Would a National Biometric Authentication Scheme Work?

Ian Lamont writes "The chair of Yale's CS department and Connecticut's former consumer protection commissioner are calling for the creation of a robust biometric authentication system on a national scale. They say the system would safeguard privacy and people's personal data far more effectively than paper-based IDs. They also reference the troubled Real ID program, saying that the debate has centered around forms of ID rather than the central issue of authentication. The authors further suggest that the debate has led to confusion between anonymity and privacy: 'Outside our homes, we have always lived in a public space where our open acts are no longer private. Anonymity has not changed that, but has provided an illusion of privacy and security. ... In public space, we engage in open acts where we have no expectation of privacy, as well as private acts that cannot take place within our homes and therefore require authenticating identity to carve a sphere of privacy.' The authors do not provide any suggestions for specific biometric technologies, nor do they discuss the role of the government in such a system. What do you think of a national or international biometrics-based authentication scheme? Is it feasible? How would it work? What safeguards need to be put in place?"

I'm wondering

[taustin (171655)]

. . . if there's a biometric "authentication" method that hasn't been cracked in the real world in ways that would be easy for the average clever crook to duplicate for a trivial amount of money. Fingerprint scanners are trivial - Mythbusters fooled a brand new, state of the art door lock with a xerox of a fingerprint, by licking it. Retina scanners have been cracked, facial recognition software is a joke with no punch line. What else is there?

And once a system has been cracked, it is totally useless, since you can't change your "password" on biometric stuff.

Re:

[Joe The Dragon (967727)]

They have scanner that are very hard to beat but they cost way to much to be used in any widespread way.

Re:I'm wondering

[dgatwood (11270)]

MythBusters did a test of several of these devices. None were particularly hard to beat, including some that were supposed to be....

Even now, the best form of authentication is a human standing there looking at your driver's license, deciding whether it is real or not, then comparing the photo. The only thing that would be significantly better and more accurate would be a system in which you would swipe a driver's license and it would contact the DMV and bring up a digital copy of that license for comparison purposes. Anything beyond that---particularly biometrics---is more likely to weaken, not strengthen security as people will tend to believe what some biometric reader device tells them over what they see with their own eyes 99 times out of 100.

Re:

[Bryansix (761547)]

Retina scanners haven't been hacked as far as I know. More importantly any security system that preports to be secure should check three things.
1) Something you have (a keycard, a usb key, a simple barcode scanned ID card)
2) Something you know (a strong password, the name of your first pet and the city you graduated highschool from)
3) Something you are (Your retinal scan, your infrared signature given off by your body, your dna, your face from two angles)

A system using this three step authentication p

Re:I'm wondering

[Daniel_Staal (609844)]

Which totally misses the point. Which is why? What problem are they trying to solve? What possible problem is worth the cost of those in power having a way to track every individual of any age anywhere in the country?

Re:I'm wondering

[Anne Thwacks (531696)]

Thanks to the modern miracle of SQL Injection, and similar high power technologies, any amount of fraudulent records can find their way into the database, while the legitimate ones leak out. If the UK government has anything to do with it, all the data will be available for a moderate price in Moscow, Lagos and Bangalore within days of the system going live.

In short, the people with most to gain from this are the criminals, who will have a really cheap, simple and reliable way of proving they are who they are not.

Meanwhile hoards of old ladies will be hauled of to jail "But officer, I thought it was my ID card - I realise now it was my library card/son's ID card - if you just let me go home, I can get my ID from the draw by the bed where I always keep it!"

You biometric database is exactly as secure as the PHP written by school leavers who lied on their CVs that protects it.

Re:

[Molochi (555357)]

My bank uses a biometric scanner to access the safety deposit boxes. You put your whole hand on it in a vulcan greeting sort of way. It seems to measure distance between finger pads. Still requires a passcode as well. Most importantly it's in a monitored location, so if my severed hand or a capacitive replica were placed on it some attention might occur. One can hope.

Re:

[camperdave (969942)]

And if you lose your hand in, say, a devastating chess accident, you can't get at your safety deposit box?

