We've been hearing about this for a while — Samsung eyes iris-scanning security for future phones

And on a completely unrelated matter... Deloitte Survey Shows Security Concerns Loom Large as the Biggest Barrier for Mobile Financial Services

They did it

The State of Florida has banned biometrics in schools — biometric systems intended to help schools function better in delivering the services they are tasked with providing.

It'll be fun to see if someone decides to sue when a school tries to sell yearbooks this year. After all, if using a secure biometric system to help a school lunch line move faster is wrong, how can schools be allowed to sell a facial recognition database of the school's students?

On a side note, the big annual biometrics conference is in Tampa, Florida again this year.

Never a good headline

We’re Not In Crisis –NHIA (Peace FM)

In January this year, the NHIA introduced the ‘instant issuance’ of health insurance Identification (ID) Card system based on biometric data.

The process began as a roll-out in the Greater Accra region after a pilot of it on the security personnel (Military and police) in two districts of the Region-Ayawaso and La.

Currently, the process has been extended to the Central and Eastern Regions respectively and the Ashanti Region will be the next to join instant issuance of the ID cards regime.

There's a reason national health services worldwide are scrambling to apply biometric ID management techniques to service delivery. Biometrics deliver bottom-line financial benefit to health care systems in significant ways. Better ID means less fraud, fewer ghost patients and a better audit trail if a provider's activities warrant investigation. Also, better patient ID leads to better patient outcomes and better records management.

It's not surprising that countries like Ghana are choosing to leap-frog the 20th century systems other large health care providers use, but it also isn't surprising that the process is difficult and requires a steady managerial hand.

Since we haven't mentioned it in a while: Biometrics can be a potent anti-corruption tool


Royal Bank of India sets aside decision for mandatory biometric authentication in PoS terminals — "In the testing phase, biometric authentication took up to 30 seconds even on 3G connections" Ouch!


PHILIPPINES: No biometrics, no voting in 2016

US Government online fingerprint ID system to be tested in Michigan & Pennsylvania

Government to Test ‘Identity Ecosystem’ in Two States (The Blaze)

The first round of tests are aimed at finding an efficient and secure two-step verification for accessing public programs, like government assistance. The White House believes this ID system will reduce fraud and overhead, by eliminating duplicated ID efforts across multiple agencies.

The Blaze article is quite negative on the whole project but it contains a lot of links to other sources of information. It's worth a read.

A closer look at the Fast Identity Online Alliance

If you haven't heard of FIDO yet, you should really click through to the entire article.

Password-free authentication: Figuring out FIDO (Search Security)

Online authentication mechanisms have grown increasingly difficult for IT security teams as employees and customers expect to access online services and e-commerce sites from a myriad of devices. With password fatigue reaching new heights, many security professionals want stronger authentication methods that eliminate the complexities and risks associated with the integration of online credentials and identity management.

By now, most security professionals have heard about the Fast Identity Online (FIDO) Alliance, a non-profit founded in July 2012 and publicly announced in February 2013. The industry group is championing better multifactor authentication and open standards to promote interoperability of next-generation authentication technologies.

More on African leap-frogging with biometrics

Using biometrics to secure African identities (HumanIPO)

African nation states are leaping the technology divide with the rapid deployment of electronic identification systems to register their entire populations. The possession of a bonafide identity document is foundational to the creation of civil society. It enables citizens to exercise fully their rights as members of society: their right to vote in an electoral system that is fraud and error free; provide access to health insurance coverage, apart from other valuable legal documents, and lastly restore the bond of trust between these citizens and their governments.

LastPass Adds Galaxy S5 Fingerprint Scanner Support — This is the kind of stuff Apple won't be doing any time soon.

Facial recognition technology is still in its infancy (CSO) — As the article spends a fair amount of time on, there's a significant difference in system performance with cooperative vs. non-cooperative users.


Private sector biometric time-and-attendance systems are gaining steam (Channel News Asia) — "...institutions including banks, schools and polyclinics have also expressed interest in such systems, adding that demand has increased by 30 per cent annually for the past three years."


DHS testing biometric exit devices at mock airport this summer (Fierce Homeland Security) — The law requiring the DHS to implement such a system is a lot older than the DHS is.

Praise for Ann Cavoukian, Privacy Commissioner of Ontario

Canada's Global Player in the Privacy Debate (Governing.com)

To Cavoukian, the notion that personal privacy is sacrificed for the greater good -- from health reporting to communications tracking -- is the lazy way out. She has developed what she calls Privacy by Design, the idea that personal privacy protections and new technology advancements can actually live in harmony. “Why do we have to look at it as one interest versus another?” she asks. “I always call it the power of ‘and.’ Get rid of the word ‘versus;’ substitute the word ‘and.’ I want privacy and security.”

We have also had good things to say about Ms. Cavoukian in the past.

We're all ears

New academic research on ear biometrics...

3D Ear Identification Based on Sparse Representation (Forensic Magazine)

Compared with classical biometric identifiers such as fingerprint and face, the ear is relatively a new member in the biometrics family and has recently received some significant attention due to its non-intrusiveness and ease of data collection. As a biometric identifier, the ear is appealing and has some desirable properties such as universality, uniqueness and permanence. The ear has a rich structure and a distinct shape which remains unchanged from 8 to 70 years of age as determined by Iannarelli in a study of 10,000 ears. The recognition using 2D ear images has a comparable discriminative power compared with the recognition using 2D face images.

If you click through to the whole study at plos.org, the authors (Lin Zhang, Zhixuan Ding, Hongyu Li & Ying Shen) have made the Matlab source code for the ear matching algorithm available. That's really neat.

From our first post on ear biometrics in 2010...

