Slashdot Mirror
DIY Iris Scanning?
gadzook33 asks: "There have been rumors floating around about DIY iris scanning, using digital cameras for biometric security. Iris scanning presents a fantastic alternative to password-based authentication but hasn't really come to our desktops yet. I've looked around but can't find any concrete material on the subject. Is anyone doing this? Are there any efforts to develop open software for this sort of thing? Are patents holding things up? Given that passwords are an almost defunct technique for protecting data in certain situations, it would be nice to have an alternative."
When I first tried to read this article and got "Nothing for you to see here. Please move along."
it seems to be quite possible with a very high resolution camera, something +4mpixels
... give anyone an incentive to gouge out my eyeballs?
which is where you use a laser to illuminate the back of the eye, and a camera to take a picture of the illuminated retina and then use some sophisticated pattern matching to recognize the unique pattern of scars left by previous scans.
Out of all the things to DIY, what would drive you towards a DIY project involving possibly lasers or bright LEDs and your eyes? Some things you shouldn't go bargain on, like never buy the cheap toiler paper. For both my eyes and my brown eye, I think it's worth spending the cash for premium.
Why are women so complicated? Find out how little I know here.
Do not look directly at laser with remaining good eye
However, any system can be spoofed or cracked. And if someone figures out how to feed information into a scanner that looks (to it) exactly like my iris, well then I'm fucked. That person is me anywhere they do an iris scan.
It would be like someone stealing your passwords and you not being able to change them.
Useful? Yes. But as an additional level of security, not an alternative.
iris scanning is useless, you may as well tattoo your root password tot he back of your neck.
anyone with a telephoto lens can steal your key
Snowden and Manning are heroes.
I personally would like to see multi-tier biometric authentication built into the OS. Log on with a password and a finger scan; any File I/O challenge with voice recognition; visit a secure site, submit to iris scan. Mix it up, occasionally challenge with authentication questions when actions seem either dangerous (downloading executables) or deviate from usual usage patterns. How aggressive to be in challenging for authentication and what types should be settable by the user. This kind of thing might be very useful in keeping your teenage kids from downloading Kazza like malware on your family computer, not just keeping your computer secure from crooks and spys.
Letter To Iran
I thought I told you to label those buttons, Emory?
In the free world the media isn't government run; the government is media run.
Efficiency and effectiveness of passwords is linearly related to your brain's capacity to learn new passwords once in a while and also strongly related to your intelligence in choosing a proper password. If you have a proper password that's not too old, you're safe.
Too old is related to the strength of the password. In general, you should choose a password for a period of a month or possibly a few months. You then decide how complex it should be to be safe during at least that period, then you choose a password that's within an fair distribution of that class, preferably by explicitly not choosing from another subclass of the passwords that is known to be weaker. If you also calculate in the advances in password cracking you should be able to work out a decent set to choose from.
Specifically, most system administrators reduce the theory to this: at least 8 characters of which at least one number and at least one special character.
This doesn't work in more than one way. First of all, the user doesn't know about any generic-spread he or she should be doing and will just pick some word with numbers or characters behind it. That's quite a small subset of the intended target. Users choose such weak passwords because they don't really care about the password or the protection, they just want to get their work done and the password thing including the change-your-password thing is an annoyance you have to live with (in their perspective). If/When their account is hacked (because of the not too bright password) they claim somebody hacked it and that they couldn't have helped the secrets in it leaking out. People don't use passwords for security, people use passwords because somebody tells them to use passwords.
While it is true that one could hold up a photo of your iris to a camera and spoof a static iris scanner, doing the same to a dynamic scanner is not practical.
What is a dynamic iris scanner? One that looks not only for the unique patterns of the eye, but also simultaneously measures retinal response to stimuli such as dimming and brightening of the display. This is much more difficult to spoof (you would essentially need to build a model of the target's eye that could respond to external stimuli and then hold that up to the scanner).
Combined with facial recognition, dynamic iris scanning is very potent. First it recognizes your face and then your eye and then the retinal response with stimuli that is timed to be somewhat random. Just don't try to log on after a night of pubbing.
It is your personal duty to fight for what is right on a daily basis. Ignoring injustice is identical to approving
Do not look into laser with remaining eye.
Face and Iris recognition have been fooled with printed pictures. Fingerprint sensors with $5 fakes. The list goes on. There is really not a lot of defenses available against this.
And you cannot change your face or iris, like you can change a password....
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
i didn't have any trouble finding a variety of resources that answer your questions using google.
b or/m l
why are you asking slashdot ?
in particular, this looks interesting: http://www.csse.uwa.edu.au/~pk/studentprojects/li
as did this: http://www.itl.nist.gov/iad/894.03/nigos/mbark.ht
Aren't the little red lights on the bottom of my mouse iris scanners? That's what they told me at work.
I would attempt to obtain a fake eyeball of some sort. While it wouldn't work perfectly, it would give me some sort of method by which to focus with. Mounted with some tape to the eyecup, and then positioned in front of the webcam, I would be able to determine the focus fairly quickly.
I would then set up some kind of "ring illumination", wherein I would create a "ring" of LEDs - red/green/blue/IR - through which the webcam would peer. Focussing again might have to be adjusted. This ring would be set up in such a fashion so that I could trigger which set(s) of LED's would be active at once - likely via USB control, too.
Once I had that set up, and focussing correct, I would then work on the software. For this DIY project, I would simply set things up to take multiple image captures of my own eye, process the images through some filters to reduce the information to just my iris (cue on the white of eyeball, and black of the pupil), then (in some manner), use these images to create an "eigeniris" image, some kind of "average" of all the images I took (over several days or months, in different levels/conditions, so as to have the best average available). Then, the software could take an image, compare it to the "eigeniris", determine if it falls within range, and use that to trigger or deny access (to whatever).
That would be the route I would take if I was doing this. Overall, the hardware portion seems the simplest to implement - the software is where you will bog down. Just like any other pattern recognition project, I would imagine...
Reason is the Path to God - Anon
That's not even funny.
Mods: Mod me informative.