Latest / Identity at the Center / #240 - Authenticate 2023: Biometrics with Stephanie Shuckers, Professor at Clarkson University and Director of the Center for Identification Technology Research

Transcript

#240 - Authenticate 2023: Biometrics with Stephanie Shuckers, Professor at Clarkson University and Director of the Center for Identification Technology Research · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Steadman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff, how are you?
0:26
Not so bad. Yourself doing great.
0:29
So yesterday we did the keynote version of Identity at the
0:34
center. I know one of the things we had
0:35
to kind of clip some of it to stay on time.
0:38
One of the things we wanted to talk about was like what this
0:41
show is all about. And for me, the punchline is
0:44
always to educate and entertain. And the reason I'm bringing that
0:49
up was this morning I was at the keynotes, very educational and
0:53
very entertaining. There was a guy named Mike Slaw
0:55
from Amazon who's up presenting. He said people say, wouldn't it
1:00
be neat if your name was coleslaw, you know?
1:04
And then he said, well, if you saw my full name is Mike, it's
1:07
Michael, my coleslaw. Hilarious.
1:11
And then he went on to give a very educational presentation.
1:15
So if folks have an opportunity to view that later, I want to
1:19
get him on the podcast as well. And he kind of.
1:22
Agreed to that already, so I think we're in good shape.
1:25
Did you get something in writing or?
1:27
Like actually it is some writing.
1:28
Get something. Blackmail.
1:30
You know, whatever it takes. I think he's, I think he he
1:34
likes being on stage, he likes talking.
1:36
So I think we're good. What'd you think of the food
1:38
truck scene last night? Oh, I loved.
1:41
I mean, the only problem was everything was like full size,
1:43
right? So it was like you had to decide
1:46
what you're getting. But I made a fantastic choice.
1:49
I got a a euro. You know, that's one of those
1:52
words like OK, is it Euro, is it?
1:55
Pretty sure you're saying it right.
1:58
But people around here seem to call them gyros.
2:01
OK, I didn't have that. I had teriyaki beef rice bowl
2:05
thing. It was good.
2:06
I know people went up for multiple trips, so you weren't
2:10
locked into just one choice. But there were also doughnuts.
2:14
There were, and Adrian is sitting here with us, and I tell
2:17
you right now, there was like a build your own doughnut station
2:19
last night in the Vander Hall. I haven't seen that before, but
2:23
like Chef's Kiss, it was plain doughnuts.
2:28
And then they had like just a bunch of toppings like
2:29
strawberry, chocolate and vanilla glaze.
2:32
And then, so I made a chocolate walnut doughnut.
2:35
And it was I found my new jam. Yeah, chocolate, walnut
2:39
doughnuts. And tonight there's going to be
2:42
more activities. We're going to be on the what is
2:45
it, the Superstar Lounge or something like that?
2:48
I can't wait. Heroes of the Green or or
2:50
something like that. Ages is legends.
2:53
Lawn OK. Legends lawn, we get the.
2:55
Appropriate branding in place. Yes, in our own mind.
2:57
Yep, in our own mind. So we're going to talk a little
3:01
bit about what biometrics? I think so.
3:03
We got the right person here to do so.
3:05
We sure do. She's Stephanie Shuckers.
3:07
She's a professor at Clarkson University and director of the
3:09
Center for Identification Technology Research, or CITER.
3:13
Welcome to the show, Stephanie. Thank you very much.
3:15
Thank you so much for taking the time here.
3:18
One of the things that we like to do on this podcast is really
3:20
learn identity origin stories. How do people get into this
3:23
business? You and I were talking a little
3:25
bit before we hit record here, and I'm going to ask you a
3:27
question a little bit. But for people who aren't
3:28
familiar with Stephanie, tell us a little bit about yourself and
3:32
the Center for Identification Technology Research.
3:37
I got into biometrics after I graduated with my PhD in pattern
3:42
recognition, mostly medical oriented.
3:45
I ended up in West Virginia, and you may or may not know, but
3:49
West Virginia is where all the fingerprints are stored with the
3:53
FBI physically in databases and electronic databases.
3:59
And so they said, hey university, you should be doing
4:03
more research around biometrics and what are the tools.
4:06
To biometrics panel recognition. So that's how I got into it.
4:12
Do you consider yourself part of the IM community?
4:15
Yeah, That's a great question because I do think we, we grew
4:19
up on a little bit separate families.
4:21
That was the biometric family and the identity family, you
4:26
know and and as time has gone on, I mean biometrics originally
4:30
was used very much in use cases that would be like the FBI.
4:35
So then moved more into use cases, you know related to
4:38
identity proofing and related to authentication.
4:41
And as that movement happened, the two communities started to
4:44
merge, which I think is fantastic because you know,
4:48
biometrics is just a tool, very simple tool, but it's the
4:51
context, you know in which it's used that makes all the
4:54
difference, you know and gives the real value of of a
4:57
biometric. So yes, I do consider myself an
5:00
identity professional. An identity nerd welcome, the
5:04
water's warm. That's right.
5:06
Am I welcome? Of course.
5:08
It's the one thing I like about this industry is it is a very
5:11
friendly industry where there's I think less competition.
5:15
I mean, sure, there's vendors right here competing against
5:17
each other, but we're all trying to do the same thing.
5:19
It's authentication, authorization, things like that.
5:22
How long have you been in biometrics total?
5:26
25 years, actually. It's it's my 25th anniversary.
5:30
Well, congratulations. Thank you.
5:32
Why biometrics? Yeah, great question.
5:35
You know, and I think it goes down to the very fundamentals of
5:38
what value it provides, right. It is a connection between the
5:43
biological cells and space, right, and the electronic, the
5:47
digital and and and it is something of value that really
5:52
no other form can provide. It doesn't work well just by
5:58
itself, right? As I said, it has to be part of
6:00
an ecosystem, but that provides that sort of extra layer of
6:04
information to make that connection.
6:06
And there's really two important pieces to that.
6:10
The the first piece, of course, is matching.
