Monday, January 2, 2012

Alternatives to passwords: Replacing the ubiquitous authenticator

Start with a laugh... (SearchSecurity.co.UK)
The joke voted the funniest at the Edinburgh Fringe this year was about an unlikely subject: “I needed a password eight characters long so I picked Snow White and the Seven Dwarves.”
Several approaches to shoring up the password authentication regime are discussed at the link.



SW&t7dfz

New York, Apartment Living, Security & Technology

Safer Buildings with Technology (The Cooperator via @HodgeBarry)
Recent nationwide crime statistics show that New York City and its outlying suburbs has become one of the safest cities of its size in the past 15 years. Nevertheless, in a sprawling metropolitan area encompassing New York and New Jersey, security is always a concern.

“People are either interested in security or they’re not. There are plenty of options out there for a condo or co-op to better protect their building,” says Harry Squasoni, senior vice president of American Security Systems, based in Long Island City. “Most buildings still have keys, which is the worst security alive. Keys go to girlfriends, boyfriends, contractors…you have no idea who has keys to your building.”

Friday, December 30, 2011

Three Taiwan Airports to Open E-gates January 1

New measures to be launched Jan. 1 (Taiwan News)
An e-gate system will be introduced at Taiwan's three main airports -- in Taoyuan County, Taipei and Kaohsiung -- to expedite immigration clearance for Taiwanese citizens. The unmanned gates will verify the biometric data of passengers passing through.

Thursday, December 29, 2011

Apple Envisions Face & Presence Detection Security for iOS Devices

Mobile Device Face-Rec (PatentlyApple.com via @m2sys)
In today's revelations, Apple introduces us to a more down to earth and practical security system for our portable devices. For simple home or personal use, the system could be setup to recognize your presence and face to quickly turn on your device. This would bypass the need for entering a password or even having to touch the home button to get to your homepage. For use at work, the facial recognition system could be set to higher levels of security. All in all it sounds like a very promising security system is in our future.
I highly recommend this article.

Albania, Macedonia, Montenegro Sign Free Travel Agreement

To facilitate and encourage the movement of people (Eurasia Review)
At the meeting of the Adriatic Charter Countries in Tirana on December 14th, Albania, Macedonia and Montenegro signed an agreement allowing citizens of all three countries to travel with a passport and biometric ID cards to and from the respective countries.

Davenport University offering degree in biometric security

Biometrics is the wave of the future (KCBY)
About 55 students are enrolled in either the two- or four-year biometric security degree programs at Davenport, a 141-year-old school of 13,500 students with its main campus in Grand Rapids.

Biometric security - which identifies people based on unique personal characteristics - has become more common since the terror attacks of Sept. 11, 2001. Government agencies and private businesses are investing in biometric devices that grant or block access after scanning fingerprints, eyes, facial features or vocal patterns.

Wednesday, December 28, 2011

India: Criminal Tracking Network Ready by 2012

Goal: Interconnect all police stations in India (Times of India)
"With the CCTNS in place, all information will be available online. Information regarding fingerprints, unidentified bodies, missing persons, stolen vehicles, stolen arms, etc, will be just a click away. At present, if we need information about a suspect, we send intimations to our counterparts in other states. This is a time-consuming process," said Dhiware.

He said that the data was being fed into the computers at the stations where the system was being installed. "Police personnel are also being trained in handling the software."

Other CID officials said the CCTNS would create a national databank of crime and criminals and their biometric profiles. This database will have details of the criminal justice system including courts, jails, immigration, passport authorities, forensic labs, transport department, mobile companies, central agencies etc, in a phased manner.

Vending Machines Show Two Different Uses for Biometrics

Kraft unveils vending machine that scans people's faces to estimate age (Daily Mail - UK)

Medbox biometrically controlled system provides prescription medicine dispensing (Deleted broken link)

The Kraft example uses biometrics to discern demographic information. The Medbox example uses biometrics to confirm a unique identity.

Discerning demographic information doesn't require the user to have had any prior interaction with the biometric platform. Confirming a unique identity requires the user to enroll their biometrics in a database for later comparison and confirmation.

