Slashdot Mirror
Mouse Scans Palms to Verify ID
p00kiethebear writes "'Fujitsu is eyeing a variation on the centuries-old art of palmistry as the latest biometric weapon against unauthorized access to computer systems and facilities. The company has developed a computer mouse that will scan the palm of the user and deliver not a look into the future but verify the identity of that person.', With a .5% error rate I wouldn't be surprised if we saw this in offices within the next few years."
Well I would just switch out the mouse with one of my own =)
.5% Error Rate means if 1 million people use it, 5000 are going to have errors. That makes it pretty significant. If that half a percent get locked out completlely or half a percent get can get onto other computers without being the right person, then there are still issues to be worked out before it's used widespread.
Why use a mouse? I mean, mouses are subject to so much wear and tear that the sensors and lenses have to be real beaten on. I don't see a reason not to have a palm-checking USB device instead.
.5% error rate when clean, but what about when six months old, sweaty, covered in coke, chips, and bodily fluids and has been used for 8 hours a day for the last half year?
Something just used for recognition would seem to be a bit more practical. Cheaper because size wouldn't be a significant factor, and also it'd be easier to lock down against theft.
But a mouse is just asking for trouble. Its got a
A mouse is a bad idea.
Of course, this tells us nothing about how easily fooled the system is. Considering the recent success of a Japanese researcher in breaking fingerprint systems, I wouldn't trust this for a second.
The thing attaches to an ordinary PS/2-style mouse port. That's a secure channel!
So anybody who can land a trojan on the box, can easily capture the valid auth dialogue with the device...
It wouldn't be too tough to have a bogus "print" stored electrically, and rep[lay it either from the actual port, or read from a location in memory.
"Flyin' in just a sweet place,
Never been known to fail..."
Actually, now I think of it, there is a HUGE contact area on this thing! Must leave a great print on the reading surface! What an opportunity for capturing palm-prints for forging access.
"Flyin' in just a sweet place,
Never been known to fail..."
I personally am not in favor of biometric protection devices. Even if they are 100% effective and never make mistakes reading, I do not feel that they are a wise choice.
Bruce Schneider wrote a good column about biometrics here. I don't like the fact that some biometrics are very easy to steal. This means that once someone discovers your biometric "password" they can use it anywhere because you can't change your password.
So I personally would be wary about having too much faith in such a device. /p
neurostar
Actually, that's one improvement that this system has over the easily-fooled fingerprint based systems. Since this system uses reflectance measurements from the palm that are affected by deep structures (veins), the palm print left on the mouse won't do a potential cracker any good.
That said, I suspect that the system really isn't worth the trouble. Other posters have noted that the mouse connects to an ordinary PS2 port, so there's an opportunity for a spoof right there. And the 0.5% error rate sounds good--but only if those are all false negatives. If the system is misidentifying users 0.5% of the time for a database of 700 users, then there will be a truly embarrassing failure rate in a corporation of, say, ten thousand users.
~Idarubicin
So now a visible percentage of the population are now going to be intermittently locked out of their computers by a stress-related illness. Isn't technology great?
An article in c't (www.heise.de) a while back really opened my eyes as to how immature biometric testing still is. They managed to fool every system they tested (fingerprints and irisscan).
The companies selling this stuff are really pushing this as 'secure' and the way the media are raving about this, I imagine a lot of ppl are fooled by this.
Even when the system itself wouldn't be easily fooled I would hate to see what happens if people start bypassing this in hard/software. You would have to have physical protection of the hardware to avoid bypassing the scanner and have very ingenious software to make this secure.
beauty is only a light switch away
See this Counterpane article from May.
Seems to me the sOme common gelatin trick would work here as well...you just need more of it.
Another issue that this may create - the chopping off of hands. Think about this...in the early 90's insurance companies tried to reduce their car theft losses by encouraging the use of car alarms and passive security measures (eg, only your key will unlock the steering column). The result...lower incidence of car theft..sort of. While noone now breaks into and steals a car parked on the street, the incidence of "car jacking" or the violent theft of a running car from the owner at gun point. More often than not this results in serious physical harm or evenb death to the car owner. That almost never happened in the "old days" before car alarms.....
So this may, for access to the right kind of data, encourage the kidnapping of perwsons, the "removal" of a hand, and the making or a "hand cast" as in the article (a whole hand print is much harder to come across than a single fingerprint)to use to circumvent this "cool" mouse...
So, be careful what you wish for....
Never by hatred has hatred been appeased, only by kindness - the Buddha
Is that 0.5% rate the "false positive" or "false negative" error rate? If it is a false positive rate, then that means 1 in 200 times, the wrong person will be allowed access. That is much worse than the false negative, i.e., 1 in 200 times the correct person will have his authentication fail.
My other first post is car post.
Everytime I think of things like this, I think of two awful things. The bank exec whose loses his hands in an accident and cannot access my account and the Mobster who cuts the bank exec's hands off to steal the money in my account. Body parts should not be used for ID unless you are willing to lose them.