6:11
You have a reference from, you know, some authoritative source
6:15
or some enrolment step. And then there's the second step
6:18
where you're matching against it, and that's where the pattern
6:21
recognition has come in. But I think there's a second
6:24
piece that's equally important and this is what we call
6:27
liveness, right. And so that's ensuring that the
6:32
data being used to make that matching decision came from a
6:35
legitimate source, that biological heart beating, you
6:39
know, electronic you know, brain you know thinking person, right
6:43
that's their present at the time of capture and so, so those two
6:46
things give the true promise, the biometrics in my opinion.
6:50
I would like to say carbon based life form is that.
6:54
Is that appropriate? All right.
6:56
Who are you excluding in this carbon based platform, right?
7:00
You gave a presentation here Authenticate for folks who
7:02
weren't able to make it. Can you kind of briefly
7:05
summarize what you talked about? Yeah, So what we're doing in
7:07
Fido is a certification program. So biometrics, to really give
7:13
its promise, right, needs to be trustworthy and and how does it
7:16
need to be trustworthy? You know it needs to.
7:19
Work well for you all the time as well as reject anyone who's
7:24
trying to attack it and they can be attacking it, you know more
7:27
in a different person just kind of you know trying to use your
7:32
account or it could be as an attacker making a fake right
7:35
biometric and so so so this certification program you know
7:40
enables vendors to. Demonstrate how well their
7:44
product works and the and those that rely on those decisions can
7:48
have confidence You know both the relying parties as well as
7:51
the consumers. So tell us about a little bit
7:53
more about this Center for Identification Technology
7:57
Research. I'm just going to call it cider
7:58
because I think it's easier. What is like the purpose, The
8:01
mission take us behind the scenes.
8:04
If I were to walk in, what's happening?
8:08
Yeah. So we're a National Science
8:10
Foundation center, so that's the US Funding Agency for science
8:15
and we're in a program that's industry focused.
8:19
So we're industry cooperative. And in our case, we also have
8:22
government members. And what we're looking at is
8:26
really more on the plied side. What are the pain points in
8:30
industry and government around technology, both biometrics as
8:34
well as general identity? And how can our research, you
8:38
know, help with those pain points?
8:41
And so, So we do a lot of very applied research, but we also do
8:44
basic science research too, because sometimes, you know, we
8:47
need to be very forward-looking, you know, in terms of what some
8:50
of the problems are. And in fact, Sider started as I
8:54
was a young professor, I said 25 years.
8:56
Well, Sider itself just celebrated its 20th anniversary
9:01
last year. And so.
9:03
I wasn't the director at that point, but but we've been
9:07
working in areas like liveness detection for since the center
9:11
started. So, so you know, we have to be
9:14
thinking about what's the next problem we need to solve, and
9:16
that's that's what we do in the center.
9:19
You know, I think one of the the top definitions that you have to
9:23
learn as an identity practitioners what is MFA or
9:27
Multi Factor authentication. So we say it's at least two of
9:30
the following. Something you know, something
9:33
you have, something you are, I guess, I think of the biometric
9:37
as essentially something you are.
9:39
Is that the right kind of definition for biometrics?
9:43
Yeah, I think that makes it very straightforward right as to what
9:46
it holds, right, what value it holds in an ecosystem that's
9:51
multi factor and and then I've also heard what you do and that
9:56
incorporates some of the behaviours which we often use in
10:00
multi factor authentication. Are those considered biometrics?
10:04
So this would be like your gestures, right?
10:07
Yes, yes, there's some behaviours that you can use in
10:10
the way we use biometrics in terms of comparing against a
10:13
reference and there's some behaviours that would be more
10:16
like Geo behaviours, right? You know.
10:18
So I guess in some sense there is a a reference in terms of
10:22
your your movement, but it's a a slightly different, you know use
10:25
case and how it comes together. But generally in the world of
10:28
biometrics, yet they all, they all fall in.
10:31
So in general though, what are the different types of
10:34
biometrics? What?
10:36
You know, give us kind of the the glossary version.
10:39
Yeah. So you know there's the kind of
10:42
face finger, iris, right is, is our, you know, main biometrics.
10:46
But there are many other biometrics that we've seen in,
10:50
in, in operation. People get a little confused
10:54
between iris and retina. So iris is the colored part of
10:58
your eye, and that's what's mostly used today.
11:00
Retinas, the back of the eye, which we don't use very much.
11:03
Of course voice biometrics, it is another one that has very
11:07
some very specific use cases as well as DNA that can be useful.
11:12
But you know, I I think really it's about you know what the
11:17
value is, you know in, in terms of the ecosystem, choice is
11:22
good, right. People like choice.
11:24
I like having choice, you know, on my in my biometrics, on my
11:28
phone and so so and choice may be an ecosystem.
11:33
You know, base a reason that why one modality might be selected
11:36
over another. What's the best biometric and
11:41
then what's the worst biometric And when I I'm going to qualify
11:44
that meaning security is, you know a fingerprint less secure
11:50
than iris or voice or other types.
11:54
I love this question because it is a common question and I like
12:00
to answer it that it's not. The modality that you need to
12:04
look at, but the actual specific implementation that that will
12:09
tell you the security posture, because in order to put together
12:13
this matching and this liveness, you're talking software and
12:17
hardware, right? You know, and one fingerprint
12:21
system could be, you know much, much worse than you know, you
12:26
know an iris system. And there's two conflict just
12:29
based on the underlying technology.
12:32
Under the hood, which of course gets back to the value
12:35
proposition of things like certification, right?
12:37
You know that helps you, you know, look look at the product
12:41
as to whether it's achieving what it's setting out to
12:43
achieve. Is there a common mistake that
12:46
you see for deployments of biometrics or it's like to your
12:51
point, right, it's it's the not the modality, it's the
12:53
implementation. Is there like a common thing
12:56
that comes up or is like, Oh yeah, that should have been
12:58
deployed a different way and will certification help that?
13:02
Yeah, yes. So one of the things that with
13:07
all the attention on matching and matching performance, you
13:12
lose sight of the front end, the actual capture of the biometric,
13:18
because a good quality capture gives you good performance.
13:22
But if you're only testing databases, you know you're not
13:25
doing anything with capture. Right.
13:27
So capture and that's that user experience you know that we've
13:30
been talking about in terms of you know if I do in passkeys
13:33
that same user experience applies to your biometric and
13:37
so. So if you can help the
13:42
individual through your user interface to provide a better
13:48
quality biometric, you're going to get a better experience, and
13:52
that often gets ignored. And liveness plays a role in
13:54
that because liveness might, you know, put a barrier up.
