Retina-Scan ATM Machines

Eyes For Sale by Anonymous Coward · 1999-05-13 20:20 · Score: 0

Ok, I can see the whole black market on eyeballs, and persons getting jumped and their eyes ripped out of their sockets!! Ok, who here does not have a criminal record and wants to sell me their eye, I only need one so you wont be totaly blind!!

Re:Eyes For Sale by shawb · 1999-05-13 23:20 · Score: 1

A way to prevent that? How about a video camera, like is already installed on most ATMs. I'm sure that it would seem suspicious if you were caught on film holding someone's head up to the eyeball scanner.

--
I'll never make that mistake again, reading the experts' opinions. - Feynman
Re:Eyes For Sale by davedavedave · 1999-05-13 21:15 · Score: 1

No, the eye needs to be attached, and the person alive. The scan also checks for the small amounts of movement in a working (living,attached) eye.

So, we're safe! Well, someone can simply jump you and just hold you up to the scanner - doh! Surely there needs to be some way to prevent this?!?!?

--
~ Artificial intelligence is no match for natural stupidity ~

Not the first by Anonymous Coward · 1999-05-13 20:20 · Score: 0

Here in the United Kingdom of Great Britain, a building society has had these on their ATM machines for about a year...

So not the first!

Simply Senzuri (not logged in)

Re:Not the first by Ralph+Bearpark · 1999-05-13 22:45 · Score: 1

More info at Sensar who actually implemented the Nationwide system.

Regards, Ralph.
Re:Not the first by Kati · 1999-05-13 20:23 · Score: 1

Who what where? There's me posting that it'll take years for that technology to become commonpace here, and you are contradicting me, damnit... where are they using it already?
Re:Not the first by chiark · 1999-05-13 22:00 · Score: 2

Nationwide Building Society have been running trials of Iris scanning for around 18 months. Biggest problem is the cost of the machines, as the cameras are about 15k GBP...
People have been very willing to accept the technology as it's non-intrusive, and secure.
The machine checks for a pulse in the eye...
For more information on this initiative, see the Nationwide's IRIS recognition info page.
Chiark.
Re:Not the first by Eddie+Hitler · 1999-05-13 20:41 · Score: 1

Yeah,

Nationwide Building Society unveiled its
system in a branch located in one of their
office buildings two summers ago. I thought
they were joking with the new guy when I
was told about it. Brits win on Technology
again, then everybody builds a better system.

Re:Eye Thieves.... by Anonymous Coward · 1999-05-13 20:22 · Score: 0

Backward old England!!!??? We have had these so-called iris/retina scans for months!! Go to a Nationwide bank in Halifax and wonder in awe as you put your eye up to a camera...

Simply Senzuri

Any good links by Anonymous Coward · 1999-05-13 20:45 · Score: 0

to iris scanning available? I'm amazed that the computer can draw a match when the pupil (and the surrounding iris) can vary in size so much.
Would a stolen eye even work? I'm sure that they dehydrate fairly quickly, the normal blood pressure is gone, and the muscles that control the pupil are relaxed and fixed. Perhaps the technology should also do a little more work and ensure that the eye is warm and surrounded by a head (then they'd have to decapitate you quickly for your $50). Seem most likely that they'd still do what they do now, and just hang around the ATM till you get your cash, then strongarm it from you.

Hazel Eyes... by Anonymous Coward · 1999-05-13 20:49 · Score: 0

My question would be what about people with Hazel eyes? My eyes change from dark brown to bright green. The iris also expands/contracts to let more/less light in depending on the lighting in the area.

I find this hard to believe that this is iris scanning. It probably scans the back of the retina (Which is like a fingerprint as no two peoples are the same.).

Most probably the reporter or the manager he interviewed didn't really know the technology and and replaced 'retina' for 'iris'. This wouldn't be the first time a reporter or manager has made a mistake reporting the facts from just total lack of knowledge. If we add a politician to the mix to support this technology that should complete the loop. :P

- Killjoy

The difference between dreams and reality, is in dreams you just haven't figured out how to get there yet.

Re:Hazel Eyes... by th0m · 1999-05-13 20:57 · Score: 1

My question would be what about people with Hazel eyes? My eyes change from dark brown to bright green. The iris also expands/contracts to let more/less light in depending on the lighting in the area.

well, those are really advantages to the technology. provided the software is good enough, it should be able to take account of those factors and use them to confirm whether it's really you when you step up to that atm.
all implementations of iris scanning [that i've seen so far] have an initial training or enrollment procedure where you have to stare into the camera for a minute or so and allow it to record some data about your iris. notice that it doesn't just take a single static snapshot; in principle it could record information like how your pupil responds to variations in ambient light, how the color varies over time, and so on.
I find this hard to believe that this is iris scanning. It probably scans the back of the retina

nope. iris scanning is proving to be far more practical than retinal scanning these days. cheaper equipment, if nothing else, and less invasive (at least conceptually; everyone can already see your iris).

--
-- in china, chinese food is just called food.

In a word by Anonymous Coward · 1999-05-13 21:08 · Score: 0

Eyes + Camera == Very close to each other
Very close to each other == Pink Eye gets a new lease on life.

Can anybody say ASS Authentication
ASS + Camera == Smell but no Disease

Re:In a word by spencerogden · 1999-05-14 00:23 · Score: 1

retina scanning would require close contact

this is iris scanning which occurs from about a foot away

--
Spencer Ogden

Re:Bypassing this security by Anonymous Coward · 1999-05-13 21:31 · Score: 0

Remember that scene in Demolition Man where Wesley Snipes escapes from the cryo-prison using the warden's eye? Not a pretty sight..

Re:Getting your "eye" riped .. by Anonymous Coward · 1999-05-13 21:39 · Score: 0

The thing is, does the average thief who would mug you for a couple hundred bucks know that stealing your eye would not work? I'd assume they would not.

Re:Getting your "eye" riped .. by Anonymous Coward · 1999-05-13 21:51 · Score: 0

I'm sure that there may be a few casulaties when the technology first comes out, but after this fallacy becomes common knowledge, most thieves would come to appreciate the facts of the matter.

Re:Only an eye? by Anonymous Coward · 1999-05-13 22:15 · Score: 0

Yea, well I wouldn't want to be one of the people the "stupid" muggers pull an eye from to try it. ;-)

"ATM Machine" redundant? by Anonymous Coward · 1999-05-13 22:16 · Score: 0

Sort of like PIN Number (Personal Access Number Number) (Automated Teller Machine Machine)

It's not an "ATM Machine" by Anonymous Coward · 1999-05-13 22:16 · Score: 0

ATM stands for "automatic teller machine". So
an ATM machine is an "automatic teller machine
machine." That's dumb. So's "PIN Number". Or
"VIN Number". Or "IBM Machines". Or "USA
America".