Monday, December 26, 2011

Fingerprinting in the workplace

Why fingerprints anyway? (Examiner)
Before the mid 1800s, law enforcement officers with extraordinary visual memories, so called “camera eyes”, identified previously arrested offenders by sight. Photography lessened the burden on memory but was not the final answer, since personal appearances change.
There's more on the history of ID, the Bertillion system, and current legal and corporate applications.

India: Another Target for UID Corruption-Busting

Using Aadhar to put an end to the oil sector scam (Deccan Herald)
Even more surprising is the absence of oil sector scam from the long list of scams getting national attention today. The PDS scam, involving an even larger amount of money, has failed to get the attention it deserves. Diversion of PDS kerosene and residential LPG is generating about Rs 52,000 crore on an annual basis. This should make it the mother of all scams in India. When other lesser scams are associated with some well known political leaders, the oil sector scam involves thousands of politicians, bureaucrats and petty businessmen at all levels. There is no single political leader or one political party who can be blamed for the oil sector scam.
Let's run some numbers.

52,000 crore Rupees is 520 billion rupees.
Rs 520 B is about ten billion U.S. dollars.

According to the CIA World Factbook, India's 2010 GDP per capita was U.S. $3,500.

If the numbers in this article and the CIA World Factbook are accurate, the losses in this one scam amount to the average annual productive capacity of more than 2.8 million Indians.

Wikipedia:
2010 population of the state of Utah = 2,763,885
2010 population of the city of Chicago = 2,695,598

This is shocking.

UAE Residents Able to Apply for Emirates ID Online in 2012

There are a couple of articles out today that deal with the mechanics of issuing/obtaining the new UAE e-ID and the uses to which it ill be applied.

Online applications to help check identity theft, errors (Gulf News)
“We had certified around a thousand typing centres across the country to carry out the pre-registration process. Now the new online application system means we are certifying thousands of internet-savvy people in the country to carry out their pre-registration process,” he explained. It may be recalled that Gulf News had earlier reported complaints received from people about errors introduced by typing centres in application forms. Emirates ID had cancelled the certification of several typing centres following repeated complaints.
...
Many residents had also complained about typing centres asking applicants to leave their original passports with them to complete applications thus exposing them to the risk of identity theft.
Another article touches upon the types of transactions that will make use of the new ID...

Online application for Emirates ID cards (7Days.ae)
The Emirates ID card has been made mandatory for completing transactions at the Abu Dhabi Retirement Pensions fund, as well as at the Department of Real Estate Registration in Sharjah from January 1. The Sharjah Department of Real Estate Registration had announced that the ID card will be a mandatory requirement for completing any transactions at the department as of January 2012. The department has linked the ID card to all services rendered, including title deeds, registration, mortgages and other transactions. Eida has provided smart card readers to the department, to read data from the cards electronically and carry out transactions more efficiently.

Friday, December 23, 2011

Biometrics in Their Proper Security Context

Here's a really good article that, on its surface, is about the facial recognition capabilities included in the Android 4.0 mobile operation system. It also communicates a couple of important security concepts: deterrence and layers.

Facial Recognition and The Club (IT Business Edge via @m2sys)

Deterrence:
I don't have to be faster than the bear, I just have to be faster than you.
OR
Don't be the lowest-hanging fruit.
In the bigger picture, it's useful to think of The Club. The device, which clamps onto opposite sides of an automobile's steering wheel to prevent its turning, isn’t enough to prevent a theft. It is enough, however, to require at least a moderate level of expertise (and, in this example, tools) to get it off. There simply are so many totally unprotected targets – cars in one case, mobile devices in the other – that it doesn’t take too much to make the thief move on to lower-hanging fruit. The Club and facial recognition are deterrents, not foolproof safeguards.
Layers:
Just because my house has locks on the doors and windows, doesn't mean I'm in favor of dissolving the police department.
The danger is that the technology will be seen as all the device owner needs to do to be safe. That isn’t the case. Serdar Yegulalp at Byte has it about right in his view that biometrics is best seen as one tool in the security tool chest:
There's ways to fix the facial unlock function to make it more useful. Schneier mentions in his piece how fingerprint readers could be programmed to prevent cheating by detecting a pulse or a pore pattern. Facial unlock, likewise, could be reprogrammed to only work if the person winks or smiles - two things a photo definitely can't do.
There are those who object to biometric identity management measures on aesthetic grounds. That's fine. There's no accounting for taste. The argument that because biometric security applications are imperfect as stand-alone solutions they are useless is, however, without merit.