13:59
Just think of, like, caches, right?
14:01
You know they're a big pain, right?
14:02
You know, I mean, I stare at those things.
14:05
Are you sure? I'm not good at them.
14:07
So maybe you are a robot Exactly.
14:09
Exactly. That's what a robot would say.
14:14
So something that was coming to mind as we were talking about
14:17
this was how Apple, you know, have the Face ID work great.
14:23
I think it worked great. Then all of a sudden went to
14:26
pandemic mode. All had masks covering our
14:28
faces. Some places it was OK to pull
14:31
your mask down, some other place not really, but they adjusted
14:35
right. All of a sudden at some point
14:38
from my perspective, Face ID started working again.
14:41
So what was that? Are there like dials that where
14:44
you said OK, we can get by with half of the face or?
14:48
Yeah, Yes, absolutely so. The the algorithm that does the
14:53
matching you know works based on the data it's trained on.
14:58
So if you know people wearing masks was just not a common
15:02
thing, you know there probably wasn't much representation of
15:05
that in their training set. And so if you retrain your
15:09
algorithm to really look at top half of the face rather than the
15:13
whole face, you know, you know, maybe condition on the presence
15:16
of a mask, you can achieve performance and you may be
15:20
asking. Is it, you know, going to
15:23
perform? Not as well, right?
15:25
If you have less information, and I would say there are use
15:29
cases where that may make a big difference.
15:31
But those use cases are searching very large databases
15:35
from the case of a one to one match on a phone, your device.
15:41
I don't think there's a significant difference, you
15:43
know, from the point of view of security if you have half face
15:48
versus whole face. When you say.
15:51
Perform not as well. What do we mean by that because
15:55
I typically see like statistics of like it's 99 point something
16:00
percent, I don't know positive or accurate or whatever you know
16:05
terminology you want to use. Are we talking about still in
16:08
that range or are we seeing more like well we went from 99% to
16:12
maybe 95% or 85% or something that is just not as you have to
16:18
use maybe other factors to try and?
16:20
Triangulate the the identity. Yeah, Yeah, great question.
16:24
And I think the answer to this question is very use case
16:26
dependent. And so in Fido we are focused on
16:29
on authentication. So that's a one to one
16:32
comparison. We're not searching large, large
16:34
databases. And so the metrics that we came
16:37
up in our certification program are based on that use case.
16:41
And so we selected requirements. You know, based on the use case.
16:46
That makes sense, right? To have the right security
16:49
posture as well as give the best convenience for the user.
16:53
And when I say it's not noticeable, it's not noticeable
16:56
because you know you're still meeting the requirements that we
16:59
need to to to achieve both of those and the the security.
17:05
So if someone says 99.9% to you. You know you you'll want to look
17:10
at them sceptically because you really need multiple metrics,
17:12
really because there's kind of three types of things that you
17:15
you want to look at. You have your your genuine user
17:18
performance, right? You've got your possibility.
17:22
If I grab your phone and put it to my face, you know whether I
17:25
would accidentally match. We call that the false accept
17:28
rate and then your last is kind of your vulnerability if you're
17:31
trying to hack it with a if. I took a photo of you and tried
17:35
to to get into your device. With that photo.
17:38
And so those are the things we're testing for and we have
17:41
metrics for each of them. It kind of feels to me like I
17:44
don't want to pick on Apple. I think they do a lot of great
17:47
things, but it kind of feels to me like the Face ID and the
17:51
thumbprint reader was more a matter of convenience.
17:55
So in other words, like if it can't see your face, you punch
17:58
in your 6 digit pin, which is not super secure right?
18:04
It's knowledge base factor. Is that right or?
18:08
Am I looking at it the wrong way?
18:11
I I would posit that yes it's convenient.
18:14
We like that convenience but that doesn't mean we're giving
18:17
up security in order to get that convenience And so, so I think
18:22
you know the that usability having that backup plan is
18:26
certainly, you know I use my pin every now and again because you
18:29
know my right hand's busy and my face isn't working and so I tie
18:32
my pin right. You know, I mean, we all have
18:34
that experience, right? So.
18:35
Face doesn't work. Well, whether you do it or not,
18:38
the pin is there. Exactly, exactly.
18:41
So again, that's part of the user convenience, right?
18:44
So it isn't so much that I've like given up some security to
18:47
use that face. I I think today, the way these
18:53
systems, the good systems perform right, they provide
18:57
significant security. Because if I were to have to
19:00
hack into your phone, I probably wouldn't start with.
19:04
A photo of your face. I'd probably try to find your
19:06
pin or try to watch you, you know, you know, shoulder
19:09
shoulder surf as my. 1st Anniversary.
19:12
My first go. And when did cider start?
19:16
That's right. So I, I mean we've made
19:17
progress. We really have made progress,
19:20
right, because biometrics work quite easy to spoof, you know,
19:22
20 years ago. So when you went over the list
19:25
of possible biometrics, one you mentioned was a voice.
19:28
I find it just like a use case that could be very usable.
19:34
Right to when you call the help desk or your call a call center
19:39
matching your voice print to what it should be, what are, But
19:45
you don't see it as much as I think you would like to see it.
19:49
Is that because it's inherently flawed?
19:52
No, I think it's much more use case dependent.
19:55
So you know if if I'm trying to log into my phone and I'm
19:58
sitting in a conference, I'm not going to use my voice, right, It
20:01
just wouldn't be convenient. So the use cases that do work
20:04
great for voice or or call centers like you bring up and
20:09
you know certainly that's you're seeing that adoption.
20:14
In fact, I think on the keynote in the first day they were
20:16
talking about, you know what do they verify your identity with.
20:19
Now, when you call a call center, right, you know your
20:23
name, your address, you know your e-mail address, your phone
20:27
number, things that can be easily gathered about you.
20:30
And so adding a voice does provide extra value, you know
20:34
from the call center point of view of course there are attacks
20:38
on that too, you know, so that's the spoofing side of the
20:40
equation. So we do need to be aware of
20:42
what's happening in AI and and deep fake voices in terms of
20:47
understanding that data. But I still think, you know,
20:50
compare where we are today. If we add voice, we've added,
20:54
you know, making the attack just that much more difficult.
