitive, like withdrawing large amounts of money from a bank account.

Bailey predicts that this approach, which he calls persona-based authentication, will take off. “The angle you hold a mobile phone, the way you key things in, the tone you use when you speak—even the ear you put the phone to and the height of that ear above ground,” could be used to add authenticating evidence, he says.

Ultimately, authentication is a problem that is unique to computers. Humans generally have no difficulty recognising other people with whom they already have a relationship, which is why no one demands a password from their spouse or children before letting them in the house. It is also why researchers are unlikely to develop easy, reliable authentication systems for online services until computers can be programmed to learn like people, Bailey says. “Self-learning and artificial intelligence are the things that will allow computers to recognize individuals and authenticate them without them having to do anything,” he concludes.

Before that day, if you want to log into your online accounts quickly and safely, you may be asked to pop a password pill.

 

A second drawback of Fido is that it provides no easy means of revoking an authentication device that gets lost or stolen. A user would have to contact each site separately to cancel it, Upadhyay says, which would lead to the possibility of a hacker locking you out of your own accounts by impersonating you and revoking your device.

Creatures of habit

Perhaps Fido’s biggest criticism is that it still doesn’t achieve what PayPal’s Michael Barrett says users really want: for websites like PayPal to take care of security for them. For this to happen, online services may have to more frequently employ behavioural analysis. This kind of security can help verify that a password is being typed by the appropriate person, explains Kevin Bailey, a security analyst at IDC. Such systems examine vast amounts of data about people to recognize them based on their usage habits.

Your location, the internet address of the computer you tend to connect from, and even the time of day that you normally sign in, are all details that could be fed into an authentication analysis. Even your click stream—how quickly you type and how long you stay on different web pages for—could become a telling detail about you. If any of these factors gave a website reason to doubt that you are who you claim to be, it could block you from doing anything sensitive, like withdrawing large amounts of money from a bank account.

Bailey predicts that this approach, which he calls persona-based authentication, will take off. “The angle you hold a mobile phone, the way you key things in, the tone you use when you speak—even the ear you put the phone to and the height of that ear above ground,” could be used to add authenticating evidence, he says.

Ultimately, authentication is a problem that is unique to computers. Humans generally have no difficulty recognising other people with whom they already have a relationship, which is why no one demands a password from their spouse or children before letting them in the house. It is also why researchers are unlikely to develop easy, reliable authentication systems for online services until computers can be programmed to learn like people, Bailey says. “Self-learning and artificial intelligence are the things that will allow computers to recognize individuals and authenticate them without them having to do anything,” he concludes.

Before that day, if you want to log into your online accounts quickly and safely, you may be asked to pop a password pill.

Source:BBC