The Rear-End as Biometric Modality

I'm usually pretty skeptical when it comes to novel biometric modalities but this one might have legs.

The Car of Tomorrow Recognizes Your Butt (Wired)
The driver’s seat is fitted with 360 sensors that measure pressure according to a scale of zero to 256. Each reading is plotted to create a 3-D image — essentially a topographic map of your ass — used as a personal identifier. Anytime someone gets behind the wheel, the system analyzes the shape of their behind. If it isn’t your rear end in the seat, the car isn’t going anywhere.

I don't think I'd roll this technology out in a way that would prevent the car from functioning as a car if the seat sensor identification didn't work out.

Remembering certain preferences, like seat position, climate control and audio options might be a great place to start, though.

Thursday, December 22, 2011

India: Lawyer Sanjay Parikh Unconvincingly Urges Biometric System Boycott

At the end of yesterday's post on Iraq, I wrote:
"It's also important to draw a contrast between violations of privacy that lead to more spam, phishing and identity fraud and the kind of privacy violation that can lead to political persecution, torture, prison and loss of life."
I've also been known to make a big deal out of the difference between Privacy and Anonymity (even more here).

So, I think it makes sense to reformulate the Privacy sentence above in terms of Anonymity as:
It's important to draw a contrast between the type of anonymity that can protect against more spam, social awkwardness and a loss of privacy in public and the kind of anonymity that can lead to political powerlessness, lack of social mobility, poverty and a shortened lifespan.
People with a legitimate ID tend to think of anonymity in terms of the first formulation, those who have anonymity forced upon them tend to suffer from the afflictions of the second formulation.

If a majority of Indians able to express their political rights agree with Sanjay Parikh, all Indians will suffer, but not equally. Those living in a condition of forced anonymity will continue to live lives of deprivation and poverty. Those who have legitimate ID will continue to subsidize corruption and continue to live in the midst of unnecessary suffering in a country that fails to assume a station in world affairs more befitting the world's second-most-populated nation and its largest democracy.

Lawyer urging people to boycott the world's largest biometric database (Sky News)

[Feb. 5, 2013 -- EDIT: The embed code for the video is broken but the link above is still good]

Wednesday, December 21, 2011

U.S. Military Departs Iraq, Takes Huge Biometric Database with It

U.S. Holds On to Biometrics Database of 3 Million Iraqis (Wired)

Two things are going on here. First, the United States is keeping the biometric (and other) information it gathered on some three million Iraqis over the length of its involvement in Iraq. Second, the military is not going to share that information with the Iraqi government it leaves behind, though it would be a simple and inexpensive thing to do. After all, information is not like cake — you can have your data and eat (or share) it, too.

The digital database is the property of Central Command’s intelligence shop in Tampa, Florida. It is conspicuously not in the control of the Iraqi government. Taylor says that the Iraqis might be able to access the database’s contents if they go “through the [U.S.] embassy” in Baghdad.

“Common sense-wise, we still have an interest there in helping our Iraqi partners,” Taylor explains, “and that information might be helpful to them should there be any issues.”

Taylor doesn’t say why the U.S. didn’t hand over its biometrics toy to the Iraqis. But there’s an obvious reason: Iraq’s sectarian divides have not healed. And a database filled with uber-specific information about approximately 10 percent of Iraq’s population could represent a wish list for a death squad, militia or insurgent group — some of which are aligned with Iraqi political parties.
This thought-provoking article addresses the issue of what happens to biometric information (or any other military intelligence, for that matter) when a military campaign is wound down.

Don't read it expecting firm and definitive answers, though. The article raises as many questions as it answers. John at the M2SYS blog does an excellent job of making explicit the questions the Wired article begs.