20:58
And when we're talking about major scale, every little
21:01
increment makes a difference. Yeah.
21:03
Now, Jeff, you rolled out voice biometrics in the past and was
21:07
it pretty well received? I mean, what were your learnings
21:10
from that? My learnings were, I don't know
21:12
much about biometric or voice biometrics when I rolled it out.
21:16
So I learned a lot and learned a lot of things around different
21:18
transient characteristics of a voice and it was effective.
21:22
Did we get enough? Uptake on it, No, I don't think
21:26
you ever get as many people as you want registered, but it did
21:29
work and this would have been 20, no 2009, maybe 2010,
21:34
somewhere in that area. So I'm sure the technology has
21:37
gotten better, but it did work. It just for whatever reason
21:44
people just weren't comfortable I think calling into this.
21:47
So what we had done is we set up an 800 number and it was a call
21:50
center type of environment and. It was a way to call in and
21:55
reset your passwords, so you would say at so and so.
21:59
My voice is my password, which for whatever reason seems to be
22:02
like the common enrollment phrase for every company.
22:05
Can't think of anything else. Right, Yeah.
22:07
And so you would, you know, you had to enroll with it.
22:09
So that was that was the first step, right, Because you had to
22:12
enroll with it, you immediately lost 100% of the population.
22:16
It wasn't ever going to be 100%. Only some percentage was going
22:18
to do that. You had roll, you register and
22:22
then from there you know you had basically like a phone menu that
22:24
would let you reset passwords. So it worked.
22:27
It was OK. I think we struggled with
22:30
adoption. I don't know if we were just too
22:33
early, didn't incent users enough.
22:35
We had multiple ways also to reset passwords, so more people
22:39
gravitated towards knowledge based authentication and going
22:43
through like a web form. Basically I liked the phone
22:46
version because it could reset passwords that you couldn't get
22:49
to. If you couldn't get to the, you
22:52
know the internal Internet site that will do the knowledge base
22:54
authentication. I mean, our industry's so
22:56
fraught with now these basic phishing attacks to steal
23:01
people's credentials or to get logged in as those people.
23:04
I mean, a recent one in the headlines was folks, the
23:10
attacker called the help desk and got reset.
23:13
Now, I would think that a voice verification would have been.
23:18
An ideal way to match up person had they not registered, they
23:21
wanted to get in. They're saying I'm calling from
23:24
very far away and I can't. You know there's no way then
23:29
that you reset their credentials, right.
23:31
Your manager has to speak to you and then call me.
23:34
Now I think sometimes help desk or they're trying to meet these
23:39
metrics like keep your call short and so I don't want my
23:42
call to. Take resolution.
23:43
All that stuff, it definitely plays into it.
23:46
But you cannot sacrifice security just because you're
23:49
trying to get someone off in 2 minutes and 30 seconds.
23:52
If it takes 2 minutes and 35 seconds and it's a more secure,
23:55
you should be doing that. Yeah.
23:56
Or even if it takes an hour, right.
23:59
So, Stephanie, one other question that I or thing that
24:03
comes to mind, especially with biometrics, I think is like
24:07
privacy. How big of an issue is privacy
24:10
when it comes to biometrics? I think a lot of them get stored
24:14
on the. The local device.
24:16
Then there's other biometrics that maybe get stored on the
24:19
server somewhere and can they be stolen and and reused?
24:25
Yeah, great question. So to kind of ask the last part
24:28
first, in terms of stolen and reuse, that's really where
24:31
liveness comes in because even if someone were to steal my
24:35
biometric, they have to take that biometric and they have to,
24:39
you know, present it to the biometric system.
24:43
And so that so a stolen biometric does not really equal
24:47
a stolen password because the, the way to take a stolen
24:50
password you just enter it. Right.
24:51
But to take a stolen biometric you have to do all the fun stuff
24:54
I do in my lab in terms of you know making masks or printing
24:57
out gummy fingers and so or doing you know other kinds of
25:02
attacks like man in the middle attacks hacking it and so.
25:06
So the stolen biometric is, is one piece of confusion for sure
25:11
and and we need to do a better job of getting the message out.
25:13
You know that that this is quite different.
25:16
But that aside privacy is still a concern and I think people
25:21
understand that a lot of data is being collected about them.
25:24
You know their obviously their identity information, their
25:27
personal and biographic information, but as well as you
25:30
know, you know their Geo information where they move,
25:34
where they're browsing and their search history and what they
25:37
bought, right. You know and so, so I think I
25:39
think people are sort of feel this kind of like Oh my gosh,
25:42
one more thing they're going to collect about me is is a piece
25:46
of it and so, so, so we can see the value it provides.
25:51
You know that we talked about you know connecting to that
25:54
specific individual, you know, but we have to get the clear
25:57
message across. And that's what Fido I think did
26:00
really well at the beginning because the in in Fido
26:04
authentication you said it, your biometrics stroll locally, you
26:08
prove yourself, you're to device and we take the cryptography
26:11
takes over and proves itself to the relying party and passkeys
26:15
continue that. Right.
26:17
But there are use cases, identity proofing use cases that
26:22
you know the authentication doesn't solve right.
26:25
You know, and so, so now if if we want to do more where
26:30
something's stored in the cloud by a trusted source, right,
26:33
that's holding your biometric, you'd like to know a little
26:36
more, you know about it. Think mobile driver's license
26:39
that are coming down the Pike, right.
26:41
And so so you know and I I think that the key to that is really
26:47
about best practices and use cases and really thinking about
26:51
privacy just in the way we think about privacy for all our other
26:54
personal data and we're asking of individuals and if we can
26:59
improve the user experience just like you said.
27:03
I liked it because it was so convenient, you know to before
27:06
if we can do the same for remote identity proofing, right.
27:11
I like it. So it's because it's so
27:12
convenient. Oh by the way I don't have to
27:14
give you a bunch of 12 other pieces of information right now.
27:17
I can bypass that because I have a more a reliable piece of
27:21
information to make that remote identity proofing decision.
27:24
You know, there were a couple of product managers from Google
27:27
presenting this morning at the keynote.
27:30
And they do a lot of like user research, right.