Re:I'm wondering

[NeutronCowboy (896098)]

Nevermind whether the scanner has been cracked. What happens if you lose your biometric password, or it gets mangled beyond recognition? I suspect they'll scan multiple parts of your body (ten fingers, 2 eyes, voice) and will accept a majority of successes as opposed to only 100% of successes. But there still will be some poor sap who lost the majority of his fingers in a wood chipper accident, and had both eyes affected due to glaucoma or retinal sunburn. Now he comes down with a cold. What's gonna happen? He won't be able to authenticate?

What worries me the most about biometric IDs is the idea that somehow, biometrics never change. I expect that there will be no process in place to change the biometrics, or that the process will be so impossible as to be the same as having no process. And if the process to change your biometric passwords is easy, why use them instead of just a regular picture ID?

This stuff might work in specific situations, where outliers are rare, and relationships between the scanners and scannees close enough to make fixes easy. But I can only see nightmares if this gets implemented on a national level.

Yale CS

[astrashe (7452)]

If history has taught us anything over the past few years, it's that putting guys from Yale in charge of things is always a great idea.

So let's let this wise man create a national biometric identification system. It sounds like a bad idea to me, but I'm just part of the rabble. I haven't had the benefit of his education and experience. I've never even been to a regatta!

absolutelly!

[rucs_hack (784150)]

Yes of course it would work!

Everyone knows that bad people are entirely willing to be completely honest, so obviously a system like this would mean we would know everything about them, and could stop all evil in the world.

Re:

[zappepcs (820751)]

Why is it that you can so easily and clearly state the GLARING obvious truth of this but smart people and governments don't seem to understand it no matter how many times it is iterated to them. Perhaps instead of banning handguns in Washington DC they should ban idiots. Yes, I realize the strain that would put on voting machines, but damn!

Private Sector

[kid_oliva (899189)]

It sounds interesting, but I am not for governmental control or involvement. Most here believe less government is better government. Why would we want to involve an entity that can't even balance a checkbook get its hands on something this complicated. I'm sorry but I don't see George W, Hilary Clinton, Barack Obama, or John McCain doing an adequate job at all except to hose it up and force regulation and compliance. Our current issues will not be solved with this. They will only take on a new twist.

Oh no, not this again.

[inviolet (797804)]

Biometrics is inherently flawed as an authentication system, because biometrics is a password you can't change. Once someone gets your password, or at least the numerical representation of it such as could be lifted from a compromised reader or database, you are toast. How are you going to change your retina scan to something new?

And never mind the demonstrated hackability of all but the premium readers.

Biometrics sound great at first blush, and to the common voter they seem foolproof, so this fad will get worse before it will get better. In fact, the authentication issue may have achieved the level of complexity as the net-neutrality issue, such that Joe Registered Voter cannot possibly understand it (even if he is the rare sort to spend an hour googling it before forming an opinion).

Meanwhile, text passwords plus certificates (where 'certificate' could be a smart card, or your cellphone's IMEI, or whatever) is still the answer for security. It's awful, to be sure, but it's much less awful than biometrics.

Re:Oh no, not this again.

[QuantumG (50515)]

People continue to confuse identification with authentication.

http://wordnet.princeton.edu/perl/webwn?s=identification [princeton.edu]
http://www.google.com.au/search?hl=en&q=define%3Aauthentication [google.com.au]

Biometrics are good for identification.. they replace your "login", not your "password".

No. Nein. Nyet.

[Jane Q. Public (1010737)]

We do NOT need National IDs at all, other than passports.

Re:

[webmaster404 (1148909)]

Passports are even getting to be bad.... You now need them for every country you visit and the US government even with all of our hard earned money can't seem to get them out quickly.

Open acts not private?

[nurb432 (527695)]

Perhaps not technically 100%, but you can expect a reasonable level of privacy/anonymity in public.

This could destroy that.

Are Fingerprints Unique

[MBCook (132727)]

The idea that every fingerprint is unique is a untestable hypothesis, since you'd have to fingerprint everyone ever born, right? We assume it's correct because we've never found examples of fingerprints that were identical.

So my question is this: if we were to fingerprint everyone in the US (all 300+ million of us)... does anyone think we might find that matching set? No one has ever done a fingerprint database of that size, right? With a quick search, I couldn't find out how many prints were in AFIS.

