Can Iris-Scanning ID Systems Tell the Difference Between a Live and Dead Eye? (ieee.org) 93
the_newsbeagle writes: Iris scanning is increasingly being used for biometric identification because it's fast, accurate, and relies on a body part that's protected and doesn't change over time. You may have seen such systems at a border crossing recently or at a high-security facility, and the Indian government is currently collecting iris scans from all its 1.2 billion citizens to enroll them in a national ID system. But such scanners can sometimes be spoofed by a high-quality paper printout or an image stuck on a contact lens.
Now, new research has shown that post-mortem eyes can be used for biometric identification for hours or days after death, despite the decay that occurs. This means an eye could theoretically be plucked from someone's head and presented to an iris scanner. The same researcher who conducted that post-mortem study is also looking for solutions, and is working on iris scanners that can detect the "liveness" of an eye. His best method so far relies on the unique way each person's pupil responds to a flash of light, although he notes some problems with this approach.
Now, new research has shown that post-mortem eyes can be used for biometric identification for hours or days after death, despite the decay that occurs. This means an eye could theoretically be plucked from someone's head and presented to an iris scanner. The same researcher who conducted that post-mortem study is also looking for solutions, and is working on iris scanners that can detect the "liveness" of an eye. His best method so far relies on the unique way each person's pupil responds to a flash of light, although he notes some problems with this approach.
Re: (Score:3)
This is where I'm curious, was this a tongue-in-cheek bit of humor or was this post actually deleted?
Re: (Score:2)
Re: (Score:3)
I'm curious too. I guess we'll have to wait and see if this is going to happen more often. Unless you feel like experimenting by posting messages that would qualify for the same treatment, of course. Personally, I don't.
Posts don't get deleted, they get modded up or down.
Some anonymous cowards get much butthurt when anyone disagrees, so they make up this censorship meme.
That being said, when the cowards go on one of their weird psychosexual or ridiculously offtopic binges, we have the ability to set the topic settings so we don't see the stuff. That also causes much butthurt.
Re: Comment Deleted (Score:2)
Re: (Score:2)
And who would even notice, never mind care, if an AC comment was deleted anyway.
Elitist much?
First of all, anyone that appreciates Slashdot's history of never deleting comments (except that one about Scientology they received a court order to remove, AFAIR) would care.
Secondly, are you seriously saying that all anonymous comments ever are worthless? Really?
Re: (Score:2)
It's not elitist to choose what you want to see and what you don't. Can't be arsed to log in or take credit for what you say, then why should I be arsed to read it? That is the exact opposite of elitist, since ANYONE can have an account, so quit trying to reframe the question to something totally bogus.
Are all AC comments worthless? Maybe not - but there's too much NOISE and not enough SIGNAL. The option to hide AC comments would be a huge improvement just in eliminating troll scripts.
Re: (Score:2)
India's PDS [wikipedia.org] entitles a citizen to a kg of rice and a liter of kerosene every month. How much trouble will people go through to cheat at that? Also, the iris scanning is monitored, so someone may notice if you hold up someone else's eyeballs instead of facing the scanner. For bigger transactions, the iris scan is just one factor: you also need to present an ID and/or enter a password or PIN.
Re: (Score:2)
Do not look into laser with remaining eye (Score:5, Interesting)
A pupil's response can be imitated with a video in response to the flash. I work with several types of eye trackers fairly frequently, the eye is relatively slow in responding to stimuli, it's definitely within the realm of a cell phone to play back the image of an eye and it's iris in response, in time to one of these flashes.
The problem with biometric is that it is considered the end-all of security system whereas it should be considered only part of something (who you are, what you know, ...)
Re: (Score:1)
biometric is that it is considered the end-all of security system
I have never understood why people think this is the case. It doesn't take a genius to realize that there are a number of ways to get this data, most of which are highly unpleasant, assuming you survive it.
Plus, if it's compromised once from an appropriately insecure and high-resolution source (e.g. someone takes a picture of your eye in high detail), you're pretty much compromised for life. Some people would say this will never happen, but considering some of the dumbass mistakes that have made security
Re:Do not look into laser with remaining eye (Score:5, Interesting)
The problem with biometric is that it is considered the end-all of security system whereas it should be considered only part of something (who you are, what you know, ...)
No. The problem with biometrics is that it builds upon faulty assumptions and fails to address real concerns.
Somebody fakes my eyescan successfuly once, it loses all future use to me and now I have to scoop out an eye, perhaps replace it with a glass one with some famous person's fake eyescan patterns, to have some use out of it again. But wait, I'd rather keep the eye to see with.