Answering the questions, however, will require a political, legal and military analysis rather than a technical analysis. After all, ID management is about people.

UPDATE: John at M2SYS, asks via Twitter:


I think it's highly unlikely that there will be a privacy backlash, at least among Iraqis.

The Iraqis (esp. Sunnis) friendly toward the U.S. military who had their biometrics captured are probably extremely relieved that the U.S. military has decided not to give the current Iraqi government their info. As for Iraqis of more violent intent, they're already lashing back and it's not over privacy concerns.

Once the U.S. military made the decision that it was going to keep the biometric database information — and it would have been truly astounding had it decided otherwise — exercising caution in how the data is shared lowers the risk that harm will come to individuals in the database and arguably demonstrates respect for the privacy of any ordinary Iraqis in the database.

It's also important to draw a contrast between violations of privacy that lead to more spam, phishing and identity fraud and the kind of privacy violation that can lead to political persecution, torture, prison and loss of life. My guess is that Iraqis worry more about the latter than the former and the former isn't very likely to result from the U.S. military's possession of the biometric data in question.

On another note, nothing prevents the U.S. from co-operating with the Iraqi government using the biometric data it has gathered on a case-by-case basis in the future. They simply decided not to turn over the whole database now, no questions asked.

Border Patrol Arrest: Biometrics Lead to Warrant for Felony Sexual Assault on a Child

Border Patrol snares alleged sex offender (Deming Headlight - link inactive)
Upon arrival at the Santa Teresa Border Patrol Station, the subjects' biographical and biometric information were submitted into the Integrated Automated Identification System (IAFIS) and additional data bases. One of the two subjects was later identified as 28-year old Erick Daniel Garcia-Garcia, a citizen of Chihuahua, Mexico. 
Garcia's background information revealed that he was wanted out of Boulder County, Colorado for "Failure to Appear in Court for Sexual Assault on a Child/Felony" and "Crimes against Persons."

Monday, December 19, 2011

Nepal: No headway in biometric ID project

Government will be unable to issue the biometric National Identity (NID) Card this year if it does not speed up the preparations (The Himalayan Times via @m2sys)
“The process of issuing NID card cannot gain pace unless law minister gives his nod to the NID bill,” the source added.

NIDMC had hired a Canada-based international smart card consultant Ardaman Singh Kohli for 20 months to prepare the DPR with assistance from the Asian Development Bank.

El Paso: New Border Crossing Systems Cause Entry Delays

New U.S. Border Crossing Systems cause Longer Entry Delays (MexiData.Info)
According to US Customs and Border Protection (CBP), the idea is to eliminate the time inspection officers spend manually entering document information into a computer as well as increase security for officers. Also touted by Unisys as heralding a 21st century approach to processing millions of crossings every year, the El Paso system was erected under a 2010 contract awarded to the company.

But on recent days, pedestrians crossing the Paso del Norte Bridge into El Paso have encountered long delays. A little more than three weeks after the new pedestrian processing lanes were opened, this reporter and a friend spent about 1 hour and 40 minutes waiting to cross back into El Paso.
This well-written and richly detailed article reminded me of some of the issues surrounding a similar implementation on the Malaysia-Singapore border earlier this year.

Hiccups are nearly impossible to avoid entirely, but there is a growing body of experience new adopters can draw from.

Malaysia Will Not Use Biometrics in Upcoming Elections

EC: Indelible ink and advance voting for next general election
The Election Commission today announced the use of indelible ink and advanced voting for the coming general election.

Finland Introducing Biometrics for Non-Citizen Residents

Fingerprints part of residence permits from new year (Press Release)
Finland is introducing biometric residence permit cards at the beginning of 2012. At the same time residence permit stickers for travel documents will be discontinued.

Changes to the Aliens Act enter force on 1 January 2012, from which date the granting of biometric residence permit cards will begin. Technical delays in the introduction of fingerprint scanning mean that in the beginning fingerprints will only be added to card chips by degrees. If technical problems prevent the scanning of a residence permit applicant's fingerprints, a remark to this effect will be added to the residence permit card chip.

Notwithstanding this deficiency, the card remains a fully authoritative proof of the right of residence for the duration of its validity.