On the topic more directly, I'd say this would be nearly impossible. Ignoring the privacy concerns that people would use to try to stop thing going into effect... does anyone think we would be able to convince most/all of the 20 million or so illegal aliens in the US to do this? I would think you would run into the same problems in just about any other country, except somewhere like China.

Re:

[MBCook (132727)]

Figures I'd find this after I posted. According to this page [fultonsheriff.org], AFIS (which is international) only holds 17 million prints (1.7 million people). So a US database would be over 175x as big.

Re:

[Panaflex (13191)]

That's not the only issue anyway... All biometric scanners have an algorithmic component which distills the scan into quantitative numeric values which can be compared to subsequent swipes of the fingerprint.

For instance, a fingerprint algorithm may utilize certain features of a print (such as a line split or a swirl) to map points on a graph. Subsequent swipes will then have a certain number of points which must match within a certain range on this graph.

It is possible that these qualitative values would

Re:

[Mjec (666932)]

My biggest concern is false positive/false negative results. Let's say you have a false reading rate of 0.01% - that's 99.99% success. With 200M people each verifying their identity a conservative twice a day that's 20,000 false readings a day.

To provide the worst sort of evidence (anecdotal), I get about 5% false negative and unknown false positive rate with my (new) laptop fingerprint scanner. That error rate excludes "scan again" requests. Sure, it's an El Cheapo, but do you imagine a government splurg

What's the real subject here?

[serutan (259622)]

The article is about someone saying why we need one. I agree that we need a secure scheme that provides both authentication and anonymity as appropriate. Without a proposed scheme in front of us there's no way to answer the /. headline's question, "Will it work?" So stand by for a thread full of rants about privacy and big government.

Re:

[Original Replica (908688)]

we need a secure scheme that provides both authentication and anonymity as appropriate.

The question of when anonymity is going to have very different answers depending on who you ask. Most law abiding citizens would object to being ID'ed dozens of times a day as they go about their business, but for a "track the terrorist" system this is what would have to happen, and is what DHS would want. Right now it's too blatantly oppressive and logistically difficult to ID everyone who walks into the subway or dri

The article misses the point of anonimity

[MyNameIsFred (543994)]

...The debate over Real ID and sensitivity to creation of any form of national ID reveal a fear that anything that identifies us to others will intrude on privacy . This has led to a preoccupation with forms of ID rather than the fundamental question of how we can reliably identify ourselves to each other....

This quote suggests that they miss the whole point of the debate over Real ID. I would argue that the main point of the opposition to Real ID was to oppose anything that make it easier for the government to reliably ID us.

...While anonymity implies privacy, it does not confer it. We delude ourselves into thinking we have privacy if the person next to us doesn't know our name...

Again this misses the point of the Real ID debate. While making it difficult for the government to ID does not prevent them from IDing us, it helps. It also helps prevent the government from retaliating against protesters. It does not prevent it, but makes it harder. That is why protesters frequently cover their faces. That is why protesters want to make it difficult for the government to track their travels.

Even the courts have found that anonymity is important component of freedom of speech. (Along with freedom of association.).

That's what my Tbird was for.

[dotancohen (1015143)]

In public space, we engage in open acts where we have no expectation of privacy, as well as private acts that cannot take place within our homes and therefore require authenticating identity to carve a sphere of privacy.

The private acts that I did in the sphere of privacy carved out by my '88 TurboCoupe did _not_ require federal authentication, thank you.

Wrong question, but here's the answer: No.

[postbigbang (761081)]

Just like in the UK, it'll work until it's cracked. Or the RFID data from passports. It is no business of the government who I am, or where I am without probable cause by a signed affidavit. There's a sufficient majority that would make sure that a national ID system is never used in the US that it's moot anyway. And for Larry Ellison and others that want to try it, they'll get laughed at, again, and just as loudly.

The question isn't unique IDs, it's tyranny. We hack tyranny first.

I think they missed the point

[joeflies (529536)]

They also reference the troubled Real ID program, saying that the debate has centered around forms of ID rather than the central issue of authentication. I think the issue is neither forms of ID nor authentication. People readily carry similar forms of ID and perform similar usages of authentication all the time in private enterprise.

