Would a National Biometric Authentication Scheme Work?

Ian Lamont writes "The chair of Yale's CS department and Connecticut's former consumer protection commissioner are calling for the creation of a robust biometric authentication system on a national scale. They say the system would safeguard privacy and people's personal data far more effectively than paper-based IDs. They also reference the troubled Real ID program, saying that the debate has centered around forms of ID rather than the central issue of authentication. The authors further suggest that the debate has led to confusion between anonymity and privacy: 'Outside our homes, we have always lived in a public space where our open acts are no longer private. Anonymity has not changed that, but has provided an illusion of privacy and security. ... In public space, we engage in open acts where we have no expectation of privacy, as well as private acts that cannot take place within our homes and therefore require authenticating identity to carve a sphere of privacy.' The authors do not provide any suggestions for specific biometric technologies, nor do they discuss the role of the government in such a system. What do you think of a national or international biometrics-based authentication scheme? Is it feasible? How would it work? What safeguards need to be put in place?"

I'm wondering

. . . if there's a biometric "authentication" method that hasn't been cracked in the real world in ways that would be easy for the average clever crook to duplicate for a trivial amount of money. Fingerprint scanners are trivial - Mythbusters fooled a brand new, state of the art door lock with a xerox of a fingerprint, by licking it. Retina scanners have been cracked, facial recognition software is a joke with no punch line. What else is there?

And once a system has been cracked, it is totally useless, since you can't change your "password" on biometric stuff.

Re:

Retina scanners haven't been hacked as far as I know. More importantly any security system that preports to be secure should check three things.
1) Something you have (a keycard, a usb key, a simple barcode scanned ID card)
2) Something you know (a strong

Re:I'm wondering

Which totally misses the point. Which is why? What problem are they trying to solve? What possible problem is worth the cost of those in power having a way to track every individual of any age anywhere in the country?

Re:I'm wondering

Thanks to the modern miracle of SQL Injection, and similar high power technologies, any amount of fraudulent records can find their way into the database, while the legitimate ones leak out. If the UK government has anything to do with it, all the data will be available for a moderate price in Moscow, Lagos and Bangalore within days of the system going live.

In short, the people with most to gain from this are the criminals, who will have a really cheap, simple and reliable way of proving they are who they are not.

Meanwhile hoards of old ladies will be hauled of to jail "But officer, I thought it was my ID card - I realise now it was my library card/son's ID card - if you just let me go home, I can get my ID from the draw by the bed where I always keep it!"

You biometric database is exactly as secure as the PHP written by school leavers who lied on their CVs that protects it.

Re:I'm wondering

Nevermind whether the scanner has been cracked. What happens if you lose your biometric password, or it gets mangled beyond recognition? I suspect they'll scan multiple parts of your body (ten fingers, 2 eyes, voice) and will accept a majority of successes as opposed to only 100% of successes. But there still will be some poor sap who lost the majority of his fingers in a wood chipper accident, and had both eyes affected due to glaucoma or retinal sunburn. Now he comes down with a cold. What's gonna happen? He won't be able to authenticate?

What worries me the most about biometric IDs is the idea that somehow, biometrics never change. I expect that there will be no process in place to change the biometrics, or that the process will be so impossible as to be the same as having no process. And if the process to change your biometric passwords is easy, why use them instead of just a regular picture ID?

This stuff might work in specific situations, where outliers are rare, and relationships between the scanners and scannees close enough to make fixes easy. But I can only see nightmares if this gets implemented on a national level.

Re:I'm wondering

MythBusters did a test of several of these devices. None were particularly hard to beat, including some that were supposed to be....

Even now, the best form of authentication is a human standing there looking at your driver's license, deciding whether it is real or not, then comparing the photo. The only thing that would be significantly better and more accurate would be a system in which you would swipe a driver's license and it would contact the DMV and bring up a digital copy of that license for comparison purposes. Anything beyond that---particularly biometrics---is more likely to weaken, not strengthen security as people will tend to believe what some biometric reader device tells them over what they see with their own eyes 99 times out of 100.