The logical conclusion is that I don't want my eyes, not even one, be used as a security in this sort of gamble. That means you do not get to scan my eyes, ever, making the idea strictly useless for security, aaa, or whatever else you want to do with it, but instead outright dangerous for my valuable body parts.
Biometrics is only "hollywood security", where usernames, including the crappy and noisy biometric ones, are taken to be as good as passwords, and "security override" is all you need to get past any hurdle anyway. In the real world, security doesn't magically improve just because we bend over backwards for some camera looking into our eyes. Any biometric is more easily faked than replaced, and that makes them useless for the end-user, in fact outright dangerous to limb, possibly life, because it makes the end-user expendable.
That means there is only one correct answer to any biometric-anything idea: FUCK OFF with your biometrics, whatever idea you have this week. FUCK OFF ALREADY.
Re: (Score:2)
Somebody fakes my eyescan successfuly once, it loses all future use to me
That's the real kicker. Imagine a password written on a yellow sticky, kept in your wallet. A password that is thus easily stolen, lost or duplicated. Now imagine that you cannot change that password, ever.
Re: (Score:2)
Re: (Score:2)
just missing an eye gives you free reign to circumvent this security.
"Just"???
You first.
contact lens
So add a measure of interpupillary distance. Are you up for having your skull cracked in two and then widened or narrowed so that your IPD matches too? Also: retina scans. Unless they have some pretty amazing holographic properties, contact lenses won't fool a retina scan.
Re: (Score:1)
Biometric should only be used to identify people accompanied by security persons who can determine of the biometric object being scanned it real or fake. This will require checks to see if the person is wearing contacts or an extra layer of skin, etc. This also requires the security person to immobilise the person who is being scanned to make sure slide-of-hand is not in play.
Biometric scanners without security are useless, since the biometric object can easily be harvested in public areas.
Re:Do not look into laser with remaining eye (Score:5, Interesting)
With the iris scanning, how about getting the person to follow a small dot around the scanner with their eye and an iris tracker can confirm it's doing so.
Any security solution that depends on technology can also be defeated by technology.
In this case, you would have to have a system for tracking the eye, which would be defeated by a system for tracking the dot. Plus, you'd need guards against feeding the system wrong data at multiple points, or bypassing the tracking altogether. You'd multiply complexities unnecessarily, and only end up with another system to keep honest people honest.
Executives[*] who base their "knowledge" on Hollywood movies and detective stories are to blame for big business buying into biometrics for authentication. It's the worst thinkable system possible, because once you have defeated it, you have defeated a living human person, who cannot change his compromised biometrics.
The implementations fly in the face of ADA and similar measures too, directly discriminating against people who cannot use the systems. Some don't have fingerprints. Others cannot stand and look into the iris scanner. Or don't have eyes to look into them with. So you must have a backup system anyhow. That prompts the question: If the backup system is trustworthy, why not use it instead?
[*]: And unfortunately not just business execs. As late as last week, a police superintendent was quoted in a big newspaper saying that DNA evidence is 100% trustworthy and (I kid you not) we should never question it. The newspaper didn't even question that statement or ask an expert for opinion.
Re: (Score:1)
That prompts the question:
Thank you!
Demolition Man (Score:1)
Demolition Man did it
I don't have any dead eyes (Score:1)
But one of them is kinda lazy. Will that make a difference?
Well, DUH (Score:1)
"Now, new research has shown that post-mortem eyes can be used for biometric identification for hours or days after death"
Sheesh, I saw this on an episode of La Femme Nikita probably a decade or so ago. I could've lent them the DVD, if they'd asked.
biometric identification insecure by nature (Score:3, Insightful)
biometric identification and verification is insecure by its very nature.
whole concept derives from faulty assumption that identity of a person is securely linked his/her body parts. obviously body parts can be separated from true identity by variety of means ranging from death, amputation, kidnapping and coercion, replication , etc etc.
other forms of identification and verification based on links to individual's mind and memory, while far from perfect, is more secure.
even simple forms of that, like passwords, can defeat insecurities created by death, amputation, some coercion, etc etc.
all rational knowledgeable people should counter absurd biometric identification hype.
Re: (Score:1)
It's far from perfect, but still much more secure than insecure passwords, which are what we commonly have. It's a lot easier to get passwords (as proved by the many millions of them available online) than to get the biometric identifiers.
For now. (Score:1)
Availability is directly tied to use. We have already got databases of passwords attached to every website that has a login so most break-ins will have a chance to make a copy, if fingerprints iris scans or something else biometric got used in the same way then this would be true of them too, but now you cant change them.
Biometric identification is a shared password you can never change, and shared passwords are the most insecure of all. Of course you can mitigate against this in physical situations, if
Re: (Score:2)
The biggest fallacy of using biometrics for security is that biometric codes can not be changed.
