Bevil Wood­ing

Cy­ber­se­cu­ri­ty breach­es are now a reg­u­lar head­lin­er in to­day's news cy­cle. Be­hind the head­lines, lies an un­for­tu­nate truth. Pass­words are not the best way to se­cure on­line ac­counts. In fact, the 2014 Glob­al Se­cu­ri­ty Re­port from Trust­wave found that weak pass­words were a fac­tor in 31 per cent of the breach­es un­der in­ves­ti­ga­tion.

When you pro­tect your per­son­al or busi­ness ac­counts with a weak pass­word or leave the de­fault pass­word in place, you're court­ing trou­ble and ask­ing to get hacked. The good news is that there are sev­er­al bio­met­ric op­tions emerg­ing to keep com­put­er as­sets safe. And, as the tech­nol­o­gy gets eas­i­er and more re­li­able, con­sumers are in­creas­ing­ly will­ing to give them a try.

The fu­ture of au­then­ti­ca­tion

Bio­met­ric tech­nolo­gies al­low ac­cess based on unique and im­mutable char­ac­ter­is­tics about our­selves; ide­al­ly, char­ac­ter­is­tics that can't be stolen or eas­i­ly faked. The goal with bio­met­ric se­cu­ri­ty is to cre­ate an au­then­ti­ca­tion sys­tem that pro­vides more se­cu­ri­ty, re­li­a­bil­i­ty and con­ve­nience for con­sumers than tra­di­tion­al pass­words.

Al­though this may seem to be the stuff of spy movies, big busi­ness­es, acad­e­mia, and even gov­ern­ments have been us­ing bio­met­ric au­then­ti­ca­tion like fin­ger­prints, eye pat­terns, voice and even your heart­beat to au­then­ti­cate users for years. And the race to se­cure the fu­ture of au­then­ti­ca­tion is well on. Bio­met­rics Re­search Group Inc. projects that the glob­al bio­met­rics mar­ket will grow to US$15 bil­lion by 2015, up from its 2012 es­ti­mat­ed val­ue of US$7 bil­lion.

Tech­nolo­gies to watch

Com­put­er chip mak­er Qual­comm, which pro­duces chipsets used by many An­droid smart­phones, an­nounced Snap­drag­on Sense ID at the 2015 edi­tion of the Mo­bile World Con­gress, an an­nu­al gath­er­ing in Barcelona for tech and tele­com lead­ers. Sense ID is a new type of sen­sor that us­es sound waves to de­tect 3-D de­tails of your fin­ger­print. The com­pa­ny says its new sen­sor can read fin­gers cov­ered in sweat or lo­tion and can work on glass, steel, plas­tic and alu­minum de­vices, giv­ing more flex­i­bil­i­ty to de­vice man­u­fac­tur­ers.

Qual­comm's prod­uct is just one of sev­er­al new de­vel­op­ments in bio­met­ric se­cu­ri­ty that tech­nol­o­gy com­pa­nies have an­nounced of late.

Al­so at MWC, Fu­jit­su de­moed a pro­to­type phone that us­es Delta ID iris recog­ni­tion tech­nol­o­gy called Ac­tiveIRIS. Ac­cord­ing to Delta ID, it "makes the iris in our eyes a unique and se­cret 'pass­word' that we nev­er have to re­mem­ber.

Chi­nese tele­com equip­ment mak­er, ZTE, al­so wants users to say bye-bye to pass­words and hel­lo to eye-based bio­met­ric au­then­ti­ca­tion. It de­buted a reti­na scan­ner in its new ZTE Grand S3 smart­phone. The Eye­print ID tech­nol­o­gy, called Eye­V­er­i­fy, us­es the phone's built-in cam­era to scan both eyes and then pat­tern match unique blood ves­sels in the eyes.

Chip­mak­er In­tel un­veiled TrueKey at the Con­sumer Elec­tron­ics Show last Jan­u­ary. TrueKey us­es fa­cial recog­ni­tion, fin­ger­print scan­ning and oth­er au­then­ti­ca­tion meth­ods to un­lock a sin­gle mas­ter pass­word that gives ac­cess to de­vices and on­line ac­counts.

Per­haps one of the most suc­cess­ful ap­pli­ca­tion of bio­met­ric se­cu­ri­ty to con­sumer de­vices to date is Ap­ple's Touch ID, a fin­ger­print-sens­ing tech­nol­o­gy for new­er iPhones and iPads.

Touch ID was re­leased in Sep­tem­ber 2013 on the iPhone 5S as an al­ter­na­tive to un­lock­ing the phone with a pass­code. Ap­ple re­port­ed that be­fore Touch ID was avail­able, few­er than half of iPhone own­ers used a pass­code. But now more than 83 per cent of iPhone 5s users use Touch ID to un­lock their phones.

Touch ID al­so sup­ports non-Ap­ple apps, so peo­ple can now use their fin­ger­prints to log in ser­vices, like Ama­zon, Drop­Box and pass­word-man­ag­er app Keep­er.

Mi­crosoft is al­so get­ting in on the ac­tion adding sup­port for the Fast Iden­ti­ty On­line (Fi­do) stan­dard to Win­dows 10 to en­able pass­word-free sign-on for a num­ber of ap­pli­ca­tions.