Re:It's not an "ATM Machine" by Anonymous Coward · 1999-05-13 23:30 · Score: 0

Excuse me while I listen to my compact CD disk.
Re:It's not an "ATM Machine" by Russ+Steffen · 1999-05-13 23:25 · Score: 1

Well, you have to say "ATM machine" to differentiate it from "ATM mode" networking.
Sorry, couldn't resist.
Re:It's not an "ATM Machine" by gavinhall · 1999-05-13 22:36 · Score: 1

Posted by FascDot Killed My Previous Use:

Or "SCUBA apparatus"
Re:It's not an "ATM Machine" by Lurking+Grue · 1999-05-13 22:38 · Score: 1

Or NIC card...
Re:It's not an "ATM Machine" by JerkBoB · 1999-05-14 02:44 · Score: 1

I hate that! "Let's install the NIC card." It's a NIC, you idiot! Network... Interface... Card !!!
Argh. I'll be ok.

--
A host is a host from coast to coast...
Unless it's down, or slow, or fails to POST!

Apple's Latest Voice Technology by Anonymous Coward · 1999-05-13 22:48 · Score: 0

Apple, in there next OS release (Sonata), will include voice print technology to allow people to use their voice to log onto the system. Talk about ease of use! Here is a possible scenerio:
"Mac log me in" (your customized desktop appears)
"Mac open Netscape"
"Mac connect me to Slashdot"
You here without touching the keyboard.

-EJ-

Re:Apple's Latest Voice Technology by Anonymous Coward · 1999-05-14 01:30 · Score: 0

Voice control sucks now, but in their next release they are supposed to be adding Dragon Systems' code, which should greatly improve the quality. Add a G4 processor, and dictation and voice control become a real possibility.

Besides, the point of the post was not to emphasize the virtues of PlainTalk, but to highlight Apple's new technologies like voiceprint.
Re:Apple's Latest Voice Technology by Defiler · 1999-05-14 01:45 · Score: 1

That's great, until someone makes an MP3 of you saying that, and plays it back from a RIO. ;)
Re:Apple's Latest Voice Technology by cpt+kangarooski · 1999-05-14 00:16 · Score: 1

Well voice control (like opening programs and such) has been around for a long time - since '92 IIRC. It predates the Power Macs, I'm certain of that.
However it's not _that_ good, trust me.
(Fortunately it rarely screws up as wildly as the Newton sometimes did. 'Course, the Newt had some degree of learning, and PlainTalk does not.)
Eat up Martha.

--
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.

Sort of exists already. by Anonymous Coward · 1999-05-13 22:53 · Score: 0

There's actually something like that, only with fingerprints. It costs about $200 and it's a little scanner thing that sits on your desk. It looks out your computer, and presumably a password file, unless you have the right fingerprint. Of course, it's not taken off very well yet.

Re:Scalpel muggings. by Anonymous Coward · 1999-05-13 23:04 · Score: 0

What's frightening is that someone will still try it. I imagine it will take some time for the criminally deranged to familiarize themselves with the security features of this technology. It will have to appear on those 'stupid criminal' reports a few times at least. "The suspect apparently assumed that if the eye scanning camera worked while the eye was in the socket, surely it work if the eye was out."

How can I have my sis go get me a quick $100? by Anonymous Coward · 1999-05-13 23:13 · Score: 0

I am opposed to any sort of ATM security that prevents me from authorizing anyone I wish to withdraw money, do a deposit, etc. in my place. If I say it's OK for someone else to access my money, then it had better be OK with the machine. And having everyone I ever may wish to access my ATM get pre-retina-scanned by my bank is an unnaceptable option.

With a gun to your head, "Withdraw $300 or die." by Anonymous Coward · 1999-05-13 23:17 · Score: 0

Since most people do not write down their ATM PIN codes anyway, I see no safer advantage with eye scanning.

Eyeball life support? by Anonymous Coward · 1999-05-13 23:36 · Score: 0

How long until an eyeball can be kept "alive" connected to a gadget.

I think I'll keep my plastic card, and just hand it to the mugger.

Re:Eyeball life support? by Anonymous Coward · 1999-05-14 03:25 · Score: 0

Bill Gates' eyeballs would make it economical...
Re:Eyeball life support? by drudd · 1999-05-14 01:05 · Score: 1

Lets see... an incredibly complex and expensive machine built to keep a human eye alive (assuming you can remove it in a struggle without significantly damaging it), used in order to get only a couple hundred dollars from someone... if they even have that much in their account!

Simple economics: easier, cheaper, faster to simply stick the person up after they've gotten the money for you. Then you're also not on the security cam.

Doug

--
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!

Agreed-here's a technical solution to iris forgery by Anonymous Coward · 1999-05-13 23:49 · Score: 0

I'd like assurance that my eye scans are not made available to ANYBODY. What is going to prevent them from making them available to employees or hackers or even law enforcement?

I really think the system sounds cool, but they had better have a VERY secure storage methodogy.

Which brings me to my thought... couldn't they store your "eyeprint" information encrypted in such a way that it would be impossible to reproduce your original iris "settings"?

When your iris is scaned at a later date would actually "unlock" (sorta like a PGP key) the "encrypted" iris picture and allow your transaction. Does that make sense? This system would actually prevent iris forgery of any sort.

Re:Alternative... by Anonymous Coward · 1999-05-13 23:51 · Score: 0

Fingerprint are partly random, partly genetic. So identical twins don't have identical fingerprints, but their fingerprints would very similar.

Retinal patterns are random. From a previous post, so are iris patterns, and you can trigger an iris contraction to verify it's a living eye, which you can't do with a retinal pattern.

Yet another invasion of our privacy by Anonymous Coward · 1999-05-13 23:52 · Score: 0

I've heard that a retinal scan can
tell if you are drunk or with child.....

Watching WAY too many sci-fi movies by Anonymous Coward · 1999-05-13 23:56 · Score: 0

So you think someone is going to cut off your head or cut out your eye to get some cash? That is just plain stupid. It'd be much easier to just take your cash after you withdraw it.

There are possible issues with this, but THIS is NOT one of them...

Re:With a gun to your head, "Withdraw $300 or die. by Anonymous Coward · 1999-05-13 23:58 · Score: 0

The don't write them down, but they do forget them. Seems like a complex solution when people could just remember their pin numbers.

Re:You thought the Pentium III Id was invasive... by Anonymous Coward · 1999-05-14 00:52 · Score: 0

If you don't like the pentium III id number I wouldn't recommend ever getting a network card either. They have unique ID's available to anyone via a network or the internet and it has been this way for as long as I can remember.

Helium is too expensive by Anonymous Coward · 1999-05-14 00:56 · Score: 0

Maybe when hydrogen fusion becomes commonplace.
The ash can be used as a cheap source of helium for personal transortation.

--Walt

ATM Camera is there to protect machine; not you. by Anonymous Coward · 1999-05-14 01:29 · Score: 0

Besides, I've seen far too many of these with deliberate scratches all over the lucite cover or just covered over with spraypaint. Ditto for 'security' cameras on board busses.

Ow! Ow! Ow! >Poink! by Anonymous Coward · 1999-05-14 01:40 · Score: 0

heh

gotta love the FOX network! by Anonymous Coward · 1999-05-14 01:47 · Score: 0

bad boys, bad boys, whatcha gonna do?, whatcha gonna do when they eyeball you...

Non indentifing... by Anonymous Coward · 1999-05-14 01:52 · Score: 0

How is the criminal supposed to know which bank you use, or if you have money in your account, etc?

