edagraffiti

There was a reason I wrote about biometrics trecently. I have a new job as COO (and VP marketing) at Biogy, which is a biometrics company. Already I’ve become a biometrics bore. But that means I don’t really have time any more to be an EDA bore as well, not to mention that since I’ll be spending less time in the EDA milieu I won’t have anything interesting to say about it any more. Okay, I set myself up for comments about not having anything interesting to say anyway, in which case why are you here reading this? Biogy isn’t fully funded so I’m not getting paid yet so I’m still interested in EDA consulting opportunities.

Anyway, time will tell how this all plays out. Maybe the gravitational attraction vortex of EDA will once again prove too much and I’ll be back in a year or two.

In the meantime, I’ll continue to post stuff here, but only once or twice a week, not daily as I have been doing since the start of the year.

My email, as always, is paul%greenfolder.com (with the percent replaced by @ of course).

I was at a biometrics conference in Florida the week before last. The state of the art is much more advanced than I realized in many areas.

For example, iris recognition can be done at a distance of a couple of meters. You just look at a screen for a second or two and the system can identify who you are and thus whether you are approved to enter, or whatever. In a self-contained unit, the unit itself can store 100,000 people. With a back-end database there can be millions or even hundreds of millions and identification still takes place in under 2 seconds. This is still what is called cooperative recognition, where the person being identified follows instructions, opens their eyes, takes off their glasses (although it has a pretty good recognition rate even if you don’t, depending on how much other reflection there is off the lenses). There seem to be research projects going on to recognize people simply by scanning them as they walk by.

In Japan, half of all ATMs are equipped so you stick your finger in to validate who you are. Over 80% of them use Hitachi’s recognition system, which works, not by fingerprints, but by the pattern of veins inside the finger which can be seen by shining a bright red light into the end of the finger. Curiously, an ATM card plus your finger isn’t enough. You have to type in a four digit PIN too, but not because the banks want it. Japanese law says that ATMs much have PINs and the law hasn’t caught up with modern technology (that would never happen here, surely, where every senator already knows that the Internet is a series of tubes). Don’t expect to see this any time soon in the US since we don’t really use smart cards and the modern way to do things is to store the biometric data on the card and not in a central database so that it doesn’t have a single point of failure, and because in many countries (although not the US) there are major restrictions on biometric databases which are obviated if you only store them on something that belongs to the user.

In Pakistan, fingerprints are used to control elections, guaranteeing one person one vote. I talked in the bar one night to people who built that system and I asked them about its computational needs. They told me it all ran on “what counts as a server in Pakistan” namely a not-state-of-the-art PC. Apparently part of the cleverness is being able to reject over 90% of people without having to look at their detailed fingerprint data.

Those of you who are citizens may have noticed that all visitors (including permanent residents like me) are fingerprinted and photographed every time we enter the US. That’s over 600 million times a year. I’m sure Homeland Security would fingerprint everyone at the border if it weren’t against the law, just like the NSA decided to examine everyone’s phone traffic (despite being against the law). I’ve no idea what they do with the data, it seems like a boondoggle for the equipment suppliers. After all, the 9/11 hijackers all entered the country legally with visas (although in couple of cases the visas didn’t get approved until 6 months after 9/11).

It is clear that the federal government isn’t going to rest until we have standardized biometric driver’s licenses. I’m sure they will then require you to use your fingerprint or iris every time you take a plane or enter a federal building. Since most government databases have significant error rates and essentially no procedures for validating and checking the data, this is going to result in some wonderful Kafkaesque stories when people get lost by the system or confused with someone else.

Identity is very important for some things, like nobody except you should transfer money out of your bank account. For others it is completely unclear, such as getting on a plane. Despite the terrorist watch lists (people who are so dangerous that they can’t be allowed on a plane but so undangerous that they can’t be charged with anything at all) airline security seems never to have apprehended a genuine terrorist (as opposed to the occasional petty drug dealer).

A lot of what the government seems to be doing is analogous to the drunk looking for his keys under the streetlight because that’s where he could see. Take lots of biometric information in, because it is possible, even though nobody has a database of biometric information from suspected terrorists to match against.

In the meantime, in tiny drips like this, I think our freedom and privacy gradually ebbs away. Forget the differences in rhetoric, the Bush and Obama administrations both seem equally keen to centralize power and take away liberties in the name of the usual trifecta of terrorists, pedophiles and drug dealers.

What are biometrics? It is authenticating people by some aspect of their body, typically fingerprints (or finger vein), iris scan or voice recognition. I think that it will become much more important in the coming years since it offers a painless way to get increased security.

As I talked about earlier, security is hard and people think it isn‘t. In the military and internally in big companies, the way that security works can be mandated. Even then there are regular stories of unencrypted disks going missing in the mail, or credit card databases being stolen wholesale. But in the consumer world there is a different issue: if the consumers find it too hard to use then they won’t use it. If a bank makes its customers jump through too many hoops to login and make online payments then either they’ll change banks or think badly of their bank for not really having a usable online payment system.