The real issue is whether you choose want to have any one organization to own all the identification information, and if anyone truly believes it will be confined to be u

The way I feel about biometrics

[edalytical (671270)]

I have three problems with biometrics:

1. My biometrics are my property and I'm not giving them up.
2. I have the right to be free from "unreasonable searches and seizures".
3. There is supposed to be a need of "probable cause".

commonly confused

[perlchild (582235)]

The summary talks about a common misconception, and manages to create another.

Authentication is when you identify(as in Identity) yourself, when you want to(say, to enter your home), or to get that 5% rebate at that place you like to eat at.

Anonymity is when someone else wants you to identify yourself, and you refuse.

Imputability is when someone's done something and 1) you want to Identify them properly, and 2) do something about some of the people you identify(presumably because something they did was wrong)

Anonymity is something private citizens like, in part because they don't much like imputability. That is when they do something, and it's not tied to their Identity.

Forcing someone to authenticate themselves is something the police, for one, likes, because
1) It prevents them from being blamed for mis-identifying someone
2) If they catch you doing something, and impute it once you authenticated yourself, they're fairly sure they impute it in such a way, it will follow you for a long long time(if they can impute your "identity" more on that later.

However, it has its drawbacks
1) If you authenticate yourself with falsified credentials, you get someone else blamed for your acts
2) It doesn't deal with the fact that you may be unable(damaged or lost credentials)/unwilling to identify yourself/automated systems may mis-indentify you

It doesn't solve the question of "Identity" itself either. Like when the no-fly list(falling under imputability) lists names(which can be the same for two people), leading to the same result as a falsified authentication.

Just a quick summary:

Identity: Who you are
Authentication: Proving who you are
Anonymity: Not having to say who you are
Imputability: Blaming who you are

The four are interlinked, but often confused, as in the article.

People interested in laws like RealID need to pay a lot more attention to distinctions between all four. Until the authentication part can be more more foolproof, the imputability is scary(you can be blamed for stuff you haven't done), the anonymity, well it's scary to those who'd rather deal with people they can identify(and therefore impute, think contracts to keep it in the white hat sphere). And the Identity, well that's the real problem. If you have a single, centralized database, any single mistaken Identity becomes life-altering, if not actually life-threatening(correcting someone's id with falsified credentials in order to make their lives a living hell? Yes, it can do that).

Does that bother you a little? I know it does me.

If this fails

[bob.appleyard (1030756)]

It doesn't matter how strong your security system is, it will fail. What happens when it does? I can't get a new $BodyPart if some fraudster spoofs it.

Who Watches The Watchers?

[softwaredoug (1075439)]

Who is to be trusted with by biometric data? Who would have access? How would the software/authentication work? Who will write the software? Is it going to be proprietary? Will it be enabled in voting machines? Why should I trust the government agency/subcontractor to do all this correctly? It seems that whoever controls this biometric data would have A LOT of power, especially if its integrated into every little device out there. Consider the potential lack of transparency in, say, an election. Could some government employee, maybe just above the average capabilities of a TSA employee, tamper with election results? Also, if my biometric info is linked to my credit card, how hard would it for that person to go on a shopping spree. How could I prove it wasn't me? The whole thing wreaks...

Work for Political Spying Like on Obama's Passport

[Doc Ruby (173196)]

Yes, this system would work perfectly for spying on all political opponents (and blackmailable "friends") personal info, just like reported tonight at at the State Department, spying on Obama's passport file [google.com].

A Solution in Search of Problem

[coaxial (28297)]

Why is there the push for this? There isn't wide scale fraud, and there's no reason to believe that Bad Guys(tm) couldn't simply create a fake entry in a database, or that the biometric stuff would actually be used. California requires a thumbprint to get a driver's license (!), and yet you're never asked for it at a traffic stop. Why?

I have a suspicion. It's not for authentication at all. Others have already pointed out the inherent flaw in using nonrevokable certificates for authentication. (i.e. once someone has faked or corrupted your biometric data, you're fucked.) So what is a biometric data good for? The same thing that's good for when the government stores DNA sequences of everyone processed. It's a globally unique identifier. You can put multiple databases together easily. Name collisions are a thing of the past.

If you really think that government won't combine their databases, you're a fool.

