Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hashing Out the Next Step in Biometric Security

Posted by ScuttleMonkey on from the facial-hashing-sounds-painful dept.

ergo98 writes "CNN is running a story about biometric hashing. Using this technique, biometric inputs (such as facial characteristics) are altered based upon individual characteristics in a hopefully one-way process. The goal is to continue to reduce the risk of a back-end data exposure."

16 of 117 comments (clear)

  1. Compromises? by Poromenos1 · · Score: 5, Insightful

    I don't like this. Say that someone discovers the "password" (the hash), then you're done. You can't change it (unless you grow a moustache). Same goes with fingerprints, etc. I think a password (passphrase) is much more practical.

    --
    Send email from the afterlife! Write your e-will at Dead Man's Switch.
    1. Re:Compromises? by Doug+Coulter · · Score: 5, Insightful

      Bruce Schneier (counterpane.com) has published on and linked to a lot of other publications on the implications of biometrics, and how easy they are in general to steal. Can't just change your password, you've only got 10 fingers (I hope!) and so on. The whole thing is a very bad idea, and most extant schemes are trivially cracked no matter how "secure" the backend. Pictures of retinas/faces have worked, lifted fingerprints translated to gummy silicone have worked, and so forth. No fancy skillz needed to get past any existing system.

    2. Re:Compromises? by mikiN · · Score: 3, Interesting

      It would be better if a biometric identification could combine several characteristics together in such a way that only a (complete) living person could provide them, for example:
      - iris ID combined with testing of the accommodation reflex, to make sure a real, functioning eye is looking at the camera.
      - fingerprinting combined with infrared scanning, to verify that an unaltered living finger is used.
      - voiceprinting of unique and varying phrases to eliminate recordings.
      and so on.

      --
      The Hacker's Guide To The Kernel: Don't panic()!
    3. Re:Compromises? by Afrosheen · · Score: 4, Interesting

      Try this one on for size. It's my little gift to the biometric community.

        In many protocols, when a session is initiated, the beginning of the transaction includes a handshake. One side says hello are you there, the other replies yes I'm here and the session continues.

        Why not make an actual, physical handshake verifier? I'm sure most people are consistent with their real handshakes, and there are a wide variety of measurable parameters a handshake can provide. For example, when shaking someone's hand, you apply very specific pressure, grip a particular way that spreads pressure to consistent points on your buddy's hand, hand temperature (which can vary depending on a number of factors but we're talking average), hand placement, duration and motion of the shake, etc. You could take it one step further and teach your employees and the system some jive handshakes that involve many steps. The admin could have the most intricate handshake of all.

        The beauty to all this is that handshakes tend to be very personal and never given out. How could someone hack or even learn a secret handshake? It'd be pretty damn hard to do and even harder to replicate once you figured out the sequence due to pressure and duration, etc.

        Schneier should give this one some thought. All you really need is a rubber jointed hand sticking out of the wall (or hidden inside it, retractable) that feels appropriately like a real human hand. Ask the RealDoll people for advice on this. Load it up with sensors and start training it.

  2. Please sit here to confirm your identity. by mikeophile · · Score: 4, Funny

    The goal is to continue to reduce the risk of a back-end data exposure. Surely you didn't think that photocopying your ass wouldn't get patented, did you.

  3. The executives of my firm by Anonymous Coward · · Score: 5, Funny

    are reluctant to adopt biometrics because they're afraid a crook will rip out their eyes.
    Seriously.
    They cited Demolition Man.
    For real.

    1. Re:The executives of my firm by kfg · · Score: 3, Funny

      I hope you've explained to them that it was only movie. Hollywood is always making shit like that up and getting the technical details wrong.

      I real life you just rip off the head.

      KFG

  4. One Way Process by buckhead_buddy · · Score: 4, Funny
    Using this technique, biometric inputs (such as facial characteristics) are altered based upon individual characteristics in a hopefully one-way process.
    Let's hope it's a one-way process. I don't trust any computer to alter my facial characteristics.
  5. Process schmocess by GillBates0 · · Score: 4, Funny
    ...facial characteristics are altered based upon individual characteristics in a hopefully one-way process.

    Heck, they need billion dollar research grants to figure out these "techniques"? Bubba, Sparky and his pals downtown would irreversibly alter an individual's facial characteristics given $100.00, 10 minutes and enough motivation.

    --
    An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
  6. Bio-metrics, my ass! by Jah-Wren+Ryel · · Score: 3, Funny


    The goal is to continue to reduce the risk of a back-end data exposure.

    Sure, today they promise that they only want to do biometrics on my face and fingers. But its just the tip of the slippery slope. You know we can't trust them. Just like the social security cards used to all say "not to be used for identification" and look what good that did.

    I say that if we don't fight these biometric overlords, it is only a matter of time before they are forcing us to sit naked on copiers so they can xerox our asses! Make a stand now while you still have some dignity, and your pants!

    --
    When information is power, privacy is freedom.
  7. Biometric Encryption by bitkid · · Score: 4, Informative
    That sounds pretty old. Ever heard of Biometric encryption? The idea is to use a one-way hash on the biometrics, but also accounting for the fuzzy-ness in the reading. If the readings match, then the same hash comes out. Otherwise something random. See here...
  8. DNA Hashes by Crixus · · Score: 3, Interesting

    It seems like DNA already is a fairly unique method of hashing.

    This actually seems easy to do. Combining various biological inputs to derive a unique identitfier.

    It doesn't seem like a GOOD idea quite yet, but it certainly seems like something that companies will pursue since I'm sure there are people willing to pay money for it.

    --
    Ignore Alien Orders
  9. What about equipment maintenance? by antifoidulus · · Score: 3, Insightful

    Say what you will about passwords, the thing is the require *NO* extra equipment to keep running(well, a keyboard, but you probably need that for other purposes anyway) However, all sorts of biometric scanners need equipment to keep running, equipment that will fail one day, and of course it will be the day that you have to log into your account to fix a critical problem in a critical production system....

    --
    Monstar L
  10. More Misdirection from the Biometric Community by tiny69 · · Score: 4, Informative
    Biometrics is one mechanism for authentication. The three mechanisms for authentication are generally grouped into, something you know (password), something you have (swipe card), and something you are (biometrics). If either of the first two become compromised, they can be changed. Biometric features on your body cannot be changed. This is the major flaw behind biometrics. So the biometric community periodically playes games with the data on the backend hoping to misdirect the users away from the major flaw. "See, we hash your data, so it's secure...."

    A story that is still relavent whenever biometrics is brought up:

    http://www.hindustantimes.com/news/7242_1301216,00 180008.htm

    --
    Go not unto/. for advice, for you will be told both yea and nay (but have nothing to do with the question)
    1. Re:More Misdirection from the Biometric Community by Russ+Steffen · · Score: 3, Insightful
      The three mechanisms for authentication are generally grouped into, something you know (password), something you have (swipe card), and something you are (biometrics).
      In reality, those groups are actually:
      • something you can forget
      • something you can lose
      • something that can change as you age
  11. And for a reason by melted · · Score: 3, Informative

    Crooks aren't that smart. After Mercedes implemented fingerprint readers in some of their cars, there were several reports that some owners got their fingers cut off by thieves. These fingers, of course, could not start the car (no self-respecting fingerprint reader relies on fingerprint alone anymore), but that was not much of a relief for folks whose fingers got cut off.