I used to work in biometrics. In the first few minutes of a biometrics class in about 2004 the instructor quoted numerous people, going back about 30 years, each saying biometrics would be reliable “in ten years”. When I actually looked at the data for various biometric systems I was rather shocked by the failure rates. And those were in cases where there was no deliberate attempt to defeat the system. I attended a conference on biometrics and I invented a new biometric system (no, I can’t talk about it—a certain government agency says that information is restricted). It became quite clear to me that every biometric system in existence could be defeated if you knew it was being used. And furthermore it was unlikely that any system could ever be undefeatable.
Hence, I am not surprised experts are coming to the same conclusion I did several years ago:
Biometric systems — designed to automatically recognize individuals based on biological and behavioral traits such as fingerprints, palm prints, or voice or face recognition — are “inherently fallible,” says a new report by the National Research Council, and no single trait has been identified that is stable and distinctive across all groups.
As part of a “something you carry, something you know” system it’s convenient if less secure. For users they’re less likely to leave the fingertip at home then the RSA fob. Sure, copies of the fingertip are left everywhere but… that’s why identification should have two or three parts, no?
If I’m reading Joe right, he’s saying that biometrics fail in that they allow people access to things that they shouldn’t have access to. That’s obviously a problem.
But what about the times when the fingerprint reader fails because I came in from the cold, or I accidentally bleached my finger, or the reader just extra temperamental today? Then we have the opposite problem: being locked out from something that I should have access to.
Which could be just as bad!
In the late 1970s our college introduced a biometric scanner in the cafeteria to speed entry, compared with having a doorman check student ID cards upon entry.
The machine measured finger lengths. The machine can be seen in Close Encounters in one scene, if you like movie trivia. The student swiped his ID and placed a hand on the scanner, which lit up green or red lights just within about 3 seconds.
The machine worked about 99% of the time.
The failure in security rested with the manning of the scanner. If you were known to the student worker behind the scanner, you got in if the scanner failed. If not, you had to get your ID checked visually. No ID, usually no problem. In any case, essentially nobody was ever refused entry into the free, all you can eat cafeteria.
The other problem is that the credentials are ridiculously easy to collect if your aim is forgery. If they are too difficult to collect surreptitious, then they are too difficult to reliably collect at security point.
5+ lead electrocardiogram for 60 seconds is nearly unique, especially if you have a strong base line.
Dental X-ray (if they can engineer the dose lower) or ultrasound of the brain cavity (if they can get the price down) would suck to defeat.
For Caucasians, freckle pattern on the face/arm.
Voice recognition (reading a few minutes of text, instead of a quickee 5 syllable password).
Blood type matching looks at markers of the surface of red blood cells (A,B, and rhesus factor). More careful matching looks at major histocompatibility factors (MHC) and other center of differentiation (CD) protein expression.
As genomic and proteonomic array technology improves, eventually spitting into a straw will give tell the difference between you and your identical twin.
Dustydog, don’t be so sure about voice recognition. Where I work, we recently hired someone who had worked on a text-for-speech company; he explained that, because they were able to take the voice patterns of an individual, and make it sound identical to that individual, they thought that the government would be a good customer for their program. After they contacted someone, though, they were delivered a “cease and desist” order instead, and that was that for their company.
There may be better, more natural ways, to identify people, though. One way is called a “borh“, used by Saxon England before the Normans took over. A borh was essentially a collection of twelve men who could vouch for each other: if one person didn’t pay his debts, the others had to help pay for them; if one person committed a crime, the others had to bring him to justice. On the other hand, individuals could apply to join a given borh, and the members of a borh could kick you out…thus, this gave you a reason to behave.
When the Normans took over, they put in a similar system, called tithings, except that membership in the group wasn’t voluntary–and that removed the incentive to behave. Thus, it didn’t work out so well.