Eye movements instead of eye structures.
The new system tracks the way a person’s eye moves as he watches an icon roam around a computer screen. The way the icon moves can be different every time, but the user’s eye movements include “kinetic features”—slight variations in trajectory—that are unique, making it possible to identify him.
AppSec • November 17, 2010 7:42 AM
Sure would suck to have a lazy eye…
or be blind..
or have your eye sight fade…
Clive Robinson • November 17, 2010 8:15 AM
It’s an unreliable biometric after a few weeks (has been known to be for some time). It has been looked at before for “auto select” on Pilot HUDs.
Basicaly as you learn various tasks like speed reading your brain adjusts to using different parts of the retina. You can do the same with cognative behaviour therepy so…
The question is what size is the grant cheque or am I getting cynical in my old age.
OldTimer • November 17, 2010 9:06 AM
Or have a stigmatism…
Or develop cataracts…
Or develop diabetes…
Or have a stroke…
I don’t see how this biometric test accounts for, or accommodates, those of us who may have a degenerative eye disease or simply get old.
Brianary • November 17, 2010 9:30 AM
Or have nystagmus (as many with MS do)…
Anonymous Prime • November 17, 2010 9:43 AM
OldTimer:
It fails to accommodate you in the same way that fingerprinting fails for those of us without fingers.
It basically goes without saying that any biometric will fail for a certain segment of the population.
Mike Curran • November 17, 2010 9:55 AM
Or gets enough caffniene or other substance in their blood system to significantly alter their behavior for a short peroid of time.
Hell, I notice my eyes moving differently after an extended session; It usually lasts for at least 2-3 hours.
David Thornley • November 17, 2010 9:55 AM
@Anonymous Prime: The difference is that my fingerprints aren’t going to change into other fingerprints. There are a lot of other problems, but there will be no gradual change over time.
This is not true of eye movements. It is very possible for vision to deteriorate gradually, and this will cause eye movements to change. It is possible to get more familiar with a situation and have eye movements change. (If you drive a car, your eye movements while doing so have doubtless changed drastically over time, as you got familiar with observation while driving.)
Mike Curran • November 17, 2010 9:56 AM
Umm, make that extended gaming session, clicked a little too fast
paul • November 17, 2010 10:16 AM
The article says the company is claiming 97% accuracy under what appear to be optimal conditions. I guess that means you’d only get locked out of your office a few times a month or a few times a week, depending on how often you had to go out and back in again.
There are certainly applications where something like this (with suitable backup and as part of a defense in depth) would be useful. I think.
D • November 17, 2010 11:09 AM
Presumably, this is similar in concept to the signature recognition systems that have been available for years. It doesn’t just look at the finished signature (mine seldom matches like that) but looks at how you sign AND ALSO updates the stroking database with every positive identification. As long as you’re signing into the sytem frequently enough (and not waiting three years between uses), it seems to be pretty robust. No reason this eye tracking thing couldn’t continuously update its data.
Of course, as will all this biometric BS, physical security of the system is paramount – wouldn’t be hard to bypass the sensor and feed the computer whatever data you want.
NobodySpecial • November 17, 2010 11:12 AM
One word – coffee
Petréa Mitchell • November 17, 2010 11:35 AM
There are probably degenerative neurological conditions which could affect it over time. I wonder if normal brain changes from aging could, too.
Or medications which affect the motor neurons…
Justme • November 17, 2010 12:15 PM
Another word: alcohol.
Jaime • November 17, 2010 12:17 PM
Great, somebody finally made a lock that is not likely to work when you are being chased by a murderer. Hollywood will probably order a ton of these system to be integrated into car door locks.
trapspam.honeypot • November 17, 2010 12:32 PM
I have macular degeneration in both eyes with changes that occur quite frequently, i.e., every couple of weeks. I have had chemo injections into my eyes for the last two and a half years to stop blindness. How in the world could they ever track anything my eyes or if a retinal scan would be doing? I have had retinal scans for every month for five years now. Each of these laser scans have returned a different image.
EH • November 17, 2010 12:41 PM
The first thing I thought about when I started reading was “I hope it’s not some random target thing,” and then, “what if they devised a system based on something like a subject reading their own name.” That is, the eye movements pertaining to seeing something familiar.
Tom • November 17, 2010 12:42 PM
Will the subject also be read a series of questions to test emotional response?
a. • November 17, 2010 12:53 PM
My eye movements are completely different depending on the mood – and that’s not even as bad as for ‘normal’ people for being somewhat autistic.
If I’m nervous, I’m sure my eye patterns would fail the recognition they use.
Same goes if I’m in my own world – either I don’t really react to the external or then I react a lot.
The only time the eye movements might follow a pattern is if I’m equally bored – and that is either similarly trapped inside my head or receiving similar external stimuli.
If I’m angry I’m sure the eye patterns would match those of a lot of other angry people.
And yes, coffee and alcohol were already mentioned above.
QnJ1Y2U • November 17, 2010 1:01 PM
@Tom
We call it Voight-Kampff for short.
Will • November 17, 2010 2:38 PM
I think the interesting bit is that the thing you track is different each time you are checked, defending against replay attacks…
Davi Ottenheimer • November 17, 2010 3:20 PM
If they could integrate this into a way to actually move the cursor instead of using a mouse/pad, then I could see the attraction.