27:34
So they have these folks that do the thing and then they take a
27:39
survey And one of the things that they found, one of the
27:42
metrics that that drives them is that people need to feel the
27:47
system is as secure, more secure.
27:50
It's just as important as it actually being more secure,
27:54
which we know it is and pass pass keys over passwords.
27:59
I know how to solve that, you just put a little image of a
28:01
lock in the corner. Yeah, that's secure.
28:03
That's, that's it. But I I think on the privacy
28:06
front, one of the reservations that people have is that, all
28:10
right, you're looking at my picture.
28:11
How long is it going to be until some database gets cracked and
28:15
my pictures all over the Internet, it's probably, it's
28:17
not going to happen, right? Well, maybe it could happen if
28:20
someone did a really bad implementation, but how do you
28:23
get that? How do we change people's
28:25
perception of that? Yeah, I I think it's it's a
28:29
concern and I and I think it goes back to the fundamentals of
28:35
even though it's stolen, it's not useful, right.
28:38
I mean, already our face is quite, you know, public, right?
28:42
You know, I mean, it's in databases, you know, every time.
28:45
You step out. There's a camera somewhere
28:46
exactly exactly so. So and and Face ID is not
28:50
breaking right. Why is it not breaking right?
28:53
Because it's is embedded into a good ecosystem in terms of how
28:57
it works. You know, as we roll out
28:59
additional things, we have to think through these scenarios,
29:03
you know, and ensure it doesn't break.
29:06
Just because that information might might be public now, I
29:10
mean it. There's real legitimate concerns
29:13
about scraping people's faces into large databases.
29:17
And these are not the types of systems that, you know, we're
29:21
thinking about when we think about identity proofing.
29:23
We're talking about identity proofing for, you know, people
29:25
who want to opt into these types of solutions.
29:29
But the scraping, it is a big deal.
29:31
And I think that does hurt biometrics because we don't have
29:35
at least in the United States you know guidance around what is
29:40
OK to do and what is not OK to do when it comes to face whether
29:44
it be, you know, large, you know, large scale databases or
29:48
it's surveillance in certain scenarios, you know and so, so
29:52
I, I, I do, you know, as a citizen, you know, I'd like
29:55
there to be legislation. I know there's a lot of work
29:58
being done around that and hopefully that will come to
30:01
pass. Yeah, I think sometimes we
30:04
think, oh, the the privacy folks are the ones with the tinfoil
30:07
hats, right? But I I think it's.
30:10
I don't know. I think it's very much a.
30:13
Legitimate concern that there's kind of this dystopian future
30:17
where you have no privacy and just look at the example of, you
30:22
know, the cookies. So we had this law.
30:25
You can't just put cookies on people's computer.
30:26
They have to agree. Well now it's like every website
30:29
you go to. It's either allow cookies or
30:32
don't use the website privacy policies on almost every site.
30:37
It's like, OK, am I going to read this 20 page privacy policy
30:42
for something I have to do if I I want to buy a sweater?
30:45
Do I want to read your 20 page privacy policy of what you're
30:48
going to do with my data? I think it's people have a
30:51
legitimate reason to think, all right, this is designed, nobody
30:55
reads that privacy policy or let's say 99.9% of people never
31:00
read it. And it might say, we can give
31:03
your data, we can saw your data, right.
31:05
And there's guardrails, right? That's what we need is
31:08
guardrails and there are some guardrails.
31:11
GDPR, California, Illinois, there are examples of
31:16
guardrails. You know, the problem right now
31:19
is that it's a very fragmented, you know, set of guardrails
31:23
around that. And I think we can be more
31:25
specific when it comes to biometrics on what you can and
31:29
can't do. But it, you know, I think
31:31
fundamentally you know that that's a piece that you know
31:34
will help with the the value proposition because in the end,
31:38
you know, we see the convenience, right, you know and
31:41
so being clear how you're going to use the data to your
31:46
customers, how long you're going to keep the data, who was going
31:51
to have access to the data, how to see what data they have.
31:54
All of these very classic privacy principles you know need
31:57
to be applied for every biometric.
31:58
System, do you see? Bipartisan support for something
32:05
like this. The reason?
32:08
And the answer is no, right? Well, what I'm saying.
32:10
Here, though, is and when I and I want to define bipartisan what
32:13
I mean is users and companies, not politics, because I can't
32:17
imagine a fragmentation of rules, regulations, laws,
32:21
whatever. It is good for anybody.
32:23
I would rather, as a vendor in this space, if I had a product,
32:27
know what my rules of engagement are versus well.
32:30
I have to do something different in California versus Illinois
32:32
versus I don't pick a state or a region or country or whatever it
32:36
may be. I guess why aren't we seeing
32:40
more of a support for give us the rules.
32:43
I know nobody wants more rules, but give us the rules so that we
32:46
know how we should be creating these processes.
32:51
Yeah. I mean, I I I think they're
32:52
coming. You know, it's natural that
32:55
regulation lags technology. You know technology of.
32:58
Course you know moves very quickly and only moving more
33:01
quickly you know so but but I I think they're coming and I think
33:04
the industry you know for the most part is policing themselves
33:08
or pre anticipating you know what what's down the Pike and
33:12
it's just I think where the issues come is some of these
33:15
kind of edge cases. You know really kind of tarnish
33:19
really the whole industry and and that's that's the part that
33:24
you know some full guardrails would be very helpful.
33:28
Can we go behind the scenes of what actually happens with
33:30
biometrics? When someone says or let's say
33:35
you know, I'm using Face ID to log into my phone, what is
33:39
actually happening? Pictures taken of my face and
33:43
then it's matched up against something and some algorithm.
33:46
Can you take us just behind what you know?
33:48
Maybe. Let's pick a couple use cases,
33:49
Face and fingerprint. Yeah, Yeah.
33:53
So I mean, what you said is exactly right.
33:56
I think where it goes a step further is related to liveness
34:03
and so. So a face, there's features
34:07
within the face, right, that are captured.
34:09
Now we use deep learning or AI as the algorithms that's trained
34:14
to learn what are features to differentiate individuals and
34:19
then those are the features you know that are are compared and
34:23
create a score you know to make a decision live.