Obscurity isn't security, but there is something to be said about making information, even public records, a bit harder to put together than to give a big data dump about everyone to everyone. Society has built on a certain level an anonymity existing, even when legally it doesn't exist. But it's all too obvious that people's expectations and behaviors don't always align with the letter of the law. And seriously, given the government's current cavalier attitude towards privacy and the law, do you really think that a simple law is going to stop them?

No retina scanning for me, my eyes change

[vinn01 (178295)]

I'm hosed if they chose retina scanning. I get drusen deposits http://www.medterms.com/script/main/art.asp?articlekey=10015 [medterms.com] .

Fortunately, it's not macular degeneration. But those deposits form and dissolve over time. That would make retina scanning a problem for me.

Re:

[kid_oliva (899189)]

The sad thing is the social security was never meant to be used as an id card. That is what a passport is for. This why our current situation is so skewed.

Re:And how well would that work?

[jamstar7 (694492)]

When I was issued my Social Security card way back in the 60's, it said, in bold letters at the bottom of the card, "NOT FOR USE AS IDENTIFICATION".

That turned out well, didn't it?

Re:

[smitty_one_each (243267)]

It would concentrate a lot of power in whoever is managing the information.
Have you looked at the response winning the latest /. poll? http://slashdot.org/pollBooth.pl?qid=1544&aid=-1 [slashdot.org]
The only possibly better response than whatcouldpossiblygowrong would be cureworsethanthedisease.
I'm confident I'd vote against any nitwit pushing such a plan.

Re:

[explosivejared (1186049)]

Well aside from the philosophical apprehensions one might have about such a system, biometrics, at least in current incarnations, are poorly suited for the job. It's not that hard to imagine such a system being built on the principle of the lowest bidder. There have been numerous discussions on here about how easy it is forge a print on a poorly implemented biometric system. I'll leave you to infer the problems that would quite probably ensue.

Re:It would work to...

[jamstar7 (694492)]

This would do a lot of things. It would a) keep tabs on anyone who was not american (potential terrorists!) b) keep tabs on problem individuals c) increase national security, because sex offenders could be tracked (and given poor service when they're trying to access govn't services.

Why does all this scare me? Is it because I could be classified a 'problem individual' based on my political leanings? Is it because the Executive Branch reserves the right to pull American citizenship at will? Is it because even the Russians [wikipedia.org] know the best way to deal with a recalicrant individual, no matter what his power base, is to tar him as a sex offender?

My other question is of course, if I'm out and about, living my life in a lawful manner, why should the government care about me?. Police aren't there to arrest the lawful, they're there to arrest the criminals after commission of a crime. Where is the mandate to surveil everybody in sight waiting for them to commit a crime?

Re:

[tomhudson (43916)]

Some of the basic premises stated in the article are just plain wrong. For example:

'Outside our homes, we have always lived in a public space where our open acts are no longer private. Anonymity has not changed that, but has provided an illusion of privacy and security. ... In public space, we engage in open acts where we have no expectation of privacy

We have always enjoyed "the anonymity of the crowd." Walking down the street, minding your own business, with nobody having the right to interfere with y

Re:It would work to...

[fyngyrz (762201)]

The premise of the article - or at least the blurb - is wrong. It makes the claim we "have no expectation of privacy in the public space." But we do. Ever want to take a road trip to some town where no one knows you, just to get away, do some shopping, have dinner, watch a show, without having to deal with people who know you? Ever enjoy the feeling of being out, alone, in an unfamiliar city?

How's that going to sit when the desk clerk looks you in the eye as you walk up and says, "How you doing, Mr. LeParanoid, and how's that appendectomy scar healing up? Wife happy about that diamond necklace you bought last week?"

Or gives you a steely look because you're on The Sex Offender List (because you had the temerity to have sex with someone 3 days over some arbitrary line, or perhaps you pissed in a bush somewhere) and proceeds to treat you like a criminal as soon as your RF-enabled ID gets in range of his LittleDictatorsConsole(tm)? Sure, you can add biometrics to it so he's sure you're a sex offender or other malcontent antisocial. That'd all be real good, wouldn't it? After all, in this society, onece you're a criminal, you're permanently low class, you can't make up for it.