They always said I had my mother's eyes by Anonymous Coward · 1999-05-14 02:36 · Score: 0

so now i can get to her bank account right? =]

You all are paranoid!! by Anonymous Coward · 1999-05-14 02:54 · Score: 0

No one is going to rip your eye out when it would be a gazillion times easier to put a gun up to your head, or smash your face up against the scanner. I would think standing to the side out of camera view with a gun would look alot less supicious than walking up to an ATM with a dead eye in your hand.

List of authorized irises by Anonymous Coward · 1999-05-14 10:35 · Score: 0

Perhaps in this situation you go to the bank with your sister and add her to the 'authorized irises' for your account :-]

Of course as far as I remember there's both an iris and a PIN for the ATM.

Re:Bypassing this security by Anonymous Coward · 1999-05-14 10:37 · Score: 0

Uhh..

Down with people who spend too much time on paranoid brainstorming!

Re:Backup system would be needed as well by Anonymous Coward · 1999-05-13 22:16 · Score: 1

I'd think there'd almost _have_ to be an alternative system available - there are, after all, people without eyes, or at least without usable ones. And given the legal climate in the USA, if they implement a system that isn't usable by everyone from one-armed acromegalic albinos to quadriplegic spastic achondroplastic dwarves, they're likely to get sued for "violating" someone's "civil rights".

Aniridia ? by Anonymous Coward · 1999-05-13 22:55 · Score: 1

What if, like me, you don't have anything recognizable as an iris ?

Re:Aniridia ? by gonzocanuck · 1999-05-14 00:18 · Score: 1

Exactly - say you were blind or had glass eyeballs! I've never met anyone with two glass eyeballs, they just had one, but still...yeah, something like thumbprint technology. What if you don't have thumbs?

--

not an ATM machine. by Anonymous Coward · 1999-05-14 01:17 · Score: 1

There's no such thing! ATM stands for Automated Teller Machine. an ATM machine would be an Atutomated Teller Machine Machine, which does not make sense... and don't go telling me how you use your "PIN Number" either...

Dead people's eyeballs? I don't think so by Anonymous Coward · 1999-05-13 21:10 · Score: 2

I don't think people will be stealing eyeballs. More likely people will be setting up fake temporary ATMs, with iris scanners, and when someone tries to withdraw money it will scan their iris but refuse to give them money claiming an error. This has been done before with regular ATM cash machines to capture PIN numbers (whilst 'swallowing' the cards).

The thieves can then go to a regular cash machine, pull out the camera, crocodile-clip the camera nodes to a lap-top, and play the scanned sequence back direct to the internal reader. They can then withdraw as much cash as they want.

Now here is the real problem with biometrics. With the fake regular ATMs, the banks and police can put out a warning and those that realise they have been duped can quickly cancel their cards and get new ones sent to them. So how exactly can someone do this with an eye pattern that will remain with them for life?

Re:Dead people's eyeballs? I don't think so by Mythor · 1999-05-13 21:31 · Score: 1

There should be a 'mecanism' to detect if the scan has been performed on a 'dead eye': wheter the eye belongs to a dead person or has just been poped out of its 'socket'. If the system is to stay, massive announcement should be made to make sure criminals are informed that it's useless to 'steel' eye balls or kill someone if they want the scan to succeed.

Personnaly, i don't like this bio-metric 'authentication' applided to ATM... i'm already missing my little plastic card.

Re:Only an eye? by Gleef · 1999-05-13 21:33 · Score: 1

Most iris scanning systems can tell if they're looking at a live eye or a dead one. Stealing an eye would be useless (although stupid muggers might try anyway).

BTW, re the title of the article, it's an iris scan, not a retinal scan.

--

----
Open mind, insert foot.

Excellent point (eom) by smcd · 1999-05-14 00:49 · Score: 1

Excellent point

I'd think not. by cduffy · 1999-05-13 21:25 · Score: 1

The problem with hashing it is any differences from the original would result in a completely different hash.

With an unhashed value, one can allow a certain level of variance (due to electronic noise, lighting and other Real World stuff).

for more info by gavinhall · 1999-05-13 22:24 · Score: 1

Posted by Open Matrix:

For more information about the technology behind this click here to go to the Sensar website.

Re:Bypassing this security by gavinhall · 1999-05-14 01:51 · Score: 1

Posted by zann:

bioauthentication still has one flaw. consistancy. regardless of how many "charictaristics" there are, they all still boil down to 0s and 1s. to circumvent this kind of security, you will just need to be able to produce a standard, expected responce in a predetermined format. this could be done on the front end (the retinal scanner) or on the wire on the otherside of the scanner. i don not wish to say that a gauntlet has been dropped, but it is something to think about.

Re:We need this on the desktop by Eccles · 1999-05-13 21:35 · Score: 1

>What we need, and which may well happen within a few years, is a system like this for the desktop.

One magazine (PC Magazine?) did a review of thumb and voiceprint scanners. The best price/performance device, and one that they weren't able to circumvent via trickery, was the U.are.U fingerprint scanner, a ~$100 USB device. I'd love to have one, so simple even a small child can use it.

I tried websearching but couldn't find a homepage for it though.

--
Ooh, a sarcasm detector. Oh, that's a real useful invention.

Re:Wierd alternatives.... by lordhades · 1999-05-13 22:57 · Score: 1

Sperm? So if your girlfriend wanted to use your computer...

Alright Buddy... by mholve · 1999-05-13 20:46 · Score: 0

Gimme your eyes willingly or I gouge 'em out with this spoon!

Re:Eye Thieves.... by hawk · 1999-05-13 21:02 · Score: 1

Nah, the technology to remove an eye is ancient :)

hash it? by hawk · 1999-05-13 21:05 · Score: 1

Perhaps a password-style hash could be done, so that the actual retina information isn't stored?

OTOH, i simply presumed that they did this in the first place . . .

You are correct by cradle · 1999-05-13 21:56 · Score: 1

I know one of the people who work at
Sensar, and he indicated that the
scanner will reject dead eyes and the like.

Re:Iris scans not retina scans... by Fastolfe · 1999-05-13 23:24 · Score: 1

Not direct contact, but closer than would be comfortable at your average ATM.

Uhh.. by Fastolfe · 1999-05-13 23:28 · Score: 1

Banks already track your ATM movements using your ATM card and PIN. This doesn't make one iota of difference as far as the banks knowing where you are (or were). Chill out...

The only possible "privacy" concern I can think of is having an image of your iris available to your bank, which is personally something I could care less about, but some of the more paranoid on slashdot have loudly pointed this out.

Re:Uhh.. by Fastolfe · 1999-05-20 01:19 · Score: 1

All ATM's have video cameras recording you as you make your transaction.

I guess if you're really that paranoid you could make all of your ATM transactions using ski masks and platform shoes, but c'mon...
Re:Uhh.. by _Stryker · 1999-05-14 01:56 · Score: 1

Yes, but the difference is that I can give my ATM card to my wife, or my kids to use and then there is no way for the banks to know who actually used the ATM card. With iris scanning, there is no doubt that it was you and you alone that made the transaction.
---

Re:Privacy? Sure. by Fastolfe · 1999-05-13 23:33 · Score: 1

Banks don't routinely give out things like your PIN, do they? I dunno, in MY bank, nobody even has access to that information. There ARE secure ways of storing things like this.