34:26
This goes a step further and it says OK, now I'm I'm going to
34:29
take some information from this you know face either you know in
34:34
a video stream I may have extra sensors.
34:38
If you think about Face ID, there's a near infrared camera,
34:42
there's structured light shining on the face, it gets a 3D
34:47
representation. It shines a specific pattern you
34:51
know for you. And so it's adding some
34:55
additional pieces of information to make it more difficult for an
35:00
attacker to come and create, you know use a photo of you in order
35:04
to to to fake the system and so, so the systems are getting more
35:08
complex, there's actually even more steps, right?
35:12
I've talked about quality already.
35:14
So making sure you get a good, a good image, but then there's
35:17
also how we secure the data. And so you know when when the
35:22
data store locally under your device in a secure part of the
35:24
phone, that's one thing. But as we move to systems where
35:28
the the reference that extraction of features is stored
35:32
you know on a server side, we can actually do some more
35:35
sophistication you know to to extract you know essentially
35:40
some key from your biometric that gets stored that can't be
35:45
reverse engineered to your original biometric.
35:48
So, so the systems have a lot of sophistication and and and are
35:53
continuing to research these different aspects of some of the
35:57
things we do in the center, but also we're seeing these things
36:00
in commercial operation. How important is it is the haves
36:05
and haves nots when it comes to having technology that can
36:08
accurately perform these transactions to validate
36:12
identity. Yeah, I mean I know biometrics
36:15
you know are more oriented towards the higher end phones
36:20
but I think you know cameras are in kind of most phones these
36:24
days you know so so at least and from that point of view you know
36:29
fight face is available. Fingerprint sensors can be very,
36:33
very cheap. You know they're capacitive
36:36
piece capacitive based sensors that are incorporated in phones.
36:39
So. So I think you are seeing it
36:41
rolling out to not just the high end phones you know, but across
36:45
the. Ecosystem, the thing everyone I
36:47
find interesting because there's been a few variations of that
36:49
implementation, especially over the last years.
36:51
You've got the the sensor itself, and now they're trying
36:53
to put them underneath the display you know of of.
36:57
The the the goal of. I just want a slab of display.
37:00
I don't want to have like bezels, right?
37:02
Right. But I think some of those
37:03
implementations, at least early on, struggled with being able to
37:06
be either accurate or consistent for the end user experience.
37:10
Do you have any experience in an area, or am I really nerding out
37:13
here? No, no, no, I'll let me nerd
37:15
out. So, so absolutely.
37:18
I mean fingerprints. There is a, you know, it's a
37:22
small percentage but a percentage that of people's
37:26
fingers that just don't read well, right.
37:28
You know, and that can be due to you know, doing a lot of
37:31
gardening or just a significantly dry fingers or.
37:36
Gardening garden. Yeah, just like a lot of work
37:38
with your. Hand oh, so worn down.
37:40
Maybe wearing squirrels and right, you know, and so, so, so
37:45
I think when you see, you know, kind of problems around
37:48
fingerprints or maybe it's a super cold day, right, you know,
37:51
and you pull out and you put it on and you see it doesn't work
37:53
because your hands are very, very cold.
37:55
Because you have gloves on, right?
37:57
Exactly. Right, yeah.
37:58
Why is my thumbprint working where I live, You know that's
38:01
pretty common occurrence and so so so you know some of that
38:07
variation in performance is, is because of that and of course
38:10
you know sensors get better, right you know in terms of of
38:14
being able to adapt to those variations as well as you know
38:20
providing you know enough biometric information to make a
38:23
good decision, you know so, so as all technology it has
38:26
improved you know but there is still kind of a fundamental
38:29
group that it can be quite difficult to take a fingerprint.
38:32
That adaptation I would expect extensive things like biases and
38:36
disabilities. How much of A role do those play
38:39
into capturing A valid biometric credential?
38:44
Yeah choice is good right choice in terms of you know of
38:48
modalities, you know to ensure, you know, I mean I like my
38:51
choice as I as I said earlier but you know moving a little bit
38:56
towards biases so. So there was some fundamental
39:01
work looking at biometric performance for different
39:06
demographic groups, different ages, genders, race,
39:10
ethnicities, skin tones and kind of a a realization that if we
39:15
just look at a global number, we may be missing you know what's
39:19
going on for groups of people and what we want for our
39:22
technology is to work well for everyone, right.
39:24
And so, so by slicing and dicing our data across demographics, we
39:29
can look at performance and ensure it works well for all.
39:32
And you know there's been significant improvement that you
39:37
know now that that scrutiny has been looked.
39:41
So NIST does some very extensive testing around demographics.
39:47
Fido is looking at putting together a certification
39:49
program. So I think for your best
39:52
solutions, those demographic differentials you know are much,
39:56
much smaller or non existent particularly for the genuine
39:59
user than they were. But that doesn't mean you
40:02
shouldn't look, because you know, there are lots of systems
40:05
out there, right? You know, and so that's.
40:07
You know, part of understanding the technology that you're
40:09
adopting, the specific technology you're adopting, not
40:13
just whether it's a fingerprint or not.
40:15
Forgive me for this naive question, but how does skin
40:19
color play into something like a fingerprint or facial
40:23
recognition? Yes.
40:25
So from from the face recognition point of view, you
40:28
know, I think there was a lot of press around, you know, making
40:32
cameras that will work well for everyone.
40:34
They do detect faces, right. They do make auto adjustments,
40:37
you know. And so in the same way having a
40:39
good photo of somebody, you know, you know it's good when
40:44
you want to take photos, but also you know, being able to do
40:48
a good biometric match means having a good photo right to
40:51
begin with, right. And then if our algorithms are
40:54
AI based, based on training data, if our training data is a
40:57
representative of, you know, the the population you know, then it
41:02
isn't going to know what to do, right.
41:04
When it, it sees faces it's really never seen before, you
41:07
know. And so that's, that's about, you
41:09
know, having a representative training set.
41:11
Is that more likely to lead to false negatives or false
41:15
positives? Because it seems to me like.
41:18
Not having that footprint I guess could lead to either one,
41:21
but it's more likely to lead to a false negative because here's
41:25
what I I think in my head, right?