Pros:
-Facial recognition accuracy is degraded as the pose angle diverges from a full frontal view. As pose angles get bigger, an ear will come into view. Tying an ear-recognition system to a face recognition system could make more identifications possible, especially with a non-participating subject.

Cons:
-Ears aren't really that stable. They grow throughout life, as the quote above addresses.
-As high school wrestlers can attest, ears are easily deformed by trauma.
-Hair obscures significant portions of the ear in a significant percentage of the population.

Washington DC: Participate in biometric system testing and earn $95

Seeking individuals to participate in an ID verification research study. (Upper Marlboro Patch)

Participants will be asked to pass through a simulated identification area that uses safe, commercially available sensors like high definition cameras. The simulated screening area will also test the usefulness of safe biometric scanners that are currently being used by other countries at border crossings such as fingerprint identification.

Video of gait analysis in action

This Security Solution Says It Can Figure Out If You Are Safe Or Dangerous By Scanning Your Skeleton (Business Insider - Australia)

They’re using a standard 2D surveillance camera to analyse a person’s motions and create a “skeletal map,” which shows the distance between joints and how they move. By comparing this map with future scans, Extreme Reality can detect any differences in movements that might indicate signs of stress and red flags. The system uses complex algorithms to detect these differences, and according to Extreme Reality, it is more than 90% accurate.

See for yourself...

This kind of thing makes fingerprint spoofing even harder

Samsung patent suggests multi-fingerprint e-wallet authentication and gesture control (Android Authority)

Applications for fingerprint scanning are quite limited at the moment...

The future may hold a bigger promise, however. A patent application made by Samsung indicates that the company may be working on an even more innovative use of fingerprint scanning for authentication. In the patent application, Samsung describes several methods for authenticating a purchase, such as through PIN, password, pattern, and even fingerprint scans. An interesting addition is the inclusion of multiple fingers for stronger authentication.

Uncertainty over which fingerprint was used — or in the not too distant future, which combination of fingerprints are used — would go a long way towards making the already difficult task of fingerprint spoofing even harder.

A noble sentiment — It is essential to be familiar with the characteristics of biometrics systems in order to better understand how to think objectively about each type and make rational decisions about purchasing and using the technology.
An introduction to biometrics follows at Namibia's New Era Newspaper.

Many things can be improved by adding a fingerprint reader — EMKA Touch uses biometric recognition via fingerprint to restrict server cabinet access (Source Engineer)

Cross Match Acquires DigitalPersona (findBIOMETRICS)

“Cross Match is strong in multimodal biometric technologies and government solutions. DigitalPersona is strong in identity verification and the commercial sector, especially finance, retail and healthcare. So, the fit is highly complementary.”

Veins are great, but that doesn't mean fingerprints are a "gimmick"

Vein-scanning technology may trump fingerprint scanning for payments (Sydney Morning Herald)  But even if the headline is true, it doesn't follow that

"Using our fingerprint is not a secure way to do [authentication]," Professor Susilo said. "It's just like a gimmick."

One of the main benefits of vein and iris scanning is that you don't tend to leave behind iris or vein prints, he said.

As most vein scanner sensors coming out this year require no physical contact, it means there are no residual biometric patterns that could be copied, preventing fraudulent use.

Fingerprints are notoriously easy to lift from surfaces and are not secure, he said, which has been demonstrated by researchers for more than a decade.

In 2002, Japanese researchers showed that fingerprint scanners could be fooled with about $10 worth of household supplies. They also found many fingerprint systems did not detect if someone was "live and well".

Vein scanners are, in fact "more secure" in the sense that there is no latency. You can't leave vein prints behind. But that doesn't mean that fingerprints are a gimmick.

To take the professor in his own terms, how much money worth of household supplies are required to access an unsecured mobile device? How much money worth of household supplies are required to access a device secured by a password? How easy is it to apply the $10 worth of household supplies to cracking the phone? The answers: None, None, Not very. It really isn't that easy to spoof fingerprints without the participation of the person whose fingerprint is enrolled.

Vascular biometrics, on the other hand, have no latency. Nobody leaves behind vein prints. But hardware cost (too expensive) and form factor (too large) disqualify vein sensors' use in mass market mobile devices*. Until about 6 months ago this was true even for fingerprint readers.






*In mobile devices, power consumption is also a big concern. I don't really know if vein readers are power hogs or not. Perhaps the likely infrequency of vein sensor use compared to the screen or audio output means power requirements won't end up being the determining factor for vein reader deployment anyway.

Newsweek not big fans of facial recognition

Biometric Surveillance Means Someone Is Always Watching (Newsweek) — It's a little hard to tell whether Newsweek is more angry about the "who" or "how."

Facial recognition ID's another 40-year fugitive

Suspected NC fugitive from 1970s arrested in Iowa (LaCrosse Tribune)

According to authorities, the man they believe is Carnes moved to Waterloo from Washington state in the summer of 2013. Where he lived before that is a mystery.

Carnes

On July 12, he used the name William Henry Cox to obtain a vehicle title. Then on March 11, he used the identity of Louie Vance to apply for an Iowa driver’s license.

Investigators became suspicious when the Iowa Department of Transportation’s biometric facial recognition program sent up red flags about his driver’s license. The system records the distances between facial features and stores them on a computerized database to compare with measurements on other photos in the system.

See also from March 15...
A promising data point for the durability of facial recognition biometrics

Samsung Galaxy S5 Fingerprint Sensor Security Already Hacked And Compromised (Hot Hardware) — Our perspective on this sort of thing hasn't changed since we wrote this heavily linked post in response to the same demonstration on Apple hardware a few months back.

Long story short: It's not that easy to do, and convenient fingerprint security is way better than not doing anything at all, which is what many of us are doing now.