Biometrics for identification

> The US has started fingerprinting all ten fingers of non-citizens 
> who enter the country.

You probably won't miss me, but this move is keeping one New Zealand citizen away from making
any plans to visit the States anytime soon.  Just way too 1984 for my tastes...

(Of course, we're knowing for fumigating visitors to our country, so who am I to point the
bone? :-)

With the theft of fingerprints from a database the way is open for a criminal to leave someone
elses finger prints at a crime scene.  Interesting.

The trouble with biometric passwords (eg. on laptops) is changing your password is challenging
(generally people have 10 "passwords") and stealing/forging your password (biometric info) is
trivial.

How people can think that a method used for identifying people who inadvertantly leave their
prints at a crime scene (ie. they didn't mean to) should become am alternative for a PASSWORD
is beyond me.

Maybe a scan and THEN a password would make slightly more sense?

Great reference to the White House case :D

> The problem is that while a fingerprint is unique, it isn't secret.

Is a fingerprint even guaranteed to be unique?

http://biometrics.cse.msu.edu/Publications/Fingerprint/Pa...

And, even if they are unique... What resolution does a typical 
fingerprint scanner operate at? 

Assuming a 2000 dpi 8 bit grayscale scanner, then we're looking at a 
resolution of approximately 2000x1000x256 = 512 million possible images.

We have more than 6 billion people on the planet, so by the pigeon hole 
principle, at least 2 people will have the same fingerprint rendered by 
the scanner.

Last time I looked fingerprints of non-citizens under the Visa waiver programme (US-VISIT)
were stored for 99 years.  Well, so much for data retention.

In 1997, I was the lead programmer for an OTC DL/ID (over-the-counter driver license and ID) 
system delivered to the State of West Virginia.  Each "capture station" was equipped with a
video 
camera, fingerprint camera, and signature pad.  WV residents could refuse to give a
fingerprint 
when getting a license, so we couldn't depend on fingerprint minutiae to confirm indentity.
This 
was the first time that a state-level OTC DL/ID system used biometric information as a way to 
make an *issuance decision* rather than just confirm identity.

We generated an identification "template" from each facial image captured by the video camera.

When the same person came to get another document, we compared the new template against 
the stored template and used the result to either grant or deny issuance of the license.  Both

images were displayed on the screen so the operator could also see the current and "new" 
images.  Operators couldn't override the system in cases where the template comparison 
indicated "no match".   Local managers *could*, and a record of every override was uploaded to

the central storage location in the capital.

There was only one goal: to try to cut down on fraudulent license issuance.  The original
system 
issued to WV did not have the capability to search through images and return demographic data.

Nor did it have the ability to display multiple historical images: only the "current image on
file" 
could be displayed.  Hence, it was intentionally limited in capabilities.

Our image template was generated on an image taken at a specific distance from the camera, 
and the image was captured against a specific colored background.  The same camera (or 
model), the same background, and the same distance from the camera (size of face within the 
image boundaries) had to be *identical* to the previous image.  If any of the specifications 
differed, the resulting template wouldn't produce a suitable match against the template on
file.

And, even with all of those limitations, we still had a significant false-positive and
false-negative 
error rate.

Knowing what I knew then, and having closely followed the industry, I can say that we are 
probably still decades away from practical biometric "face in a crowd" identification systems.

And, knowing what I do about how easily some of these mechanisms can be either faked or 
spoofed, I would also require *multiple* biometric identifications for legal identification.
Some 
combination of multiple fingerprints, palm print, retinal check, signature, and facial
template - 
at least 3 - should be required for legal (non-passport) purposes.

I am guessing that someone will figure out a way to get retinal data via red-eye flashes and
200 megapixel cameras. 

In the end, "Something a person is" is probably the easiest factor of authentication to
spoof... and should only be used as a 'factor' with multiple authentications... and other
factors involved to be useful.

"Revocation of a biometric identifier is difficult or impossible—if it is even known to be
compromised."

You're forgetting the Schneier's mantra. Biometric identifiers are always known to be as
compromised as they can be. As soon as, or before, you use one for identification, it is
compromised. Once anyone anywhere takes your fingerprints, or you touch some surface without
wiping it off afterwards, somebody can get your fingerprints. It's meaningless to revoke a
biometric identifier, because all of the possible replacements are also presumably known to
potential attackers. The only security that comes from biometrics is the difficulty of making
a convincing claim to really have the biometric (which ranges from very little for practically
any automated device to quite high for a human).

for some reason, all I can think about whenever biometrics come up, is 
worrying about someone cutting off my finger or ripping out my eyeball. 
never discount the stupidity of criminals!

I've long believed that the core problem with social security numbers is that they're used for
both identification and authentication. It's like letting unix users log in with only a
username, then trying to prevent the users from leaking their names to each other.

It'd be much safer to make all SSNs public, and let anyone use them for identification. To act
on behalf of someone with a given SSN, you'd need the corresponding secret code. Since most
places that record SSNs use them only for identification, this scheme would hugely reduce the
incidence of identity theft.

During my undergraduate studies I developed a proof-of-concept program that used a neural
network to recognize a user's typing style (as the cadence of keystroke timings from the
keyboard).  In the resulting paper [<http://dx.doi.org/10.1142/S146902680200052X>], I of
course acknowledged that this is not intended to be a complete security/identification
solution, but merely one option for inclusion in a set of methods.  I imagine someone typing
in their username and password and, in addition to validating the username and password, it
validates the way in which they are typed.  Other researchers have developed systems that
constantly monitor the keystroke activity of the user while interacting with the system.  If
at any point the typing behavior changes, the system can react appropriately (going into
lock-down mode or just sending an alert to an administrator.

My system worked fairly well, usually requiring only one or two attempts at the typing
challenge to be recognized and only rarely recognizing a false positive.  With tuning, I'm
sure it could have been improved.

The point is that behaviorally-based biometrics are *slightly* better than physically-based
ones in that it's harder to steal them and that they aren't entirely fixed.  In the scenario
of the keystroke timing recognition technique, the timings could potentially be stolen over
the wire and a repeat attack might then gain access.  But, combine that with some physical
form of ID, like a keyfob, and a memorized passphrase or password and now you're talking.  I
also imagine the person's typing style changing over time, like their signature.  The database
of keystroke timings would have to be updated periodically with new samples from the
authenticated user, perhaps gradually and automatically through some statistical recognition
of a slight but acceptable deviation from the current set.

I'm not arguing with the article at all.  I am actually in complete agreement that physical
attributes should never be treated like secret keys.  I just wanted to point out a dichotomy
in the realm of biometrics that might be worthy of separate consideration.