Schneier on Security

Christoph Zurnieden • August 3, 2007 7:38 AM

It's a good field experiment, carefully designed, executed and it's
easily repeatable. Despite of the very low budget.
The result of that experiment is, that all of the three tested products have
a poor detection rate which is also heavily dependent on illumination,
position and speed of the test subjects.
The summary says the products work. That irritated me at first but even this
poor detectionrate is still good for on thing: for detecting groups like a
flock of Hooligans. But the high number of false negatives (that number seems
to be carfully hidden which might have reasons beside my paranoia) does not
support a recommendation of any of these products for the reliable detection
of individuals. A trained person in front of a video monitor is better and
probably cheaper too.
This will change in the future of course. The development of 3D face
recognition has already started; the results of an experiment, similar
to this, will be available in 2009.

> How about facial recognition + fingerprint + password?

The technical solutions to measure biometrics have a very poor detection
rate. Let me give you some numbers:
The odds that two different passwords map to the same has is with a keyed
MD5 algorithms 1:2^80
The odds that two different faces/fingerprints map to the same hash is
unknown, the algorithms of almost all of the products is secret.
But even with a detection rate of 99.999% one of 100.000 detections is
wrong (a false negative or a false positive). 700.000.000 passengers took a
flight in the USA last year, that are 7.000 errors. Not much? Well, it's
the detection rate, so every measure counts. Let's be conservative and
assume 3 measures at every airport, that are 6 measures each flight. Persons
without a boarding pass are also allowed at the airport like families,
business partners and so on, let's asume 1 person on average. That sums up
to 700.000.000 x 6 x 2 = 8.400.000.000 detections which results in 84.000
errors. I couldn't find the number of how many individual people are behind
the 700 millions tickets, so I can't calculate the inconvinience factor.
But I digress.
If we take that 1:100.000 ratio as the result of the calculation of the
birthday problem the cardinality of the set of hashes is 10.000.000.000.
That number together with close to 8.000.000.000 people on the world: please
use condoms and die early to keep these nice products working, thank you.
Conclusion: the difference between a password alone and facial recognition +
fingerprint + password is neglectable. Provided that a good password is
used of course!
No, the "what you are" part of "What you know, what you have and what you
are" is not usable yet and will not be usable for a very long time I guess.

This here http://www.networkworld.com/community/node/18031 made my footnails
curl. Even with a detectionrate of 99.999% it's only good for a PIN of not
more the 5 digits.

Oh, and one little note at the end: these products work with security by
obscurity: if you know the algorithm used or merely get in posession of the
product you are instantly able to develop counter measures. Unlicensed SFX
make-up artists will have a nice holiday in northern Cuba?

> Where does this desire to police each other come from?

It's a leftover from ancient times when we strolled in small groups over the wide fields of eastern africa. A sudden disapearing of a member might be a sign of a way to close carnivore, non-members are competitors in the fight for food and partners and so on.

CZ