It's also quite possible that a PIN will still be required to make a withdrawal. (Though I suppose if they've found some way to get at ultra-secure information like your iris image from the bank, they could get your PIN too, but I've never in my life heard of a single case where a PIN was retrieved from a bank...)

Re:Backup system would be needed as well by Fastolfe · 1999-05-13 23:35 · Score: 1

If you experience some sort of permanent or semi-permanent change, you'd probably want to make a quick visit to your bank to refresh that biometric data.

Though, like the other poster mentioned, iris scanning probably won't be the only way you can access your funds from an ATM.

Re:Contact Lenses by Fastolfe · 1999-05-13 23:37 · Score: 1

If you're wearing a contact lens designed to obscure the iris, naturally, iris recognition systems will fail to recognize your iris.

I doubt that this will be the only way to retrieve funds from your local ATM, however. There surely will be backup methods (like your traditional ATM card + PIN).

Re:We need this on the desktop by slim · 1999-05-13 20:40 · Score: 3

Hrm, the problem there is that an ATM can know (to some level of trustworthiness) that the data it's getting really is from an eye scanner.
If the data's coming off the net, who knows - it might be coming off a hard disk, grabbed from a sniffer, or anywhere....
If your password gets compromised, you can change it.... how do you change your eyes?

--

Iris/Retina by apilosov · 1999-05-13 23:25 · Score: 1

There's a funny thing about retina scans:
In mid-1980sh, it was discovered that AIDS virus does transfer with eye fluids. It was discovered when some major biometrics conference was under way. Noone at the conference agreed to test retina scanner, and that was the death of retina scanners.

Re:Iris/Retina by DrRobin · 1999-05-14 00:32 · Score: 1

Bad misinformation. HIV virus can sometimes be _detected_ in tears but there are _no_ known cases of transmission via this route. If possible, it must be _extremely_ rare and difficult or it would have been seen by now. That is not to say there is no worry since many infections _can_ be spread eye-to-eye but HIV is not one of them. Please, please get facts straight on this very serious topic.
Robin Colgrove MD
Laboratory of Molecular Retrovirology
Division of Infectious Diseases
Beth Israel Deaconess Medical Center
Harvard School of Medicine

Re:Alternative...except by marcus · 1999-05-13 21:01 · Score: 1

for Data and Lore.

--
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO

Getting your "eye" riped .. by Ex-NT-User · 1999-05-13 21:01 · Score: 1

won't work. Neither will a color copy of your face.
From what I remeber about these systems (Gata love the Discovery channel) they won't work if the eye is no longer attached to the user. The systems check to ensure that the eye is still "alive". (Small changes/fluctuations in the iris)

If someone mugs you and pokes out your eye the ATM will not authenticate it (the eye) because these changes will no longer occur. A picture won't work for the same reason.

The only way you can be mugged is either after you got the money out. Or haveing the mugger make you takout the cash at gun point at the cash machine. So nothing has really changed with the exception of not having to remeber a card and a pin number.

Ex-Nt-User

Re:How did they... by Ex-NT-User · 1999-05-13 22:10 · Score: 1

They didn't say how they tested that it works.. just that it does. I figure they did it with animals or something like that. (I know not a pleasant thought)

Ex-Nt-User

Re:Actually, we need an open source directory serv by osi · 1999-05-13 22:24 · Score: 1

OpenLDAP isn't bad at all. Dig up the nss_ldap module and you can store anything that NSS would use in a LDAP directory. LDAP is great!

Contact Lenses by pridkett · 1999-05-13 20:32 · Score: 2

As a side note, how do these things work with people who wear contacts sometimes and glasses other times. Would they not be able to wear contacts while using the ATM because it would mess up the iris scan? Anyone who knows something about this would be helpful, I don't want to look forward to a life where I have to take out my contacts every time I want to get money.

--
My Slashdot account is old enough to drink...

Re:Contact Lenses by haakon · 1999-05-13 21:02 · Score: 1

But what about those novelty contacts? You know cat slits, biohazad symbols and alike that completely obscure the iris. But as long as it can handle the full eye chrome set I'm looking at I will be happy.
Re:Contact Lenses by th0m · 1999-05-13 20:48 · Score: 2

according to this,
The iris pattern is processed and encoded into an IrisCode, which is stored in a database and used for recognition in any transaction when a live iris is presented for comparison. Eyeglasses and contact lenses are accommodated easily.

of course, this is specific to that company's implementation of iris recognition, but i suspect that it's all in the method. if you can algorithmically process an image of an iris into a representation that matches even after optical distortion, then you're set.

--
-- in china, chinese food is just called food.

Re:Scalpel muggings. by tgd · 1999-05-13 23:25 · Score: 1

Ugh, there's a lot of silly comments in here.

1) The thing requires the eye to be alive. Won't work with a goughed out eye anyway.

2) In comment to the guy talking about now someone will wait until you scan your eye and then shoot you or some such nonsense, WHERE ARE YOU LIVING? That happens all the time anyway.

This is so much more secure than an ATM card... the biggest valid problem I've heard with it was the fact that a parent doesn't have the option of telling their kid "go get me $40" or having a friend do it.

These, BTW, aren't anything new, its just the non-testing installation of it thats new. There've been a bunch of banks around the country doing it for a year or so on a testing basis, or at least so I remember reading last year.

Re:What about... by tgd · 1999-05-14 00:40 · Score: 1

Braile buttons or not, there's not very many ATM machines usable by the blind anyway.

I've never heard one voice prompt me...

Re:But a high-rez display with appropriate softwar by tgd · 1999-05-14 00:44 · Score: 1

I seem to recall reading last year that the visual range the scanners use is not the human-visible range, which is what miniaturized monitors display in.

I think they're into the near infared, so that the image remains contrasty with people whose eye color changes, etc...

Either way, I'd guess if you had a way to get a hires animated image of someone's eye, and fool the machine (which has to be looking for other facial items to even locate the eye -- you don't stick them in front of the camera with these), you're probably clever enough to steal the money from the bank in less easily-catchable ways than stealing from an ATM.

You do know that ATM machines photograph every transaction right? You're gonna look pretty silly holding the display over one of your eyes and hoping it'll work.

Iris scans and Friday nights... by dattaway · 1999-05-13 23:34 · Score: 1

It also says an iris contains 266 points of information, a lot more than a fingerprint. Put that in your pipe and smoke it.

In short time, ye old peace pipe can route more than 266 points of information on thee iris! After a night on the town, it might refuse to hand over the dough!

How long will it take for iris roadside checkpoints to catch the drivers that have been hammered and stoned? "We saw your red eyes all the way down the block, step out of the car please!"