That would be awesome
Otherwise, it appears to have marginal to no benefit over existing controls but adds a new set of risks.
antibozo • November 17, 2010 3:34 PM
I wonder how hard it actually is to authenticate as someone else by mimicking his or her eye movements.
Of course the company that markets it will claim that it’s very difficult.
Dr. T • November 17, 2010 4:33 PM
The biometric described in the article would not be affected by poor eyesight, development of cataracts, development of diabetes-induced retinal damage, etc. However, it almost certainly would be affected by the following: general fatigue, eye fatigue, metabolism-altering drugs such as caffeine and amphetamines, drugs that affect muscle movement such as tranquilizers and antihistamines, drugs that affect coordination and fine movement such as amphetamines, sedatives, anticonvulsants, etc. The method’s designers have not done within-person studies to assess these factors. I suspect that they will find so much within-person variation that the technique will have no value as an identifier. (It might have value in assessing performance. For example, it could be used by the military and the airlines to see if pilots are affected by illness or medications.)
Joe • November 17, 2010 4:46 PM
The company is not claiming this is ready for use. The researcher is quoted as saying the system needs to be tested on many more subjects and over time. So there seems to be some realistic caution there.
However, I would submit that 97% accuracy is way too low for something as important as security. So even if their algorithm maintains its current accuracy, it still is not good enough.
Black Panther • November 17, 2010 4:54 PM
What is wrong with a key lock and key code combo? I think that fits the two-factor authentication criteria, too…
Tangerine Blue • November 17, 2010 6:17 PM
There are certainly applications where
something like this … would be
useful. I think.
Yep. If they really uniquely identify a person, they’d work great for an account id.
But biometrics like this are not secret, so they make lousy authentication credentials.
maelorin • November 17, 2010 6:57 PM
as an additional problem, after the issue of (re)training a familiar/repetitive task, and other changes in eye movement over time – what happens when you start getting bored of doing this ‘test’ to get through the door or get into the system?
it won’t take long for many people to get fed up with having to play ‘follow-the-dot-to-pass-the-lock’ … at least with iris scan, fingerprinting, or facial ‘recognition’ you don’t have to pay attention …
it may have some value along the lines @dr t suggests above. though again, boredom, frustration, and other emotional/environmental factors will play a role here too.
why bother with this game, when you could measure elements of a persons movement as they walk up to the lock as a preliminary ‘what you are’ factor. upgrade (a) cctv camera for facial recognition plus iris scan; combine all that with a key code…
with decent hi-res colour video feed, your system could analyse gait, gestures, posture, face, eye movements, iris scan and have a multi-factor match as an ongoing process the whole time.
add in rfid tag(s) for extra points, track your mobile phone with local gprs/gsm mini-towers, and so on. why rely on any one factor when some software, a few bits of kit, and a network of small servers could provide you with complete coverage and constant multi-factor (re)verification.
hell, give ’em key cards and passcodes so they think that’s the identification tool …
eyesoars • November 17, 2010 7:52 PM
Put reversing prisms on for a couple days and your saccade trajectories will have changed substantially and irreversibly.
BF Skinner • November 18, 2010 6:16 AM
“kinetic features” — slight variations in trajectory — that are unique
I see no proof for this claim. And it’s pretty early in the life cycle to be claiming a new trait is individually unique. We work under the assumption that fingerprints and dna are unique but that hasn’t been proved yet has it.
“less complicated than using … a smart card to gain access”
Says who? Proximity cards are just waved at the reader and the card/pin combination is used a technique used by anyone with a bank card. Any 2nd factor added to the crazy eyes system here makes it as complex as any system now in use.
In addition to the critiques here of a trait that changes over time…why pursue biometrics anyway?
An identity isn’t something we are it’s something we’re given– as part of a relationship. And relationships end. I think an artifical identity not tied to pieces of my body, that can be definitely ended, is preferable.
Discriminator • November 18, 2010 7:32 AM
“97% accuracy” is a very vague metric, as accuracy (as technically defined) is dependent on the ratio of true positives and negatives, as well as where they set the cutoff. Would it be that confusing to report two numbers, such as sensitivity and specificity?
“Our algorithm lets an impostor in 2% of the time and keeps the rightful owner out 4% of the time.” Then again, anyone could understand how useless that is…
Of course, this topic has been addressed several times before here.
Petréa Mitchell • November 18, 2010 11:21 AM
BF Skinner:
“We work under the assumption that fingerprints and dna are unique but that hasn’t been proved yet has it.”
No, actually, if we’re competent at it we work with the knowledge that DNA evidence can match more than one person. It’s not a complete genomic scan, and it’s not proof on its own that a specific person was present. Where it comes in really handy is ruling out suspects instead.
Dr. T • November 18, 2010 5:11 PM
@BF Skinner: “… We work under the assumption that fingerprints and dna are unique but that hasn’t been proved yet has it….”
We already know that fingerprints are not unique unless the investigators have unsmudged, hi-res prints of all ten fingers.
DNA is unique to all non-twin individuals, but DNA testing doesn’t examine the entire genome. That’s why results are given as probabilities (eg: there is only a one in a billion chance that someone else could have the same DNA markers). The probabilities are somewhat misleading, though, because they are for random persons. A close relative would be far more likely to match the tested markers than a random person.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
-ac- • November 17, 2010 7:29 AM
A lot of these newer behavioral identifiers make me wonder if they have studied them enough to determine how they will vary over time. I guess an “expiring biometric” has it’s uses.