{"id":10402,"date":"2017-11-08T06:43:46","date_gmt":"2017-11-08T06:43:46","guid":{"rendered":"http:\/\/www.lifeandnews.com\/articles\/?p=10402"},"modified":"2017-11-09T06:45:43","modified_gmt":"2017-11-09T06:45:43","slug":"the-challenge-of-authenticating-real-humans-in-a-digital-world","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/the-challenge-of-authenticating-real-humans-in-a-digital-world\/","title":{"rendered":"The challenge of authenticating real humans in a digital world"},"content":{"rendered":"

Jungwoo Ryoo<\/a>, Pennsylvania State University<\/a><\/em><\/span><\/p>\n

Proving identity is a routine part of modern daily life. Many people must show a driver\u2019s license to buy alcohol at a store, flash an ID card<\/a> to security guards at work, enter passwords and passcodes to retrieve email and other private information, and answer security validation questions when calling banks or credit card companies for customer service.<\/p>\n

Authentication<\/a> is also getting easier<\/a> for people: Take the iPhone, for example. Unlocking the early versions required a multi-digit passcode. Then Apple introduced Touch ID<\/a>, which would unlock the phone with a fingerprint reader. The latest version, just out, is the iPhone X<\/a>, which can use its camera to perform facial recognition<\/a> to authenticate a user<\/a>.<\/p>\n

As a software security researcher looking at authentication technologies for hand-held devices<\/a>, I am fully aware that the technologies change, but the challenge remains the same: How can a digital system authenticate an analog human\u2019s identity?<\/p>\n

Three factors of identity<\/h2>\n

There are three main ways<\/a> of proving an identity. One involves something you know \u2013 like a password or your mother\u2019s maiden name. This method assumes the authorized user will have information no unauthorized user does. But that\u2019s not always the case: For 145.5 million Americans<\/a> affected by the Equifax security breach<\/a> revealed in September 2017, reams of previously private information may now be known to criminals.<\/p>\n

A second method of authentication is with something you have \u2013 such as a key to your home\u2019s front door or a smart card to swipe at work. This assumes a limited number of people \u2013 possibly as few as one, but it could be a small group of users, like a family or co-workers \u2013 are allowed to enter a physical space or use a digital service. <\/p>\n

A third way is by authenticating the individual human being \u2013 who you are \u2013 with some aspect of your biology. There are various type of these biometrics, such as fingerprints, facial recognition<\/a>, iris scanning and voiceprints<\/a>. This strategy, of course, assumes that the bodily feature is unique to the particular individual \u2013 and, crucially, that the digital system involved can tell the difference between people.<\/p>\n

Using two or more methods together can improve security and is called two-factor, or multi-factor, authentication<\/a>.<\/p>\n

The consequences of digital authentication<\/h2>\n

This increasing dependence on digital authentication may actually result in less security. While cameras, sensors and other devices can make authentication easier for people to accomplish, they carry their own weaknesses. <\/p>\n

When a system seeks to authenticate an individual, it must compare the information the person is presenting<\/a> \u2013 what they know, what they have or who they are \u2013 against a previously stored database of authorized users. As the Equifax security breach<\/a> makes clear, those databases are themselves vulnerable to attack. Information stolen from there could be used somewhere else \u2013 for instance, to identify which bank a particular person uses and answer security questions when calling to transfer money. Or the database itself could be corrupted, altering information so an attacker would be able to fake his way into a physical space or system.<\/p>\n

Another potential security threat inherent in biometrics in particular is that criminals don\u2019t need to guess a password, or force someone to reveal it: The simple presence of the victim \u2013 even at gunpoint \u2013 can supply the fingerprint or face to authenticate and unlock a system. <\/p>\n

Future complications<\/h2>\n

As authentication becomes more complicated, using multiple factors and secure communications between sensors and databases, users become less willing<\/a> to jump through all the hoops. So security managers try to make the process easier for them without weakening the protections. This commonly happens on websites that urge users to log in using their Facebook or Google accounts<\/a>; those sites rely on the advanced security of the tech giants rather than creating their own authentication systems.<\/p>\n

In one futuristic scenario, authentication could occur without a user even noticing: When you walk into a store, facial recognition could identify and authenticate you. Then, at checkout, you\u2019d need only to scan your purchases and leave \u2013 the store will automatically charge the credit card of your choice. This isn\u2019t science fiction: Amazon has patented a system<\/a> for doing exactly this in its Amazon Go cashier-less convenience stores<\/a>.<\/p>\n

This is possible in part because of the increasingly common practice of computer systems authenticating each other<\/a> \u2013 so the store\u2019s system would recognize you, connect to the credit card company and authorize your purchase all on its own.<\/p>\n

\"TheIt may be more convenient, and even more secure, than a magnetic strip on a plastic card in your wallet. But the potential dangers will require much higher security for private information, particularly biometric data<\/a>. A real identity still comes down to flesh and blood.<\/p>\n

Jungwoo Ryoo<\/a>, Professor of Information Sciences and Technology at Altoona campus, Pennsylvania State University<\/a><\/em><\/span><\/p>\n

This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Jungwoo Ryoo, Pennsylvania State University Proving identity is a routine part of modern daily life. Many people must show a driver\u2019s license to buy alcohol at a store, flash an ID card to security guards at work, enter passwords and passcodes to retrieve email and other private information, and answer security validation questions when calling […]<\/p>\n","protected":false},"author":44,"featured_media":10404,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3410,8],"tags":[3467,2290],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/10402"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=10402"}],"version-history":[{"count":2,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/10402\/revisions"}],"predecessor-version":[{"id":10406,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/10402\/revisions\/10406"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/10404"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=10402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=10402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=10402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}