Scalpel muggings. by djw · 1999-05-13 21:03 · Score: 5

Everyone who's worried about getting mugged for their eyeballs -- do you have any idea how unlikely this is? Here's a breakdown:

The mugger must knock you out and steal your wallet. This risk is already present.
The mugger must not immediately leave the scene of the crime, even though he's already got whatever cash and credit cards you were carrying.
The mugger must now use his scalpel, forceps, grapefruit spoon, melon baller, or whatever else he's got handy to remove your eyeball from the socket and sever the optic nerve and muscles that hold it in place, all without puncturing the eyeball in the process (which would probably result in an unusable iris due to the influx of blood).
You must not wake up during any of this.
Because of the $300-per-day limit your bank undoubtedly has on ATM withdrawals, the mugger must now appear on security video at multiple ATM locations over several days holding a severed eyeball, or the whole endeavor is only mildly profitable given the risk. Additionally, the eyeball must maintain its appearance for quite some time with no hydration or blood supply. Formaldehyde may help here; I don't know.

Conclusion: scalpel gangs are not going to rule the streets anytime soon. I'd be more worried about the reliability of the hardware, and the fact that while you can change a PIN, you can't easily change your iris pattern.

Dan Wineman

Re:Scalpel muggings. by Old+Man+Kensey · 1999-05-14 03:35 · Score: 1

firestarter wrote:
What we need is a reliable anonymous electronic payment system.
In a way, we have this already. Have you ever used a pre-paid phone card? You pop your money in, you get a card worth whatever you paid (typical amounts: $5, $10, $20) with an ID number on it.
There's no way to associate that card with you because the PIN (really an account number) is set when the card is printed, long before you walk up to the machine. Ran out? Get another!
A similar system is the DC metro, where you put money into a machine and get a paper card with a mag-strip on it. When you go through the gate you pop the card into a slot; at the other side you get a new card with the amount left printed on it. When you don't have enough left to go through a gate, you can pop the card into a farecard machine and add money; the value of the old card is added to what you put in and you get a new card.
I think a hybrid of these would work. You'd have a machine like an ATM, run by Your Favorite Credit Card Company. You put money in, give it a PIN for cash withdrawals and it spits out a card with a magstripe. Then you take this to a merchant and they run it through just like a Visa card.
The merchant knows they'll get their money because it's run by Visa (or whoever). You have your privacy.

--
-- Old Man Kensey
Re:Scalpel muggings. by Signal+11 · 1999-05-13 23:17 · Score: 2

Who's to say some criminal won't just sit by the ATM, and when you go to withdraw, he pulls a gun off-camera, and tells you to give him the $300 you just withdrew?

I mean, all we've done here is make the crime all the more violent and personal, with the added bonus of throwing your privacy out the window. I *like* anonymity. I don't care that there's a %0.01 chance that somebody might guess my pin and rip me off - that's what insurance is for. All I'm seeing is a bunch of greedy companies trying to keep the criminal element out... by compromising our privacy and anonymity.

--
Re:Scalpel muggings. by Jurph · 1999-05-14 01:52 · Score: 1

Good points, all... so what is the likelihood of a nationwide (or worldwide) retina database that business owners can access for a fee? Gov't sponsored registration of all US citizens at birth (or at full retinal development age).

There could be a lock system, implemented at Customs, so that upon entry to the US, you pass through, show your visa, and scan your peepers; this "logs you in" to America and lets you buy things legally--life becomes much more difficult for illegal immigrants.

Sure, you'll have business owners who won't subscribe-- they'll put "cash only" signs in their windows, or an eye in a slashed red circle, and get a reputation for being 'swarthy' and 'unreliable' places; the media could portray them as such, and make a bigger deal out of robberies. To combat this backlash and show that a business has implemented eyeball-based payment, they could put a small picture of an eye on their door or window.

Now, I'm sure the NSA and FBI would love that--tap the machines that read from the database and flag the locations of known criminals. The eyeball could stand for that well-worn phrase about Big Brother's voyeuristic habits.

Sound fun to anyone?
Re:Scalpel muggings. by Stephen+Williams · 1999-05-13 21:07 · Score: 1

Because of the $300-per-day limit your bank undoubtedly has on ATM withdrawals, the mugger must now appear on security video at multiple ATM locations over several days holding a severed eyeball, or the whole endeavor is only mildly profitable given the risk.

ROTFLMAO!

(sorry about the zero-content posting, but I had to congratulate djw for providing me with the funniest mental image I've had all day. Cheers djw :-)
Re:Scalpel muggings. by firestarter · 1999-05-13 23:35 · Score: 2

Iris scanning for ATMs aims at solving a symptom (reliable access to cash) to a problem (cash itself).

What we need is a reliable anonymous electronic payment system. I think Mondex is close to this (although I don't know too much about it myself). Something where you can charge an electronic card up with cash units from your credit card in the comfort of your own home would give you:

1/ Greater security, since you're not getting a large quantity of cash at an obvious crime target (static ATM).
2/ You don't need to carry so much anonymous money , since you can recharge at your leisure.

Differentiating between anonymous money and verified money is important. Verified money (with a good verification system) is difficult to steal (a signature on a credit card slip is verified but it's not a good system). Anonymous money is necessary for your privacy, but is more attractive to criminals. The convertion point where you exchange verified -> anonymous money carries the greatest security risk and the sooner it is removed from public places the better.

I believe it is is iris scanning... by RealTime · 1999-05-13 20:16 · Score: 0

not retina scanning.

--

Yesterday it worked; today it is not working; Windows is like that...

I'd think that biometrics would be a security risk by cpt+kangarooski · 1999-05-13 20:33 · Score: 3

Think about it - you've just eliminated the current ideal of compartmentalizing your proofs of identity (e.g. passwords, accounts, etc.) by having them all use a single key. Namely your eyeball, which will, sooner or later, not be all that useful once someone figures out how to spoof the scanner.

I'll stick with different passwords for everything important, thanks.

--
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.

DNA is easier to steal, too. by jani · 1999-05-14 01:23 · Score: 1

I can't imagine why anyone would even _think_ about having one's finger pricked for a drop of blood should be good enough for determining identity anyway.

That must be one of the most insecure ways of identification, except for the From field in e-mail messages or news articles.

If you believe that DNA is good enough to identify you, and at the same time think it is scary that virtually anybody can pick up the scraps of your own body you leave behind to _track_ you down, I'm really, really surprised that you can't connect the two to:

The same virtually anybodies can take those scraps of skin, hair, blood remains etc from your garbage, hotel room, car, whatever _and put it somewhere else_, pretending that you were there. But of course you weren't there, just some minor parts of you somebody else stole.

You don't have to see "Conspiracy Theory" and believe in it to think that these things can happen. They can happen because someone has thought about it, and because there tend to be people who abuse every new thing they can come across. That can be your everyday psychopathical specimen, it can be a super-secret government agency (for which government?), it can be organized crime, it can be a prankster, it could be an accident.

So don't go around trusting DNA to be of any help.

What are the alternatives, then, if you don't believe an iris or retina scan is good enough?

Well, you can apply some modern image recognition software. Today, it's possible to recognize a person from her facial features, even through physical changes such as minor injuries (swollen eye, fresh cut across the face, etc), with a precision similar to that of fingerprints (I honestly cannot remember which way is more sure, except for fingerprints having lots of "proven" technology behind it).

This makes it possible to recognize that person's most common facial expressions.