41:27
I have no research to back this up, So I know you don't operate
41:30
that way, but I do. So if you had a very dark skin
41:35
tone and you're relying on infrared, kind of like scanning
41:39
your face and turning into a like a calculus problem
41:43
essentially if. What it's doing is measuring
41:47
differences. Maybe the camera just doesn't
41:50
work well with very dark skin, for example.
41:55
Yes, So it can actually affect both.
41:59
So in Frodo, what we're focusing on initially is just how your
42:03
senses we want the genuine user to have the same experience, you
42:08
know, as other users, right? You know, and so.
42:11
So we're looking at at the differentials for the false
42:15
negative use case. But you shouldn't bury your head
42:18
in the sand to say, OK, so we only need to worry about false
42:21
negatives, not not false positives.
42:23
So what are false positives? So false positives would be
42:26
cases where you know two different people just happen to
42:30
match you know or you're doing attack you know with the with a
42:35
a spoof and so. So that's the thing we're going
42:38
to look is this kind of a second thing to look at, right, You
42:41
know, but you would want to know, right, if the false match
42:45
rate, you know, for one demographic was significantly
42:49
higher than another and that can happen if the system isn't
42:53
trained well. Yeah, one thing I've noticed
42:55
like so I have a beard for people who can't see it.
42:58
Haven't met me before. And it doesn't seem to matter
43:02
how long the beard is, right? And I've heard that if people
43:06
got like a what do you call it, rhinoplasty or a facelift, the
43:14
face ID will still work. So it seems to me it's like must
43:18
be implementation specific, like how much difference are you
43:25
willing to accept from whatever stored in the database?
43:30
Yeah, yes, exactly. There's there's a threshold and
43:33
there's a point at which you know it, it won't work right
43:36
when you have alterations and then you may need to re enroll.
43:41
So I had one last question. So the topic is around deep
43:45
fakes, yes. How?
43:49
How are you thinking about deep fakes and how that could affect
43:53
the biometric space in the future?
43:56
Yeah, great question. So what Deepfakes can do is they
44:01
can take, say, a still photo of you that I might have as an
44:08
attacker and they can animate it, right.
44:11
You know, that's one of the things that deepfakes can do.
44:14
And so, So if my biometric system and the way it operates
44:21
requires some kind of motion, you know, in the face, then that
44:27
can be used to attack a system. It can be used in two ways.
44:31
It can be used, you know, like if you think of your Face ID and
44:34
your phone, right, you can present that Deepfake to the
44:38
phone. Well, we all know that's
44:40
probably not going to work on Face ID, right?
44:41
Because Face ID is looking for a three-dimensional thing.
44:45
And I've now just displayed a 2D Deepfake, right?
44:47
You know, So probably won't be successful.
44:49
That doesn't mean it won't be successful in other scenarios,
44:53
right. But you could also take that
44:55
deep fake, you know and you know bypass or inject as a replay
45:00
attack and so. So especially systems that are
45:04
kind of widespread and people have easy access to, you know,
45:08
as an attacker to you know create a virtual camera or some
45:12
kind of way of bypassing. And in those cases we still can
45:16
use approaches like liveness and we call them challenge response
45:21
to probe the system to see if there's truly a legitimate
45:25
person there. And so if the deep if the deep
45:28
fake creator can't pre anticipate what challenge
45:34
response is going to be present then it makes it that much more
45:38
difficult for them to to mount the attack.
45:40
So we are many biometric systems have these kinds of solutions in
45:47
them that not only do the liveness from thing physical
45:50
mass but also deep fake attacks. I feel like we're in this
45:54
identity space where it's the the finish line keeps moving or
46:01
the good enough line keeps moving, right?
46:03
The attackers come up with an attack, the industry comes up
46:08
with a barrier. The attackers figure out how to
46:11
go and get that because they kind of think, OK with deep
46:14
fakes, you know, that's a big hurdle.
46:18
To cross to get to somebody's account.
46:20
But it would be worth it for certain accounts, I'm sure.
46:24
But also now AI is coming and getting, you know, just
46:29
exponentially growing in terms of its capabilities.
46:32
So maybe these kinds of attacks become more commonplace.
46:36
So we are then forced to move that security line a bit
46:40
further. But it seems to me like it's,
46:42
you know. It's moving, it's progressing on
46:45
both sides as we go and it will continue to do so.
46:49
Yeah, absolutely. And that's why we want to pre
46:51
anticipate, right. You know the types of attacks
46:54
that may happen and what what the solutions may be.
46:56
But you know, absolutely it is sort of a, you know, a race.
47:02
An arms race right? A race?
47:03
A race? A face race?
47:05
That's right. When you say predetermined or
47:08
pre anticipate, what do you mean by that?
47:11
Yeah, I guess I'm referencing in the Research Center, you know
47:14
we're doing research thinking about you know what is the the
47:17
next thing that we will need right.
47:22
You know and so so you know in in terms of you know liveness,
47:28
you know quality assessment, you know securing templates, you
47:32
know with non invertible right. Templates can't be reverse
47:36
engineered. Deep fake detection, right?
47:39
These are the things that we're doing in the center, you know,
47:42
to help enable the industry, you know, to, you know, be in the
47:46
position to adopt and provide it.
47:49
There's a whole YouTube channel around cider that does a whole
47:53
bunch of videos around biometrics.
47:55
We'll have a link in our show notes so people can check that
47:58
out. And for my cheap friends out
48:00
there for free, it's YouTube Free Education.
48:03
You might have to watch some ads, but probably worth it at
48:05
that point. Is there a certain type of deep
48:09
fake that you're especially concerned about?
48:12
Because I think for me, voice seems like the one that is
48:16
easiest for an attacker to execute against, but I'm not
48:20
sure if that's right or there's something else that I should be
48:22
thinking about. No, certainly I think that's the
48:24
one that's risen up quickest because when we think about it,
48:28
we think and I think you referenced this, it's it's how
48:31
easy it is to mount the attack which then will tell us how
48:34
scalable the attack is, right, because now it's not now we're
48:39
we do have to target somebody, right.
48:41
So we have to make a decision right.
48:43
We have to go find their voice sample you know in this case and
48:46
we have to train a system right. So we are still at, we're at the
48:51
targeted phase and so, so you it does take it kind of one step
48:57
more however the the, the the attacks themselves, right, how
49:06
easy it is to make them can vary, right.