This whole ID mania needs to go away. It is a sign of a pervasive sickness among the rulers of this society. It is not a solution, or a potential solution, to terrorism, or any other problem we face.

Re:

[Iron Condor (964856)]

Last I checked (1999 or there abouts), there were 535 members of congress, of which 29 had been accused of spousal abuse, 7 had been arrested of fraud, 19 had been accused of writing bad checks, 117 had bankrupted at least two businesses, 3 had been arrested for assault, 71 couldn't get a credit card due to bad credit, 14 had been arrested on drug-related charges, 8 had been arrested for shoplifting, 21 were defendants in then-ongoing lawsuits. In 1998 alone, 84 were stopped for drunk driving.

After all, in this society, once you're a criminal, you're permanently low class, you can't make up for it.

Sure looks

Re:

[Kozz (7764)]

Damn! That's incredible.

I mean, you've had those statistics memorized for nine years???

Re:It would work to...

[profplump (309017)]

Authentication does not necessarily mean that those around me know who I am. Take a credit card transaction as an example -- the credit card company wants to know that I'm an authorized user of the card I hold. The merchant wants to know that my credit card company will pay them on my behalf. But the merchant doesn't have any fundamental interest* in knowing who I am -- only the credit card company does. So if I authenticate to the credit card company, and the credit card company authenticates to the merchant, we can all feel safe, and I can remain anonymous with respect to the merchant.

It's certainly possible to design the system to provide strong authentication for a variety of purposes without compromising privacy or even anonymity. Whether or not anyone will bother to do that/allow that to happen is debatable, but you shouldn't necessarily relate the ability to authenticate with an inability to provide privacy.

*I know they might like to know who I am for marketing purposes and whatnot, but they have no interest with respect to conducting a safe and reliable financial transaction.

Re:It would work to...

[fyngyrz (762201)]

What you are describing here as privacy is actually what the blurb more correctly labels as anonymity.

No. You fundamentally misunderstand privacy. Privacy is not "being alone."

Privacy is the existence of social boundaries that we (generally) agree not to cross.

Examples: I invade a lady's privacy when I look up her skirts without her permission. I invade your privacy if I open your mail without your permission. I invade your privacy if I read your medical records without your permission. All of this can happen with you, me and the issue in question all out in the public space.

These are things we can do, but we agree not to do, because we recognize the fundamental right to privacy as existing in open society, not just in the home or when we are alone. Private means that you retain control by social convention over information which relates to your existence, and in turn, were I to obtain access by any means without your permission, I would have crossed the social boundary for that issue. That is the very core of "violating someone's privacy."

Anonymity is another social boundary. We have -- in the past -- recognized that others have the right to proceed about their day without having to inform others who they are and what they are doing. This boundary, like any other social boundary, can be crossed (violated, more like) by simple, easy actions on the part of invaders of privacy. But anonymity is not a thing unto itself, it is simply another facet of privacy.

The following should help you develop a better understanding of what privacy actually is: More on privacy. [ideaspike.com]

Re:

[fyngyrz (762201)]

A driver's license is a certificate that says you can drive. It doesn't even need your name on it. You just need to have one in case someone questions if you have passed a test to drive. Having done so, of course, does not permit you to run a red light or drive over someone's baby in a stroller. Nor does not having a license prevent you from starting a car and driving off. As it turns out, the thing that really matters to society is how well you drive -- not the certificate at all.

A passport is a certif

Re:It would work to...

[tomhudson (43916)]

There's at least one in the White House. The only difference is that he has more resources. "Shock and Awe" sounds like terror to me.

Yep, Dick Cheney with a few drinks in him and a shotgun in his hand will certainly wipe that smile (and a layer of skin) off your face real quick.

Re:

[zippthorne (748122)]

I don't want adds calling out my name like in "Minority Report"

Well you're just going to have to level up, or quaff an invisibility potion, or keep your aggro down by using lower-level healing spells when you can get away with it.

Re:

[Anne Thwacks (531696)]

If a crim wants my biometric, they take my finger, eye whatever

The more efficient ones imply insert THEIR data against your name in the database index:

UPDATE biometric_data SET identity = 'fake_value' WHERE name='Your Name';

Its easy when you know how, and the go'mint computer can do zillions of transactions a second.