Take this one step further, into recognizing several facial expressions in succession (that is, the way your face changes).

Use cameras from several angles to make sure that it is a real person, and not some face superimposed on a dummy/robot.

Require that your voice is synchronized with (and matches) your facial movements when you say "I want to withdraw some money" (or whatever your not-so-secret passphrase is).

Feel free to combine this with some other method that can be performed simultaneously, such as measuring iris response to varying light level, blood pressure and pulse, perhaps even the fingerprint (but that can be faked more easily).

The bonus for the customer is that this would take less energy and time than remembering a PIN code and punching it in, and/or leaning towards a scanner to measure the exact retina, but would still be at least as secure.

The downer is that this technology has yet to be actually implemented, tested and "proven" in a real user environment, and that it'll probably be a bit expensive for the next five years or so, until technology catches up and becomes really cheap.

This doesn't prevent someone from threatening you or your family to force you to withdraw money, buy a Corvette or whatever, but what does? Maybe sometime in the future, we can actually determine for sure whether someone is under pressure for doing things, and that she shouldn't be doing it. I somehow doubt that, but we'll hopefully live to see.

Camera positioning by drw · 1999-05-14 03:29 · Score: 1

Being someone who is confined to a wheelchair, I am curious as to where the camera is located. I assume that they are positioned for a standing person of average height, which would be impossible for me to get to.

I hope that they are providing an alternate way of identifing yourself. Like the old-fashioned ATM card with a PIN.

Re:Iris scans not retina scans... by Old+Man+Kensey · 1999-05-13 23:21 · Score: 1

Ares wrote:

I doubt most people would want to subject themselves to a retina scan given the current state of the art. It requires the scanner to come into direct contact with the eye.

Actually, no.

I had a retinal photo the other day as part of my latest eye exam. The lens does get close-in, but it didn't touch my eye. It does shine a very bright linear light in, and the camera rotates from one side to the other (like a panoramic camera).

The afterimage of the light had very clear tracery of the retinal blood vessels in it.

--
-- Old Man Kensey

Actually, we need an open source directory service by cthonious · 1999-05-13 20:50 · Score: 2

Something like NDS, but it won't do it any good until all the server apps are directory enabled.

sendmail, imap, inn, nfs, lpd, apache ... all this stuff needs to be directory enabled. This way one can log on once and have access to all the network resources that are directory-aware.

We do have Open LDAP but I find it a bitch to set up and use. Don't know much about the Open Group's DCE, it looks expensive.

I guess one could roll one's own (using PAM and such), but that is more work than most people care to do.

--

support gun control: take guns from cops

Iris scans not retina scans... by Ares · 1999-05-13 20:22 · Score: 2

Everyone seems to be pointing this out. Can't imagine why. Anyway, I doubt most people would want to subject themselves to a retina scan given the current state of the art. It requires the scanner to come into direct contact with the eye. Not exactly my idea of a good time.

Re:Iris scans not retina scans... by Duke+of+URL · 1999-05-13 23:27 · Score: 2

Is that true? You need to put your eye against the scanner? I would NEVER put my cornea up against anything else that other people may have toched in any fashion. The cornea (clear part over your iris) does not receive direct blood flow, thus it is more difficult to fight off infections which could be picked up from direct contact with the scanner.

Here's a link to a picutre of the anatomy of the eye

Re:Bypassing this security by MenTaLguY · 1999-05-13 21:51 · Score: 1

as someone who is not likely to have time to
see the movie, how did they do it?

--

DNA just wants to be free...

Only an eye? by Optic · 1999-05-13 20:22 · Score: 3

The person who sent in this link makes an excellent point... I wouldn't want to be mugged for my eyes. That's why I find it stupid to only have a single form of authentication. A PIN number or some other code should be used as well, to make eyes less attractive to would-be theives.

1. something you HAVE
2. something you ARE
3. something you KNOW

/me shrugs. :)

Re:Another privacy concern... by Fletch · 1999-05-13 22:45 · Score: 1

having a PIN should be the customers option when he/she signs up for the account.

Re:yeah, but what about... by JerkBoB · 1999-05-14 03:05 · Score: 1

I don't think that the system cares about iris color. Have you ever looked at an iris closely? There are all kinds of blobs and squiggles, and those are what the system records.

Incidentally, my eyes change color, as well. It's kinda fun. My eyes are brown or green or somewhere in between, depending on my mood.

--
A host is a host from coast to coast...
Unless it's down, or slow, or fails to POST!

Fashion Models better ATM disable their accounts by Jon+Luckey · 1999-05-14 01:25 · Score: 2

An Iris is pretty huge. From what I can tell from the article, that the eyes are not very close to the scanner and must have a fair amount of variation in closeness to the camera.

I am sure that there are plenty of pretty high resolution photographs that show details of people's irises. For example, people on magazine covers. How difficult would it be to laser print one on an elastimer sheet, and distort the iris sections mechanically to simulate pupil contraction. A photocell here, a solinoid there, ia bit of circuitry, and boom, a photosenisitve facial fascimle.

Sure magazine could use photoshop or such to replace irises in pictures before publication, but what about the thousands of pictures already out there.

Irises are just too 'out-there' in plain sight. Its like walking around with your pin number tatooed on your face. Anyone with a telephoto camera could steal it.

--
-- 3 events that reshaped the world in the 20th century: WW1, WW2, and WWW

Do these machines have instructions in Braille? by fishbowl · 1999-05-13 22:51 · Score: 2

How do they get around the A.D.A.? (There
are Americans without eyes...)

--
-fb Everything not expressly forbidden is now mandatory.

Re:We need this on the desktop by XNormal · 1999-05-13 21:30 · Score: 1

Using biometrics on your desktop for securing network access is tempting but it is also very dangerous - there must be a secure path from the reader to the verifier. In the case of an ATM it is physically secured inside the ATM strongbox.
On a network it would have to be a combination of cryptographic authentication and a tamper-resistant reader (no such thing as tamperproof).

Without this it would be ridiculously easy to sniff your iris/finger/hand/face/voice print over the network and impersonate you.

The embedded cryptographic engine inside the tamper resistant reader would use a challenge-response algorithm to ensure that:

1. The scan comes from a real scanner
2. The scan has been performed in the last few seconds.

Without this, it is useless.

--
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.

Desktop biometrics - dangerous unless done right by XNormal · 1999-05-13 21:14 · Score: 5

Using biometrics on your desktop for securing network logins is tempting but it is also very dangerous - there must be a secure path from the reader to the verifier. In the case of an ATM it is physically secured inside the ATM strongbox.
On a network it would have to be a combination of cryptographic authentication and a tamper-resistant reader (no such thing as tamperproof).

Without this it would be ridiculously easy to sniff your iris/finger/hand/face/voice print over the network and impersonate you.

The embedded cryptographic engine inside the tamper resistant reader would use a challenge-response algorithm to enable the server to ensure that:

1. The scan comes from a real scanner
2. The scan has been performed in the last few seconds.

Without this, it is useless.

--
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.

iris images being stored. by magister · 1999-05-14 02:36 · Score: 1

First off this sounds very insecure. i work on computers 24/7 and i dont trust any computer outside my reach. I think they should implement a more secure method.

