Devices can recognise you from your fingerprints, iris pattern and even your heartbeat but while a stolen password can be changed, pilfered prints cannot
Wade Prince pulls out his iPhone and opens up his banking app. Instead of entering a password or pin, he looks into his phones front-facing camera, as if he were taking a selfie. He lines up his face in a window on the screen and within seconds hes logged in.
Its so simple, he says. I can then access my checking and savings accounts, or handle my homeowners insurance or car insurance through the app.
Prince, a government contract consultant based in Maryland, has signed up for the biometric logon service offered by United States Automobile Association. This lets customers access their accounts using their face, fingerprint or voice.
Biometric security doesnt rely on what you can remember, but who you are. It swaps passwords for digital readings of anatomical features such as your face shape, fingerprint, iris, heartbeat and even brainwave patterns.
The password system is severely broken, explains Thomas Keenan, a professor and expert in biometrics from the University of Calgary.
Weve been relying on them for 40 years, but people now have so many and they are so complex that we can no longer remember them. You cant forget body parts and they are much harder to duplicate or steal.
Apples Touch ID, a fingerprint authentication, launched with the iPhone 5s in 2013, and similar capabilities feature in Microsofts latest operating system, Windows 10. According to Biometrics Research Group, 650 million people will be using biometrics on mobile devices by the end of 2015.
Its not just phones and operating systems incorporating the technology: ATMs, cars and briefcases have all been secured with fingerprint (and sometimes palm vein pattern) recognition technology. And, as of January 2016, a company called Sentinl will start selling Identilock, a gun-lock that will only release the trigger when the rightful owners finger comes into contact with it.
Fingerprinting technology is the most common biometric, but a number of companies are experimenting with alternative identifiers such as face recognition and iris scans, which are raising privacy concerns.
Data breaches are very common. If biometric information is stored on a mass scale it can be hacked into and stolen and we may lose control of it, warns Jennifer Lynch, a senior staff attorney at the Electronic Frontier Foundation, a digital rights group.
Lynch is particularly concerned about the rise in use of facial recognition in shops which use it to identify thieves and high rollers and other public spaces. Depending on what that data is linked to, it could be very threatening to privacy, she adds.
The same characteristics that make biometrics seemingly secure are what also make them so intrusive. If passwords are stolen we can change them. We cant change our fingerprints or our faces. History has shown that storing any kind of personal data presents a tantalising bounty to malicious hackers as demonstrated when the fingerprints of 5.6 million US federal employees were stolen in September.
Its a concern expressed by Pippa King, who has been campaigning against the use of biometrics in schools which has become widespread in the UK and USA for more than a decade.
I dont think the technology is bad. It has a place in society in banking and military applications but there is no case whatsoever to use it on a five-year-old to get a library book out from the library, she says.
She believes that these systems desensitise children to giving up their biometric information without grasping the consequences.
Its you. If it gets compromised in any way, which it could do, that could have serious implications later down the line for buying a mortgage, opening a bank account, getting insurance. Whats being gained against that? she says.
Other biometric technologies to start creeping into the mainstream include iris scanners, which can now be found in two Fujitsu-manufactured devices for the Japanese market and heartbeat identification, which can be found in smart wristband Nymi. When the wearer sits down at their computer, the wristband wirelessly communicates their identity so that the machine automatically unlocks.
Karl Martin, the companys founder, argues that the heartbeat data is more secret than other biometrics, which makes it harder for someone to steal your identity.
It cant be captured in a photo from a distance like your face or iris. You leave fingerprints all over the place, but to copy someones heart-rate you need direct skin contact, he says.
Even if some biometric systems are harder to crack than others, no security system is impermeable. Biometric hackers from Germanys Chaos Computer Club bypassed Apples Touch ID just days after it launched by taking a photograph of a fingerprint on a glass surface and using that to create a fake finger that could unlock the phone.
A year later a member of the same hacking group, Jan Krissler, cloned the thumbprint of the German defence minister, Ursula von der Leyen, after photographing her hand from a distance at a press conference.
After this politicians will presumably wear gloves when talking in public, Krissler joked at the time.
Its not just fingerprints that can be spoofed. Some facial recognition tools can be fooled by simply holding up photos or videos of the individual. Meanwhile, a team of Spanish researchers managed to trick eye-scanners with reverse engineered fake irises.
The risk of spoofing can be mitigated through the use of more sophisticated sensors such as ultrasound-based fingerprint scanners, which detect the pulse in the blood vessels under the skin or through multi-factor authentication. This is the combination of different biometric identifiers to reduce the likelihood of any foul play.
For USAA customer Prince, the payoff is worth the risk. He trusts the bank and likes the convenience. However, he points out, hed be wary of using biometric authentication elsewhere.
Because of this nervousness around data breaches, most technology companies including Apple and Microsoft ensure that the biometric data is stored on the device and not on a central server.
The only way your biometric could be compromised is if somebody could gain access to your personal device and break its encryption. Its bad for you, but its not the same as getting a massive database of biometric information for all Microsoft users, explains Lynch.
But the risks are really outweighed by the benefits, she adds, pointing out that the convenience of biometrics means that people who typically eschew passwords because they are too fiddly are more likely to secure their devices.
Lauren Devine, a lawyer and academic expert in child protection and safeguarding, is wary.
She recounts the moment when her 13-year-old son Jacob now 16 was sent to isolation for refusing to register his fingerprint to use the school canteen.
I went to school and said that I didnt give my consent. As a parent I want to be clear that the decisions I make that affect my children are in their best interests.
This is a technological area where the implications are not fully understood. Its very difficult to know whats happening to the biometric data and be completely confident that it will only be used for the purpose you consent to, she says.
Thankfully, some of the more dystopian fears of criminals turning to finger amputation to gain access to high-value devices are rejected by experts. If Im going to cut your thumb off to open your phone, why dont I just put a knife to your throat? jokes White.
It involves less blood, you wont scream as much and it should have the same result.
Read more here: http://www.theguardian.com/us