49:09
And so right now I think why voice has risen to the top is
49:13
because it is just super easy. There are these tools out there.
49:17
Train it quickly, boom, type in whatever you want it to say.
49:21
But you know, voice community's not standing still, right?
49:24
They have been developing algorithms to detect synthesized
49:30
voices. And so, you know, they're, you
49:33
know, again, a technology that's getting better and better right
49:37
in that kind of arms race in terms of of of detection.
49:43
And so I do think that it still has a role to play.
49:49
Interesting. We'll start to wrap things up if
49:52
there was. I got a couple questions here
49:54
and we'll kind of end on a lighter note.
49:56
If you could not use fingerprints, face or iris, and
50:01
let's put voice in there as well to perform biometric
50:04
authentication, what would you choose next?
50:08
Yes, so one biometric technology that has been around actually
50:12
for a while, but I think is very useful is vein recognition.
50:18
And so I've seen both palm vein recognition and finger vein
50:23
recognition and you do need a specialized technology, you know
50:29
so it it's not like face or cameras are kind of ubiquitous.
50:33
You do need kind of an extra level of technology.
50:35
But but we we've seen vein recognition, Amazon one would be
50:40
example that incorporates vein recognition as well as other
50:45
companies have vein recognition. And so yeah, if I if I was given
50:49
a choice, I want my vein scanner.
50:51
Vein recognition. I never even heard of that.
50:54
So the like the Amazon basically no pay or you know, grab your
50:58
stuff and walk out the door, slap the thing.
51:02
I know there's wrists and there's also palm vein
51:05
recognition. I would think after we just went
51:08
through with COVID that people would be very hesitant of
51:10
slapping their hand. On a multi on a device that a
51:13
lot of other people are slapping their hand on and they're non
51:16
contact, you don't have to touch.
51:17
Oh, you just put it right over it.
51:18
OK, interesting. I learned something.
51:21
We were talking before we hit record, and you started to
51:23
mention something about the dead finger problem.
51:26
And I said no, save it. I don't know anything about it.
51:29
Tell me about the dead finger problem.
51:31
Well it connects everything we talked about.
51:33
So like back to my origin story you know in terms of biometrics
51:37
and and you know thinking about what to research and you know
51:41
one of the the company said to me well can you solve the dead
51:45
finger problem you know which which is essentially the idea is
51:48
that someone's going to cut off someone's finger and and use
51:52
that you know on a fingerprint system.
51:54
Luckily you know that doomsday scenario that.
51:58
That person who suggested it, you know, hasn't come to
52:02
fruition, though I do know of some actual use cases where
52:05
that's happened. But it's probably more likely
52:07
they'll steal the fingerprint and create a a replica, you
52:11
know, made of some material. And so that's kind of what
52:14
kicked me into the business. And we've been doing spoofing
52:17
ever since. So, but not so many cases where
52:21
we're cutting off fingers to test.
52:23
That so does it work or does it not work?
52:25
Does it pen on the reader? Does it?
52:28
Yeah. A fingerprint can be scanned
52:30
even if it's dead and in fact that is a a way to identify
52:34
someone and so so then the question is, is is the solution
52:38
that rejects those fake, you know biometrics also rejecting
52:43
dead and that's use case dependent.
52:45
You know whether you think that's a a a major attack vector
52:49
for your system as to whether it would reject it.
52:52
And I'm the one who brings up the negative stuff.
52:56
More morbid fascination around it I got I got another question
52:59
I want to ask. Is there a way to determine a
53:01
live finger versus a dead finger using just the finger?
53:06
Absolutely there is a way. Pulses or something, right?
53:08
Yes, yes. Well, so if you go to the
53:10
doctor's office and they shine that, you know, little red
53:13
light, you know there's actually a second light in your infrared
53:15
light and and that's looking at blood flow.
53:18
So. So there are scanners that you
53:21
know do use multiple wavelengths of light and collect a lot of
53:24
information, you know about the finger, you know on the surface
53:28
and within ultrasound scanners, ultrasound, fingerprint scanners
53:32
have an array of ultrasound. So there is the potential to to
53:35
legitimately determine whether it's alive or dead finger.
53:38
So I thought for sure you're going to say.
53:41
Like smell. I've heard about this.
53:45
I've heard about this. So what does it go on like?
53:48
Breath, smell or body odor or what if you had garlic for
53:54
dinner the night? I know these are silly
53:56
questions, but well, I mean, you know, you know, dogs can trace
54:02
scents, right, And follow scents, So there isn't silliness
54:05
there. I would say that you know that
54:08
we we've done a little bit of a look on on that one that's
54:12
probably that's out out there research problem so.
54:15
So we'll keep working on and get back to.
54:17
You all right? Yeah.
54:18
Love to have you back home. And that one's solved.
54:21
All right. We'll go ahead and wrap things
54:23
up. Stephanie, thank you so much for
54:24
being part of this conversation. Learned a lot, hopefully enjoyed
54:27
your time. We'll come back when we have
54:28
Smell O Vision or something available for us to use.
54:32
You can find us on the web ID acpodcast.com, Twitter at ID AC
54:36
podcast Mastodon at ID AC podcast at infosec dot exchange.
54:41
We'll have links for people to connect with us on LinkedIn,
54:44
including Stephanie, Jim, and myself.
54:46
Also a link to the YouTube channel that I referenced for
54:49
cider, so you can learn more about biometrics from there.
54:52
Any final thoughts before we wrap it up?
54:55
I'm happy to be here and happy to answer questions and you
54:59
know, please reach out to me. Thank you very much.
55:02
Thanks, Stephanie. Jimmy, I think for you.
55:04
Hey, same same here. I'm on LinkedIn, you're on
55:07
LinkedIn. Connect with us and let's keep
55:10
the conversation going. Yep.
55:12
All right. We'll leave it there.
55:13
Thanks everyone for listening and we'll talk with everyone in
55:15
the next one. You've been listening to
55:18
Identity at the Center. We hope you've enjoyed the show.
55:23
Make sure to like, rate and review and we'll be back soon.
55:27
But in the meantime, hit the website at
55:29
identity@thecenter.com and find us on Twitter at IDAC Podcast.
55:37
See you next time on identity at the center.