Yale CS

If history has taught us anything over the past few years, it's that putting guys from Yale in charge of things is always a great idea.

So let's let this wise man create a national biometric identification system. It sounds like a bad idea to me, but I'm just part of the rabble. I haven't had the benefit of his education and experience. I've never even been to a regatta!

absolutelly!

Yes of course it would work!

Everyone knows that bad people are entirely willing to be completely honest, so obviously a system like this would mean we would know everything about them, and could stop all evil in the world.

Private Sector

It sounds interesting, but I am not for governmental control or involvement. Most here believe less government is better government. Why would we want to involve an entity that can't even balance a checkbook get its hands on something this complicated. I'm sorry but I don't see George W, Hilary Clinton, Barack Obama, or John McCain doing an adequate job at all except to hose it up and force regulation and compliance. Our current issues will not be solved with this. They will only take on a new twist.

Oh no, not this again.

Biometrics is inherently flawed as an authentication system, because biometrics is a password you can't change. Once someone gets your password, or at least the numerical representation of it such as could be lifted from a compromised reader or database, you are toast. How are you going to change your retina scan to something new?

And never mind the demonstrated hackability of all but the premium readers.

Biometrics sound great at first blush, and to the common voter they seem foolproof, so this fad will get worse before it will get better. In fact, the authentication issue may have achieved the level of complexity as the net-neutrality issue, such that Joe Registered Voter cannot possibly understand it (even if he is the rare sort to spend an hour googling it before forming an opinion).

Meanwhile, text passwords plus certificates (where 'certificate' could be a smart card, or your cellphone's IMEI, or whatever) is still the answer for security. It's awful, to be sure, but it's much less awful than biometrics.

Re:Oh no, not this again.

People continue to confuse identification with authentication.

http://wordnet.princeton.edu/perl/webwn?s=identification [princeton.edu]
http://www.google.com.au/search?hl=en&q=define%3Aauthentication [google.com.au]

Biometrics are good for identification.. they replace your "login", not your "password".

Open acts not private?

Perhaps not technically 100%, but you can expect a reasonable level of privacy/anonymity in public.

This could destroy that.

Are Fingerprints Unique

The idea that every fingerprint is unique is a untestable hypothesis, since you'd have to fingerprint everyone ever born, right? We assume it's correct because we've never found examples of fingerprints that were identical.

So my question is this: if we were to fingerprint everyone in the US (all 300+ million of us)... does anyone think we might find that matching set? No one has ever done a fingerprint database of that size, right? With a quick search, I couldn't find out how many prints were in AFIS.

On the topic more directly, I'd say this would be nearly impossible. Ignoring the privacy concerns that people would use to try to stop thing going into effect... does anyone think we would be able to convince most/all of the 20 million or so illegal aliens in the US to do this? I would think you would run into the same problems in just about any other country, except somewhere like China.

The article misses the point of anonimity

...The debate over Real ID and sensitivity to creation of any form of national ID reveal a fear that anything that identifies us to others will intrude on privacy . This has led to a preoccupation with forms of ID rather than the fundamental question of how we can reliably identify ourselves to each other....

This quote suggests that they miss the whole point of the debate over Real ID. I would argue that the main point of the opposition to Real ID was to oppose anything that make it easier for the government to reliably ID us.

...While anonymity implies privacy, it does not confer it. We delude ourselves into thinking we have privacy if the person next to us doesn't know our name...

Again this misses the point of the Real ID debate. While making it difficult for the government to ID does not prevent them from IDing us, it helps. It also helps prevent the government from retaliating against protesters. It does not prevent it, but makes it harder. That is why protesters frequently cover their faces. That is why protesters want to make it difficult for the government to track their travels.

Even the courts have found that anonymity is important component of freedom of speech. (Along with freedom of association.).

That's what my Tbird was for.

In public space, we engage in open acts where we have no expectation of privacy, as well as private acts that cannot take place within our homes and therefore require authenticating identity to carve a sphere of privacy.

