Tuesday, October 24, 2006

I can't change my hair style! My biometrics will fail!

Alright, this statement is slightly exaggerated but only slightly. We might arrive at this soon.

If you are an avid internet surfer and a member of many web portals, just think about how many times you asked for 'Forgot Password'. It's hard on us. With all due respect to SSO, I need to memorize about 10-15 passwords and use a password manager (it's easier to crack the password manager utility than than password itself) and inspite of all this, I request for the forgotten password. Recently I read that 60-75% of the HelpDesk requests to famous portals are for the forgotten passwords.

Biometrics has made great inroads. Not that all laptops have that facility and it's specially not there with all the sales personnel in the world who travel with unsecured laptops. But if biometrics does become common place and wins the catch up game with the hackers, we might be in for some reprieve.

I'm particularly interested in how the face, finger and voice based biometrics work. Some of them have the multi layered verification system where there's registered finger print, the voice based pass phrase and then the password itself. However, as far as I have seen, you are again tied in or hard coded to the finger touch recognition software's provider.

With the face, it's trickier. There are supposedly technologies that will recognize the face even if the face dimensions change with a smile (don't smile ear to ear), frowning , blinking etc the risks are as much as that associated with regular image mapping techniques.

What if the face is posed at an angle of 15-20 degrees? What if the light is insufficient.

The most important thing to remember is the title of this blog - yes, face biometrics is yet to transcend the changes made by your hair dresser. It's quite possible that the world's leading hair dressers might register themselves in a face-provider registry and discovered by the web service out of face biometrics and your latest face will be sent in for verification.

How about using a string of regular passwords as in older times ;-)