 |
A Disturbing Little Meditation on Biometrics
| by Ed Gottsman
|
Posted at Feb. 02, 2006 08:10 AM CST | | | Some of this material comes from a fascinating article in New Scientist (Sept. 17-23, 2005) entitled "Privacy & Prejudice: Whose ID Is It, Anyway?" (However, any uproarious one-liners (assuming you notice them) are mine). | | | Biometrics (in one form or another) is often considered a cure for identity theft, terrorism, illegal immigration, lost laundry tickets and so forth. There are, however, significant practical problems with its deployment. For example, people with worn finger pads (which often characterize certain kinds of manual workers) can't be enrolled in fingerprint recognition systems (nor—obviously—can people with lost limbs) and the total for worn pads is estimated at about 2 percent of the population. Further, we leave fingerprints wherever we go, so getting copies of other people's biometric identifiers would be straightforward. (DNA scanners [still in the lab] suffer from a similar vulnerability.) | | | Separately, one in 75,000 people have no retina, and in any case there are proposals on the table that involve using tinted contact lenses to spoof retina scanners. Voice recognition is vulnerable to ambient noise (can you imagine using it to enter a subway system?) and might be spoofable with a surreptitiously-made recording (cf Sneakers). Proposals that rely on multiple identifiers have been deemed (in some quarters) too complex and expensive for mass deployment. There's also (I suspect) a voting problem: you put your hands in the fingerprint scanner, smile for the face scanner, speak your pass phrase for the voice scanner and stick your eyeball up against the retina scanner. What if some of those scanners (for whatever reason) reject you while others accept you? What if some of your fingerprints pass and others fail? What's the poor security guard to do? | | | So What?
The significant difficulties that attend most biometric technologies make my proposal for full X-ray skeleton recognition (which no one seems to take seriously) look very attractive. Think about it! Everybody has one; you don't leave copies of it lying around; it works in noisy environments; you can't be separated from it (well, technically, I guess a really determined thief...never mind) and it can't be imitated. For added security, you could even have a personal little "pass-dance" (maybe something from A Chorus Line that you'd perform to further confirm your identity. How about it, science?! (http://www.jaredstory.com/deep_thoughts.htm) | | | | Comment on this post |
|
| Trackbacks and Pingbacks are records of links made to accenture.com pages. | | | Pingback URL:
http://www.accenture.com/Accenture/PingBack.aspx |
Comments Posted by:
Alan Wong
on
July 31, 2006 10:46 AM CST  | Agree with Neil Norman's thoughts and comments. For those that work with security in practice and out of the lab, it is all about raising the bar and reducing the probabilities (biometrics or otherwise) and not about waiting for things to be technically 100%. It is about delivering value in business terms.
For example, with the common door lock, most of us sleep fairly well at night even though we know that the lock on our front door can be picked. In fact, why take the difficult option of picking a lock when there is usually a fragile window next to it? By increasing the difficulty of breaking the lock, we increase the cost of the operation and it eventually becomes unprofitable when weighed with the risks involved. Biometrics is unique in the way that it adds to solutions. In the case of the security space, where it is currently seen to sit (and I believe this will shift), it can be used as another tool to raise the cost of operations to an intruder to the system. “Paper with value” is another obvious example, from Monopoly money, to bonds, to bank notes and IOUs there is an idea of fitness for purpose and for those that are deep into the game of making security or breaking security, the essential questions to ask when designing a system is – “is it worth it to break this system?” or “is it worth it to create this system?”.
Biometric vendors paint a black and white picture as this is easier to market and shout about, but as with most technologies there is a space between what the adverts say and what the cynics say. If one knows where this lies then one can create pragmatic solutions that are able to improve today’s problem and prevent tomorrow’s. If one does not know where this space lies then one either throws the baby out with the bath water or tries to gain knowledge and understand how to use the upside of this technology and use other means to guard against the downside. If one is able to do this generically and understand the business problem that is being resolved then one can create systems that can do the technology justice and deliver clients real value.
|
Posted by:
Neil Norman
on
July 07, 2006 06:18 AM CST | Having worked for Accenture for 7 years, I know the organisation and its people well. Unfortunately, this article or commentry is well below the intellectual competence of the company. More tabloid than white paper.
Some informed comments:
- Basics on biology: the retina is not the iris. Irrespective of the colouring of a contact lense, the internal layout of the retinal structure would remain the same.
- retinal scanning is currently not cmmercially available on any scale and remains a very immature technology. My point: of the 0.00001% of deployments it possibly represents, why lift it out in order to raise concern about the remaining 99.99999% of biometrics which does not suffer due to individuals having retinal issues.
- technicaly we do leave fingerprints wherever we go, however, high-end fingerprint scanners now - and have for some time - incorporate live-scan tests, demanding that a live and kicking human being be attached.
And what a great close. "Duh, hey guys, I think the inherent risks of exposing our customers to radiationis far less than the failings of retinal scanning!".
Good job we didn't ask you to to provide a market view on the car market! you would probably asseerted that the inconveniences of shovelling coal into the burner far outweigh the smells given off by a petrol engine!!!
Be Accenture, not tabloid. |
|
|
|