My idea would be more like, when applying for the account they have a randomly generated 4096byte key genrated, this would be used to unlock you accound when it needs to be accessed to with draw from an ATM or else ware. Then they could use you iris as the encrypting key using somthing like RSA's RC5-64, or somthing better.

That way when you goto get some money from the ATM machine it just uses you IRIS to decrypt the key to unlock you account. no need to store you iris, execpt in your head :).

It just seems more secure that way, cause if some one did break into the banks computers, then they would be trying to decrypt keys for a long time, you will probly be dead and have passed you money on in your will befor it gets cracked.

--
-magister-

They won't have to take your eyeballs by ch-chuck · 1999-05-13 20:18 · Score: 1

Sounds like it might be fairly trivial to get
somebody's retina scan - Don't know anything about
it but the article sounded like you just stand
there - does one have to put there eye up to
something like looking into a microscope to be
verified?

Chuck

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }

ok - IRIS scan by ch-chuck · 1999-05-13 20:24 · Score: 1

hmmm still wonder if holding a fake eye up to it would work, cloned by, say, a portrait photographer.

Chuck

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }

Another privacy concern... by MAXOMENOS · 1999-05-13 20:32 · Score: 4

The inventor of this technology assures us that photographs of irises will not be distributed outside of the bank. But as we know, accidents (and outright negligence, and occasional criminal behavior) do happen.

It's easy to replace a stolen ATM card, and maybe even to get your ATM number changed. But what if your iris image gets stolen?? Once that cat is out of the bag, how can the bank ever trust your eyes again, and how can you ever prove that it wasn't you who withdrew $700 in Jamaica?

At the very least, they should incorporate a PIN number with this, to ensure that fraud doesn't occur. Even if they have your eyes, they can't get your money without a PIN. In my mind this would be the best solution all around: no card to lose, your eyes become immensely less valuable for a mugger, and if your iris photo is stolen, it only increases their chances of stealing your money to one in ten thousand. I'm not saying iris checking with PIN is crimeproof, but iris checking with no PIN is a rotten idea.

--
Finding God in a Dog

Problems with Pregenant women resolved? by afniv · 1999-05-14 02:47 · Score: 1

Some years ago (3 or 4 years), I was shown a tour of a highly secured U.S. Air Force base. There was some talk about some of the security measures. I never observed this particular one, but to enter certain areas, one had to stand in a small phone booth size compartment (so only one person could enter) and then would have to submit to a retinal scan before the person would be allowed through.

It was discovered, using these devices, that a woman's retina changes slightly during a pregnancy. I guess more than a few times the poor trapped woman trying to get into the secured area would set off the alarm and immediately be surrounded by armed security guards. Supposedly, this was how some women first learned they were pregnant.

I wonder if this is true for modern retinal scanners? Either that or your money is safe if your wife is pregnant.

~afniv
"Man könnte froh sein, wenn die Luft so rein wäre wie das Bier"

--
~afniv
"Man könnte froh sein, wenn die Luft so rein wäre wie das Bier"
Richard von Weizs

Correction by afniv · 1999-05-14 02:57 · Score: 1

I'm actually sure if it was a retinal or an iris scan. If it was retinal, perhaps the iris scan is immune from changes during a pregnancy.

~afniv
"Man könnte froh sein, wenn die Luft so rein wäre wie das Bier"

--
~afniv
"Man könnte froh sein, wenn die Luft so rein wäre wie das Bier"
Richard von Weizs

Actually...it's *iris* scanning... by dschuetz · 1999-05-13 20:15 · Score: 3

I hate to be picky, but these machines scan the details of your iris (the color in your eyes around the pupil), not the retina (which requires, IIRC, bright light and a close-in lens).

Other-n-that, pretty darned cool. Though I'd still like to have a code of some sort (might be nice to have an "emergency" code that'd provide money, but call the cops, too...or something like that...)

Re:Alternative... by haakon · 1999-05-13 20:53 · Score: 1

No need to worry, even evil twin brothers have different fingerprints. Fingerprints are influenced by your development in the womb rather
than your genetics. (Warning this information was retrived from an unreliable source, my memory).

Re:But a high-rez display with appropriate softwar by baglunch · 1999-05-14 00:44 · Score: 1

So you have a larger central light source that brightens and dims randomly. You have a series of LEDs around it's border. These LEDs turn on one at a time in a random fashion. The combination of these two random events, coupled with your iris's reponse to them should provide a pretty compelling security arrangement.
But I don't think that this is sufficient. It would be nice to have a brainwave recognition complement to the iris ID. When you are getting your iris scan, you think of something in particular and don't tell anyone. So your iris pattern is recognized in conjunction with how your eye responds to what you are thinking of, combined with the particular pattern of your brainwaves upon thinking of this something. Even if everyone thought of Sex with the same person in the same position in the same setting, etc., everyone would think of it in different ways, would have different brainwave patterns, and different iris reactions. It'd be interesting to see a spoof that circumvented this.

--

Work is for people who lack the imagination to play.

Re:Bypassing this security by smileyy · 1999-05-13 20:20 · Score: 1

I dunno. Mug you afterwards?

--
pooptruck

Re:The Hindenberg effect by Shadarr · 1999-05-14 01:41 · Score: 1

And good riddance, if you ask me. When you see things like this working in science fiction it assumes a totally secure system, which we all know cannot be built. I would much rather see advances in smart-cards and e-cash, something that retains the anonimity of paper money (anyone read Shadowrun?).
If this doesn't get shot down, 10 years from now you won't have any cards, you'll just get your eye scanned everywhere. That gives crackers way more power, because once the system is breached your whole identity can be stolen. If someone steals your drivers license, you can get a new one and invalidate the old. If someone replaces your iris scan with thier own, how do you prove you were ever you?
Besides which, are PIN's really that insecure? The people who get thier accounts raided are the ones SMRT enough to write it on the card, or use 1111. Do we really need to give away all our privacy to protect morons from themselves?

--
Bite the hand.

How do you revoke your iris by Squamus · 1999-05-13 23:26 · Score: 1

One of the primary tenents of a good auth system is revocation. The system will eventually be hacked, count on it; and when it is, how does the unfortunate viction go about getting a new "password".

--
A pithy quotation of someone I've never met.

Already in UK by samael · 1999-05-13 20:49 · Score: 1

Wasn't this already tried in the UK? I'm sure one of the banks over here ran a trial with a few machines. It was very popular IIRC. People loved being able to do without their cards.

--
My Journal

Re:Already in UK by fmackay · 1999-05-13 22:30 · Score: 1

Yup, I remember seeing it on "Tomorrow's World" several months ago. In Swindon I think - every new technology seems to get trialled there, the demographics of the population map almost exactly onto the national population, or something. Anyway, I seem to remember that you still needed a card - you didn't have to remember a PIN tho'. You'll still need a card anyway - debit/credit card, or cheque guarantee, so why bother?

