Slashdot Mirror
New Technology Combines Lip Motion and Passwords For User Authentication (bleepingcomputer.com)
An anonymous reader writes: "Scientists from the Hong Kong Baptist University (HKBU) have developed a new user authentication system that relies on reading lip motions while the user speaks a password out loud," reports BleepingComputer. Called "lip password" the system combines the best parts of classic password-based systems with the good parts of biometrics. The system relies on the uniqueness of someone's lips, such as shape, texture, and lip motions, but also allows someone to change the lip motion (password), in case the system ever gets compromised. Other biometric solutions, such as fingerprints, iris scans, and facial features, become eternally useless once compromised.
Hey Mike, what's my password again?
I has been flyingpig69 for the last two months boss.
Thanks, I'm really liking this secure authentication system you've installed.
And passphrases of at least 15 characters, with no ridiculous rules such as 'Must use a capital letter, a number, a non-alphanumeric character' etc.
The general public must be so incredibly stupid that they can't even create decent passwords.
What's the point everyone's gonna hear you
I have to take the bandaid off the camera on my laptop to protect my cat pictures.
No thanks
What happens if someone suffers, say, stroke and part of the face is paralysed. Or they have Botox?
I suppose there has to be a backup to allow someone to reset their password in such cases, or in cases where they forget it. This backup may prove to be a weakness.
What happens if I record a video of my boss uttering his password, and then show the video to the camera?
its not the word your saying but the unique biometrics of the lips so it can change with what ever you say where as a finger print or facial/iris do not change.
Dr. Frank Poole: Okay. Well look Dave. Let's say we put the unit back and it doesn't fail uh? That would pretty well wrap it up as far as HAL was concerned wouldn't it?
Dave Bowman: Well, we'd be in very serious trouble.
Dr. Frank Poole: We would, wouldn't we. What the hell could we do?
Dave Bowman: Well we wouldn't have too many alternatives.
Dr. Frank Poole: I don't think we'd have any alternatives. There isn't a single aspect of ship operations that isn't under his control. If he were proven to be malfunctioning I wouldn't see how we'd have any choice but disconnection.
Dave Bowman: I'm afraid I agree with you.
HAL: I know that you and Frank were planning to disconnect me, and I'm afraid that's something I cannot allow to happen.
Dave Bowman: Where the hell did you get that idea, HAL?
HAL: Dave, although you took very thorough precautions in the pod against my hearing you, I could see your lips move.
Biometrics should be used for IDENTIFICATION, not AUTHENTICATION.
There is nothing wrong with a fingerprint or iris in lieu of a user name. I don't change that when the databases scattered all over creation get individually compromised.
So, we've reached a point where a user actually has to say their shitty password out loud in order to obtain better security?
Let me put my boots on so I can wade through the irony.
Oh, and not to nitpick or anything, but this is hardly combining functionality to create better security when your password is known to anyone within earshot of you authenticating. One half of that system is basically compromised simply by using it as intended.
My passwords are way too embarassing to be said loudly in presence of my coworkers.
When you type a password by moving your fingers you are making a gesture. Or you can speak a passphrase and make the gesture with your mouth. Either works for authentication; the advantage of speaking the word versus tapping on the keyboard is that it's harder for someone else to duplicate.
This seems to assume that the camera can see an individual's lips.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Here in Alabama, we already have a spectacular biometric system called RIN - the Redneck Identification System.
At each door we have a spitoon. When you approach the door, you spit into the spittoon and say anything you want. The spit velocity and composition is analyzed and the drawl of the speech is measured. No "southern bio" match, no ID match.
Dave doesn't chew Skoal and is always dead center in the pan - IMPOSTER DETECTED. GIT 'EM BOYS!
--I like turtles...
Other biometric solutions, such as fingerprints, iris scans, and facial features, become eternally useless once compromised.