The private acts that I did in the sphere of privacy carved out by my '88 TurboCoupe did _not_ require federal authentication, thank you.

Wrong question, but here's the answer: No.

Just like in the UK, it'll work until it's cracked. Or the RFID data from passports. It is no business of the government who I am, or where I am without probable cause by a signed affidavit. There's a sufficient majority that would make sure that a national ID system is never used in the US that it's moot anyway. And for Larry Ellison and others that want to try it, they'll get laughed at, again, and just as loudly.

The question isn't unique IDs, it's tyranny. We hack tyranny first.

commonly confused

The summary talks about a common misconception, and manages to create another.

Authentication is when you identify(as in Identity) yourself, when you want to(say, to enter your home), or to get that 5% rebate at that place you like to eat at.

Anonymity is when someone else wants you to identify yourself, and you refuse.

Imputability is when someone's done something and 1) you want to Identify them properly, and 2) do something about some of the people you identify(presumably because something they did was wrong)

Anonymity is something private citizens like, in part because they don't much like imputability. That is when they do something, and it's not tied to their Identity.

Forcing someone to authenticate themselves is something the police, for one, likes, because
1) It prevents them from being blamed for mis-identifying someone
2) If they catch you doing something, and impute it once you authenticated yourself, they're fairly sure they impute it in such a way, it will follow you for a long long time(if they can impute your "identity" more on that later.

However, it has its drawbacks
1) If you authenticate yourself with falsified credentials, you get someone else blamed for your acts
2) It doesn't deal with the fact that you may be unable(damaged or lost credentials)/unwilling to identify yourself/automated systems may mis-indentify you

It doesn't solve the question of "Identity" itself either. Like when the no-fly list(falling under imputability) lists names(which can be the same for two people), leading to the same result as a falsified authentication.

Just a quick summary:

Identity: Who you are
Authentication: Proving who you are
Anonymity: Not having to say who you are
Imputability: Blaming who you are

The four are interlinked, but often confused, as in the article.

People interested in laws like RealID need to pay a lot more attention to distinctions between all four. Until the authentication part can be more more foolproof, the imputability is scary(you can be blamed for stuff you haven't done), the anonymity, well it's scary to those who'd rather deal with people they can identify(and therefore impute, think contracts to keep it in the white hat sphere). And the Identity, well that's the real problem. If you have a single, centralized database, any single mistaken Identity becomes life-altering, if not actually life-threatening(correcting someone's id with falsified credentials in order to make their lives a living hell? Yes, it can do that).

Does that bother you a little? I know it does me.

Who Watches The Watchers?

Who is to be trusted with by biometric data? Who would have access? How would the software/authentication work? Who will write the software? Is it going to be proprietary? Will it be enabled in voting machines? Why should I trust the government agency/subcontractor to do all this correctly? It seems that whoever controls this biometric data would have A LOT of power, especially if its integrated into every little device out there. Consider the potential lack of transparency in, say, an election. Could some government employee, maybe just above the average capabilities of a TSA employee, tamper with election results? Also, if my biometric info is linked to my credit card, how hard would it for that person to go on a shopping spree. How could I prove it wasn't me? The whole thing wreaks...

Re:

It would concentrate a lot of power in whoever is managing the information.
Have you looked at the response winning the latest /. poll? http://slashdot.org/pollBooth.pl?qid=1544&aid=-1 [slashdot.org]
The only possibly better response than whatcouldpossiblygowrong wo

Re:It would work to...

This would do a lot of things. It would a) keep tabs on anyone who was not american (potential terrorists!) b) keep tabs on problem individuals c) increase national security, because sex offenders could be tracked (and given poor service when they're trying to access govn't services.

Why does all this scare me? Is it because I could be classified a 'problem individual' based on my political leanings? Is it because the Executive Branch reserves the right to pull American citizenship at will? Is it because even the Russians [wikipedia.org] know the best way to deal with a recalicrant individual, no matter what his power base, is to tar him as a sex offender?