Bypassing this security by dmuth · 1999-05-13 20:16 · Score: 1

I'm curious as to how crooks/con artists are going to try and bypass this kind of security. Maybe we'll see a black market pop up for glass eyes that are replicas of legitimate bank customers' eyes. :-)

Re:Bypassing this security by tofupup · 1999-05-14 01:57 · Score: 1

settle down bevis
Re:Bypassing this security by periscope · 1999-05-14 04:03 · Score: 1

An "easy" way around this little problem is to use RF signals. As anyone knows, electronic devices such as ATMs use electronic control signals. Transmitting on the correct frequency will cause the eye-scanner to "think" that it is receiving scan pictures - actually, they will be radio signals interfering with its operation. SECOND WAY to do this is as follows.... YOU ***ALL*** SHOULD BY NOW know those new projectors which use lazers to project pictures into your eye instead of using areal screen? Well, just use one of those to project an iris scan onto the screen. 3. Hack into the back computer and add your own scan in place of someone else's (best use someone else's iris - in case you get cought... :-). 4. I will NEVER let any bank store my IRIS scan unless ***THEY*** sign a contract to say who sees it (this will include not divulging it to the US government or the police. Furthermore, I would demand to be allowed to attempt to hack in to the computer to see how secure it is. At this point I would expect to be told where to go, so you can see that I won't be having an IRIS controlled bank account anytime soon.... :-)

--
http://www.jonmasters.org/
Re:Bypassing this security by MindStalker · 1999-05-13 23:49 · Score: 1

I saw it, but couldn't quite make it out though basically what they did was they had a friend who worked where this guy went in for an eye exam. So their friend was able to get a copy of the retna/iris scan from the computer at the doctors while it was being scanned. And they created some sorta interface.. I couldn't quite make out what it was quick moving movie that used this information and spit it into the scanner
Re:Bypassing this security by p00ploop · 1999-05-14 00:05 · Score: 1

Hmm.... Sounds like a classic birthday problem to me.

Ben
Re:Bypassing this security by Patman · 1999-05-13 20:36 · Score: 1

If you haven't seen "Entrapment" yet, do so - it's got an interesting way to get aroung this problem, and it didn't seem too "techie" - seemed reasonably doable.
Re:Bypassing this security by drudd · 1999-05-14 00:54 · Score: 1

And that's why there's the handy dandy security camera behind that neato little mirror on the ATM.

--
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!
Re:Bypassing this security by cakes · 1999-05-13 21:50 · Score: 1

When I saw (what I assume is) the underlying work presented about 6 years ago (by the inventor), he said you could ensure it was a real living iris by stimulating it with light and monitoring how it reacts - the check test worked regardless of pupil size as the iris just shrinks when the pupil is enlarged, so the pattern remains the same.

ISTR the test used a Gabor function on the scanned pattern, and it worked when there was the iris occupied about 80 pixels or more in diameter.
Re:Bypassing this security by jeru · 1999-05-14 00:17 · Score: 1

if I'm going to hold you up at the ATM machine, I can now just slam your face against the glass and let it scan you. No more extorting PIN codes. This will have a zero result on security, with the exception that ATM fraud will decrease. Though, who's to say you couldn't create a fake iris which you could encode at will, just like they have for the magnetic strips on credit cards? Its just a computer on the other side...that's never stopped anyone before.

Iris Scanning CRACK!! Contact lenses are the key! by Ron+Bennett · 1999-05-14 03:55 · Score: 1

Seems to me that all one must do is get a high resolution photograph of someone elses irises and print these out to the aprox real size onto contact lenses. There's many methods by which this could be done.

I've even seen some movies in which spies were protrayed using such a method to defeat iris security. So it's certainly not a new idea, but one most people wouldn't think of.

Wonder how they will prevent people from bypassing IRIS security via this method?? I bet they really can't unless they also still require a PIN...but then what's the point of the whole IRIS scanning thing if one still needs a PIN anyways?? DUMB!!

Ron Bennett

Re:What about... by BrownJ · 1999-05-15 10:03 · Score: 1

Yes, I'd feel very safe with a voice prompt like...
"Enter YES to verify $1000 withdrawal"

--
Eh?

Re:Bright light.... make it stop by th0m · 1999-05-13 20:45 · Score: 1

we've got to stick our eye up against some camera, while we have a really bright light shone directly into it so that it can check our iris

that's how a retina scan would be; iris scans just use a regular video image of the front of your eye, so really you're only limited to the quality of the image that a video camera can produce at distance. i think that current systems can recognize you at a distance of a foot or so.

--

-- in china, chinese food is just called food.

Re:But a high-rez display with appropriate softwar by th0m · 1999-05-13 21:28 · Score: 1

assuming for argument's sake that a display could ever produce an image that was sharp and high-res enough to fool the camera, it still wouldn't work against systems that tested for a live eyeball.

if the system was looking for pupillatory oscillations it wouldn't find them, unless you were playing high-resolution video of a real eyeball. if it was generating different light levels and observing the response of the iris, the static / prerecorded video image wouldn't be up to par.

and if you were smart enough to develop an interactive, real-time, high-resolution, realistic computer-generated iris image that can behave just like a real eye and respond instantaneously to external stimuli, why the fuck would you waste your time trying to get fifty bucks out of an ATM?

--

-- in china, chinese food is just called food.

glass eyes won't work by th0m · 1999-05-13 20:40 · Score: 5

one of the cool things about iris scan technology is that it (can be configured so that it) rejects 'fake' id material like a photograph of an iris, some kind of model of an eye, or even a dead guy's eyeball.

the human pupil naturally oscillates and responds to changes in light level; a particularly secure iris recognition system could make use of this by, for example, providing a variable light source over the course of a few seconds to ensure that the iris is 'live' and not somehow simulated.

this is similar to the capabilities of that desktop face-recognition software that was going around a couple years ago - you could put it in a mode where it asked you to blink or smile or something during the recognition process. a bit less convenient but a bit more secure.

http://www.iriscan.com/ has some good information about iris scanning, particularly this page.

--

-- in china, chinese food is just called food.

Re:glass eyes won't work by sjx · 1999-05-14 01:54 · Score: 1

Damn.It would have to be the right eye they chose, wouldn't it?... as opposed to the eye on the left-hand side, I mean.

So, how on earth are people who have one eye (or less) supposed to get their cash out? What about the accessability factors?

--
-- /sjx.

Re:Alternative... by landtuna · 1999-05-13 20:37 · Score: 1

Except thumbscanning sucks when you have an evil twin brother. I think irises are supposed to be different between twins.

Invasive? All you lose is your deniability! by FatSean · 1999-05-14 00:44 · Score: 1

And me? I'm for all deniability a person can get!

--
Blar.

Even worse than scalpel muggings. by the_tsi · 1999-05-13 23:42 · Score: 2

What's MORE frightening is that five years from now everyone will be getting email chain letters that talk about some guy who goes to a party, gets a drink, and wakes up in a bathtub full of ice without his eyeballs.

-Chris

The news in texas.. by Ellis-D · 1999-05-13 20:22 · Score: 0

The story I saw on channel 4 was funny. They said this technology was only seen in the movies... I saw this about a couple months ago in Electronics Now.. But the military uses retna scanning on classified project and has been using that technology since the early 80's.
"Windows 98 Second Edition works and players better than ever." -Microsoft's Home page on Win98SE.