No. They do not. This is a rather common misconception. Granted, you can never change these things - which is an inherent weakness, but they do not become "eternally useless". I may have your fingerprint - but I can not fool every fingerprint reader on Earth. Better fingerprint readers are invented - each successive generation being harder to fool. Iris scans and facial recognition are much the same. You may be able to fool the scanners of today, but not necessarily the scanners of tomorrow. You may be able to fool some scanners, but not all scanners.
I can place a security guard at the scanner - thus ensuring that a rubber finger (or a gummy bear), or a picture of your face, is not being used, much like an extremely cheap lock can be very effective if someone can monitor it to ensure it is not picked. They do not become eternally useless. They are still, and always will be, an additional measure, not to be used in isolation.
"Government is like fire; a handy servant, but a dangerous master." -- George Washington
The point is don't try and sell this as a "combined" security model when one half of the system is essentially compromised, simply by using it as intended.
Unfortunately, the other half of this system will ensure the entire thing is marketed as the best "multi" factor authentication solution in the entire universe.
From a pureley technical point of view, it *is* a multifactor :
- something you have/are : Your lips (or more precisely : their peculiar shape and your personal way to move them when making some sounds).
- something you know : A certain order in which you present the above lips motions (though it's linked to the sound you're making, and if somebody can over-hear you, they have a decent starting point at guessing what motions you where doing with your mouth).
Currently, it's not being marketed *for being multi factor*.
Currently, it's being marketed for the fact that you *can* change the "something you have/are" part. It's a changeable-type of password/biometric, which is unusual among other biometrics where you can't change the "something you are" part (you can't easily grow an extra finger with a new fingerprint whenever a previous one was compromised - using gumy bears or whatever).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
These kind of "biometrics unlock" (like also a fingerprint scan) are used as a quick way to unlock instead of having to input a strong password.
They're the equivalent of a PIN code, not the equivalent of a 16-characters long strong password.
So if you can't lip/mouth your biometric pass, you simply do as you would if your finger was unavailable (= harmed, and covered with a band-aid) for fingerprint scans:
you type instead the strong unlocking password to log-in.
Now the problem is that you probably use your PIN-like biometric because it's faster and easier, and thus avoid using the strong password.
And thus by never using it, there's a risk that you'll forget it.
Seriously, how many people around here know the PUK to unlock their SIM card, as opposed to the PIN ?
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
The password here (i.e.: the word that is spoken) isn't what plays the role of password (it's not the actual word itself that unlocks the machine).
As mentionned, this technology doesn't use any voice recognition.
The thing which acts as a password (the thing which decides to unlock or not) is the particular way in which your mouths moves when composing the sound of the word.
The word only plays the role of a mnemonic : a thing that helps you remember the combination of elements - i.e.: the order of mouth movement that you need to do to unlock the session.
You could try to do the same motion noiselessly if you want (and if you actually manage to do the same lip motions).
---
Now, there's a strong correlation between sounds and lip motions, and somebody over hearing you would have a good starting point at trying to guess what your camera sees.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
My password is "rrrrrrrrrrrr" (12 times 'r'). Now read my lips, and try to get the difference between "rrrrrrrrrrrr", "rrrrrrrrrrr" (11 times 'r') and "rrrrrrrrrrrrr" (13 times 'r')...
Password, Passkey, Biometrics
Something you know, something you have, something you are
aka ...
Something you forget, Something you lose, something you no longer are
Puteulanus fenestra mortis
my inability to read or type anything without moving my lips is a security bonus.
Nullius in verba
I'm Stephen Hawking, you insensitive clod!
Computer, establish a security code for access... One - Seven - Three - Four - Six - Seven - Three - Two - One - Four - Seven - Six - Charlie - Three - Two - Seven - Eight - Nine - Seven - Seven - Seven - Six - Four - Three - Tango - Seven - Three - Two - Victor - Seven - Three - One - One - Seven - One - Eight - Eight - Eight - Seven - Three - Two - Four - Seven - Six - Seven - Eight - Nine - Seven - Six - Four - Three - Seven - Six - LOCK!