My other question is of course, if I'm out and about, living my life in a lawful manner, why should the government care about me?. Police aren't there to arrest the lawful, they're there to arrest the criminals after commission of a crime. Where is the mandate to surveil everybody in sight waiting for them to commit a crime?

Re:It would work to...

The premise of the article - or at least the blurb - is wrong. It makes the claim we "have no expectation of privacy in the public space." But we do. Ever want to take a road trip to some town where no one knows you, just to get away, do some shopping, have dinner, watch a show, without having to deal with people who know you? Ever enjoy the feeling of being out, alone, in an unfamiliar city?

How's that going to sit when the desk clerk looks you in the eye as you walk up and says, "How you doing, Mr. LeParanoid, and how's that appendectomy scar healing up? Wife happy about that diamond necklace you bought last week?"

Or gives you a steely look because you're on The Sex Offender List (because you had the temerity to have sex with someone 3 days over some arbitrary line, or perhaps you pissed in a bush somewhere) and proceeds to treat you like a criminal as soon as your RF-enabled ID gets in range of his LittleDictatorsConsole(tm)? Sure, you can add biometrics to it so he's sure you're a sex offender or other malcontent antisocial. That'd all be real good, wouldn't it? After all, in this society, onece you're a criminal, you're permanently low class, you can't make up for it.

This whole ID mania needs to go away. It is a sign of a pervasive sickness among the rulers of this society. It is not a solution, or a potential solution, to terrorism, or any other problem we face.

Re:It would work to...

Authentication does not necessarily mean that those around me know who I am. Take a credit card transaction as an example -- the credit card company wants to know that I'm an authorized user of the card I hold. The merchant wants to know that my credit card company will pay them on my behalf. But the merchant doesn't have any fundamental interest* in knowing who I am -- only the credit card company does. So if I authenticate to the credit card company, and the credit card company authenticates to the merchant, we can all feel safe, and I can remain anonymous with respect to the merchant.

It's certainly possible to design the system to provide strong authentication for a variety of purposes without compromising privacy or even anonymity. Whether or not anyone will bother to do that/allow that to happen is debatable, but you shouldn't necessarily relate the ability to authenticate with an inability to provide privacy.

*I know they might like to know who I am for marketing purposes and whatnot, but they have no interest with respect to conducting a safe and reliable financial transaction.

Re:It would work to...

What you are describing here as privacy is actually what the blurb more correctly labels as anonymity.

No. You fundamentally misunderstand privacy. Privacy is not "being alone."

Privacy is the existence of social boundaries that we (generally) agree not to cross.

Examples: I invade a lady's privacy when I look up her skirts without her permission. I invade your privacy if I open your mail without your permission. I invade your privacy if I read your medical records without your permission. All of this can happen with you, me and the issue in question all out in the public space.

These are things we can do, but we agree not to do, because we recognize the fundamental right to privacy as existing in open society, not just in the home or when we are alone. Private means that you retain control by social convention over information which relates to your existence, and in turn, were I to obtain access by any means without your permission, I would have crossed the social boundary for that issue. That is the very core of "violating someone's privacy."

Anonymity is another social boundary. We have -- in the past -- recognized that others have the right to proceed about their day without having to inform others who they are and what they are doing. This boundary, like any other social boundary, can be crossed (violated, more like) by simple, easy actions on the part of invaders of privacy. But anonymity is not a thing unto itself, it is simply another facet of privacy.

The following should help you develop a better understanding of what privacy actually is: More on privacy. [ideaspike.com]

Re:It would work to...

There's at least one in the White House. The only difference is that he has more resources. "Shock and Awe" sounds like terror to me.

Yep, Dick Cheney with a few drinks in him and a shotgun in his hand will certainly wipe that smile (and a layer of skin) off your face real quick.

Re:And how well would that work?

When I was issued my Social Security card way back in the 60's, it said, in bold letters at the bottom of the card, "NOT FOR USE AS IDENTIFICATION".

That turned out well, didn't it?