"Tran­si­tion­ing away from pass­words and to a stronger form of iden­ti­ty is one of the great chal­lenges that we face in on­line com­put­ing," said Dustin In­galls, Win­dows se­cu­ri­ty and iden­ti­ty pro­gramme man­ag­er at Mi­crosoft, in an in­ter­view with ZD­Net.

Fi­do sup­ports bio­met­rics such as face, voice, iris, and fin­ger­print or don­gles. The stan­dard is re­ceiv­ing sup­port from ma­jor in­dus­try play­ers, in­clud­ing Sam­sung, Visa, Pay­Pal, RSA, Mas­ter­Card, Google, Leno­vo, ARM, and Bank of Amer­i­ca as well as Mi­crosoft.

Ap­ple's Touch ID sys­tem and the Mi­crosoft-sup­port­ed FI­DO stan­dard both of­fer an­oth­er ad­van­tage over the pass­word-based mod­el: they are stored lo­cal­ly, which makes it much hard­er for hack­ers to crack an on­line trove and plun­der mil­lions of cre­den­tials as com­mon­ly hap­pens now.

Se­cur­ing Re­li­a­bil­i­ty and Trust

Still, it will be quite a while be­fore the pass­words are phased out com­plete­ly. Bio­met­ric tech still has quite a draw­backs, and in spite of its many flaws, pass­words re­main far more re­li­able. If you type in your pass­word cor­rect­ly, it will work; no has­sle, no wor­ries.

Bio­met­ric se­cu­ri­ty tools, in con­trast, suf­fers from re­li­a­bil­i­ty is­sues. When In­tel de­buted its TrueKey ser­vice dur­ing a keynote ad­dress at the CES 2015, the pro­gram failed to recog­nise the pre­sen­ter demo­ing it. Sam­sung's fa­cial recog­ni­tion soft­ware for its smart­phones can eas­i­ly be fooled. Even Ap­ple's Touch ID, for all its suc­cess, still doesn't work well for every­one, fail­ing if your fin­gers are moist or even cold.

Then there's the cost fac­tor. Killing pass­words won't come with­out a hefty price tag for con­sumers as well as cor­po­rate and cloud ser­vice providers. Phas­ing out ex­ist­ing se­cu­ri­ty sys­tems and in­tro­duc­ing new ones will in­volve cost­ly back-end and front-end tech­nol­o­gy re­place­ments, in­te­gra­tion, end-user train­ing and oth­er sup­port costs.

An­oth­er key is­sue re­strain­ing wide­spread adop­tion of bio­met­ric se­cu­ri­ty prod­ucts is trust. Con­sumers must be­lieve that the com­pa­nies of­fer­ing the bio­met­ric so­lu­tions are tak­ing good care of all the bio­met­ric da­ta they col­lect.

The string of high-pro­file cy­ber­se­cu­ri­ty breach­es over the past few years makes it clear that con­sumers should not blind­ly trust that every com­pa­ny hold­ing their bio­met­ric da­ta will have ap­pro­pri­ate sys­tems in place to pro­tect it.

"It's sim­ply not safe to as­sume that the com­pa­nies ask­ing us for our bio­met­ric da­ta are go­ing to be any safer with that da­ta than the com­pa­nies cur­rent­ly stor­ing our pass­words," ac­cord­ing to Stephen Lee, a se­nior cy­ber­se­cu­ri­ty ex­pert with the Caribbean Net­work Op­er­a­tors Group, CaribNOG, and CEO of the US-based tech firm, ArkiTechs Inc.

"Mak­ing your mo­bile de­vice or net­work more se­cure us­ing bio­met­rics, can have the to­tal­ly un­in­tend­ed con­se­quence of mak­ing you much more vul­ner­a­ble to new av­enues for iden­ti­ty hack­ing," Lee added, "Es­pe­cial­ly when pro­tect­ing pass­word da­ta has al­ready proven to be so dif­fi­cult. If your pass­word is com­pro­mised, at least you can change it. Good luck try­ing to change your iris pat­tern or thumbprints."

A more se­cure fu­ture?

There is lit­tle ar­gu­ment that pass­words by them­selves are an in­creas­ing­ly in­ef­fec­tive tool for se­cur­ing our dig­i­tal as­sets. By us­ing some­thing we are, rather than just some­thing we know, bio­met­ric au­then­ti­ca­tion tech­nolo­gies hold the promise of a more se­cure fu­ture.

How­ev­er, that se­cu­ri­ty comes at the high price of en­trust­ing our valu­able per­son­al bio­da­ta to third-par­ty ven­dors. The bot­tom line is none of these se­cu­ri­ty tech­nolo­gies is a panacea for our dig­i­tal se­cu­ri­ty chal­lenges: They all have vul­ner­a­bil­i­ties and there­fore they all car­ry risks. But there is an even greater risk in be­liev­ing that pass­words by them­selves with keep you or your pre­cious da­ta safe in the dig­i­tal age.

Bevil Wood­ing is chief knowl­edge of­fice at Con­gress WBN (C-WBN) an in­ter­na­tion­al non-prof­it or­gan­i­sa­tion and ex­ec­u­tive di­rec­tor at Bright­Path Foun­da­tion, re­spon­si­ble for C-WBN's tech­nol­o­gy ed­u­ca­tion and out­reach ini­tia­tives. Fol­low on Twit­ter: @bevil­wood­ing