>then the vein signature could be updated evertime the person is scanned successfully
This is actually a very bad idea!
Consider what happens if someone (let's call them Alice) gets mis-identified (identified as someone else, say Bob). There is a non-zero probability that this happens with any biometric system, called the False Acceptance Rate. If you use a large enough biometric database (the US Gov't appears to like those a lot) for 1-to-many matching and this probability approaches 1. Alice's live scan will match Bob's recorded reference data, probably only just within the maximum delta, but that's good enough. Now look at what happens if you update the recorded reference data (Bob's) with the live recording (Alice's). The recorded reference will be migrated towards Alice and away from Bob. Do this a couple of times, and Alice is more likely to be identified as Bob than Bob himself! Not good.
Note that it is not even necessary for Alice to be enrolled in the system with her own biometrics. In fact, the chances of her getting mis-identified are higher if she's not...
> Yes, the same is true of any security system of any sort -- but for reasons I can't fathom, biometric-based security systems seem to give a higher "sense" of protection to the executives writing the checks.
Biometrics (what you are) have a crucial advantage over passwords (what you know) or tokens (what you have) because they are non-transferrable. They make it more difficult to commit fraud in, for example, time and attendance control systems.
> Some day in the very near future there will be a way to easily duplicate fingerprints, vein prints, retina prints, or whatever.
Some day in the very near future, there will be biometric scanners that can tell the difference between real/live and fake/amputated body parts. The fact that there are not many now is mostly due to the fact that nobody wants to pay for them. People seem to think that spoofing is not an issue. But it is, or will be. As biometrics are increasingly used to protect things of value (cars, credit cards, etc), it becomes more profitable to develop spoofing techniques. That, in turn, makes it more profitable to develop better liveness detection methods. It's an arms race, really.
> It is not uncommon for the smaller bloodvessels to simply disappear and appear over time to facilitate changes in energy consumption.
Good point. The article does not mention immutability over time at all, although this is a make-or-break feature of biometrics. Especially when the changes are gradual, this is a killer. If the change is a one-time-only event, such as an accident or surgery, you can always re-record the person's reference biometric. But you don't want to have to do this every week, for practical and security reasons.
Dancin Santa wrote: >I find it worrisome that the verification of something as personal and important as someone's identity is based on something as common and repeatable as the pattern and layout of veins.
According to Fujitsu (in TFA), their method is capable of identifying one hand from a population of 1,250,000 (they claim a FAR of 0.00008%). So the vein pattern is not as 'common and repeatable' as you think; the differences may be subtle, but they're large enough (provided their claims are true, of course).
Slashdot Mirror
>then the vein signature could be updated evertime the person is scanned successfully
This is actually a very bad idea!
Consider what happens if someone (let's call them Alice) gets mis-identified (identified as someone else, say Bob). There is a non-zero probability that this happens with any biometric system, called the False Acceptance Rate. If you use a large enough biometric database (the US Gov't appears to like those a lot) for 1-to-many matching and this probability approaches 1. Alice's live scan will match Bob's recorded reference data, probably only just within the maximum delta, but that's good enough. Now look at what happens if you update the recorded reference data (Bob's) with the live recording (Alice's). The recorded reference will be migrated towards Alice and away from Bob. Do this a couple of times, and Alice is more likely to be identified as Bob than Bob himself! Not good.
Note that it is not even necessary for Alice to be enrolled in the system with her own biometrics. In fact, the chances of her getting mis-identified are higher if she's not...
> Yes, the same is true of any security system of any sort -- but for reasons I can't fathom, biometric-based security systems seem to give a higher "sense" of protection to the executives writing the checks.
Biometrics (what you are) have a crucial advantage over passwords (what you know) or tokens (what you have) because they are non-transferrable. They make it more difficult to commit fraud in, for example, time and attendance control systems.
> Some day in the very near future there will be a way to easily duplicate fingerprints, vein prints, retina prints, or whatever.
Some day in the very near future, there will be biometric scanners that can tell the difference between real/live and fake/amputated body parts. The fact that there are not many now is mostly due to the fact that nobody wants to pay for them. People seem to think that spoofing is not an issue. But it is, or will be. As biometrics are increasingly used to protect things of value (cars, credit cards, etc), it becomes more profitable to develop spoofing techniques. That, in turn, makes it more profitable to develop better liveness detection methods. It's an arms race, really.
> It is not uncommon for the smaller bloodvessels to simply disappear and appear over time to facilitate changes in energy consumption.
Good point. The article does not mention immutability over time at all, although this is a make-or-break feature of biometrics. Especially when the changes are gradual, this is a killer. If the change is a one-time-only event, such as an accident or surgery, you can always re-record the person's reference biometric. But you don't want to have to do this every week, for practical and security reasons.
Dancin Santa wrote:
>I find it worrisome that the verification of something as personal and important as someone's identity is based on something as common and repeatable as the pattern and layout of veins.
According to Fujitsu (in TFA), their method is capable of identifying one hand from a population of 1,250,000 (they claim a FAR of 0.00008%). So the vein pattern is not as 'common and repeatable' as you think; the differences may be subtle, but they're large enough (provided their claims are true, of course).
> The thing weighs a ton and is as easily moved as a freshly-dead hippopotamus.
As opposed to, say, a month-dead hippopotamus?
> Can we tell George to do the same ;)
For a minute I thought you meant George Dubya...