Once a biometric code has been cracked then that code is useless forever and you are stuck with it. If a protected resource requires e.g. an iris or finger print but that print is revoked, then you can never use that authentication mechanism every again.
If someone successfully guesses your password (or encryption key) then you can rescind it and use another.
Another fallacy is that it is actually not difficult to
This validates how many cheesy movies? (Score:2)
Yet another case of popular media predicting actual science.
Seriously, I think there was at least one James Bond ("Never Say Never"?) with this theme as well as one in which eyes were carried around in plastic baggies to break security. I think the big part of this was the "ick" factor to create audience buzz.
Re: (Score:2)
Minority Report is 2002. Demolition Man is 1993: https://www.youtube.com/watch?... [youtube.com]
Never Say Never Again is from 1983, but in it, somebody has his Iris altered to match the President's one: https://en.wikipedia.org/wiki/... [wikipedia.org]
Re: (Score:2)
Thank you for the references.
Minority report did it twice (Score:2)
Somebody sold India a LOT of hardware (Score:2)
India is going to find out that iris scanning suffers from all of the same issues as any other biometric scanning device. ALL of them have to turn the scan into a digital representation, which is then used to authenticate or verify identity. The weak point int he process is between the device and the computer. Since that digital representation can be copied and replicated, it is no more secure than any other identification system. It's actually less secure, because it's considered the user name AND pass
Re: (Score:2)
First... (Score:2)
First they took our jobs, then they took our thumbs, now they are gonna take our eyeballs. When will it end ??
Re: (Score:2)
Re: (Score:2)
You consider /. to be part of the government? Hot dang are you trying to inflate their ego?
Been there. Done That (Score:2)
This means an eye could theoretically be plucked from someone's head and presented to an iris scanner.
Minority Report [wikipedia.org] - duh.
Don't use proto-matter (Score:1)
It doesn't matter (Score:2)
You can always take an image of a dead iris scan, manipulate it, and feed that to the camera.
The same problem with all biometrics (Score:2)
Iris scanning suffers from the same fatal flaw that every other type of biometric scanning suffers from. What do you do when my iris scan is compromised? How are you going to issue me a new iris identification?
palm vien (Score:2)
>"Iris scanning is increasingly being used for biometric identification because it's fast, accurate, and relies on a body part that's protected and doesn't change over time. "
Not really. It is a rather stupid biometric, especially when something exists that is far better in just about every way....
There is only one safer and practical biometric I know of- that is deep vein palm scan. That registration data cannot be readily abused. It can't be latently collected like DNA, fingerprints, and face recognit
Re: (Score:2)
So soon they forget (Score:3, Interesting)
As someone that was part of the team that pioneered iris recognition in the late 80s, I can say that this is totally the fault of the current software. We had various techniques implemented from the start that would prevent this kind of problem. Controlling multiple IR leds to provide a changing specularity pattern. This would guarantee that the eye was shaped as expected, rejecting all flat copies. Checking for the normal pulsation of the pupil would reject dead eyes. There were various other checks, like verification of facial features (there were two eyes, etc.). Checking for the proper occlusion of the eyelids was also part of the process. With only a few captures our testing has not shown this kind of issue (and we did try perfect eye replication). I've heard this kind of thing from the beginning, nothing new here. Again, we implemented all of these features in our original work, but implementors felt that these should not be included in their products.
Doesn't stop them from trying (Score:1)
It'll be a great reassurance to the bank to know that the bad guys can't get into the vault by holding up an eyeball they've "liberated" from the bank manager. However, it'll be little comfort to the now eyeless bank manager if the bad guys haven't kept themselves abreast of the developments in dead eye detection, or if they decide to give it a go anyway. If some bit of your anatomy holds the biometric keys to something of value, then in addition to all the other problems that get mentioned about biometri
Re: (Score:2)
constructing dead guys finger (Score:2)
No surprise here (Score:2)
Yes, the tech already exists... (Score:2)
The answer is yes. The technology to detect the difference has been around for over a decade, but it's not in any iris scanner for security that I'm aware of.
My Mom and Dad (yes, both of them, this one was actually Mom's idea), hold a patent on a method for using a laser and optical system to measure a bunch of things about the eyeball, including intraocular pressure. It's sensitive enough to not only measure the internal eyeball pressure, but you can very easily see the pulse, and with a bit of clever ma
Change over time.. it does (Score:1)
Hmmm, the article ignores the fact that a retinal scan is changed by cataracts, glaucoma, log term diabetes, retinal detachment, macular holes, macular degeneration, or massive beta radiation exposure.
I wonder if using IR laser scan instead of red laser scan as the first generation of the tech did would sense living tissue based on temperature?