The solution that the credit card companies came up with is simply to accept a certain amount of fraud and try and manage it down. Some of the behavioral stuff they now use seems to have got really good. Someone got hold of a credit card number of mine recently and they didn’t let a single fraudulent transaction go through, and, until they finally put a complete hold on the card, without blocking a valid one. Further, that was the first time they put a hold on my card, they didn’t have any earlier false alarms. That’s a big improvement from when once I couldn’t pay for my hotel in Japan because "someone appears to be attempting to use your card in Japan". Er, yes, that would be me.

I think biometrics offers the possibility of industrial strength security coupled with consumer ease-of-use. There are some issues since a few people don’t have readable fingerprints and people occasionally cut their fingers and so on. So there does need to be an alternative route for those rare occurrences, although they can be relatively cumbersome. To some extent biometrics has a bad rap since early implementations were poor and had high failure rate (you put your finger on the pad and you are not recognized) and there are some health issues with shared detectors (do you really want to stick your finger on the same piece of plastic as several hundred other people, some of them with flu, already did?).

Biometrics is divided into what are called one-to-one and one-to-many. One-to-one is where you know who the person is and you are trying to confirm it. The amount of data and processing required is relatively low. The one to many is where you scan, say, someone’s iris or fingerprints and identify them within a second or two from a database of several millions people. That requires much more serious computation, although the amount of data required to be stored per person is only of the order of 1K bytes.

There are lots of subtleties to making biometrics truly secure in the face of virus-ridden PCs, keyloggers, unencrypted wireless networks and the rest. Unlike a password, you can’t change your biometrics so guaranteeing that the data remains secure is even more important.

I’m amazed how much bad practice there is around security. People just aren’t very good at it, and sometimes don’t even realize that there is a security issue to worry about. It is not just that people aren’t good at it; they think they are.

Here’s one example. When I was an undergraduate in 1974 it was already standard practice in operating systems to store passwords after processing them through what was then called a one-way cipher and would today be called a hash function. Yet today, if you forget your password, many websites will simply send you an email telling you what it is (as opposed to resetting it and telling you what they reset it to). This is bad for so many reasons. Firstly, it should never be stored unhashed in the database since it risks the entire database being stolen (and thus everyone’s passwords). Since email is not secure, sending a password through email risks it being compromised that way. And you should not have your password on your computer anywhere (such as in an email) since one way of optimizing password search is to try every word on a person’s computer, orders of magnitude quicker than an exhaustive search. So something that was being taught to undergraduates nearly 40 years ago is still not being done.

That’s before worrying about the real weak link in security: users. We are all exhorted to have long passwords, not contain words, change them regularly, use different passwords for different purposes and so on. Nobody does that. What almost everyone does is have one weak password for stuff you don’t care about (if you really want to read the New York Times while pretending to be me then be my guest) and a stronger one for things you care a lot about (if you want access to my bank account then definitely don’t be my guest). Often banks insist on strong passwords (must contain an upper case letter, a lower case letter and a digit for example). So lots of people just write it down and stick a post-it on the computer. But then the usual set of backup questions are required for users who forget their passwords. I just don’t think it is that hard for someone to find the last 4 digits of my social security number and my mother’s maiden name (and an amusing aside: one website wouldn’t accept the answer to my mother’s maiden name question since it only has 4 characters and was deemed too short! It wasn’t even Wu or Li). It was a password recovery weak link that led to all the Twitter documents being compromised a few weeks ago.

As Bruce Schneier says, amateurs attack the cryptography; professionals attack the people. It’s even got a name, social engineering. Most readers of this blog are tech savvy and are at least suspicious of things like emails that look like they are from your bank or Paypal requiring you to go and log in. We are aware that the site you end up on might look like Paypal but probably is some password harvesting site. But less tech savvy people haven’t a chance. They’ve never heard the term phishing and don’t have any feel for which emails might be genuine and which are clearly fraud.

When people are phoned up they are even more vulnerable. There’s a lovely story of some high-up general inside the Pentagon saying that his password would be impossible for anyone to get. Susan Headley, a famous social engineer who had been briefing these generals, picked up the phone, pretended to be an admin in the Pentagon, called the general’s admin back wherever he was based and said the general had forgotten his password. She had it in a minute. But think about it. The general’s admin knew he was at the Pentagon, caller-ID may even have confirmed that, and so the whole story somewhat checked out.

A couple of years ago (I can’t find the reference any more) a security company went to a tradeshow, picked up lots of free USB memory sticks, loaded them up with a “phone home” program and then scattered them in the parking lots outside big companies. Well over half the memory sticks were inserted into computers inside the firewalls of those companies. If you found a memory stick beside your car are you sure you’d destroy it or might you see if it is any good (especially a couple of years ago before they became dirt cheap)?

Memory sticks are prohibited inside the DoD and homeland security since they became a vector for malware getting from employee’s home computers inside the firewall. Apparently this causes huge problems for some people since the DoD has many disconnected networks ("airgapped") and USB sticks were the way data got transferred between them. On coastguard ships there is equipment that doesn’t have a CD reader and without a USB stick, no way to update its tables.

One mail I can’t work out is that almost every day I get an email telling me I’m being sent a billing summary for my records, which is attached. But there is no attachment. I’m sure it is some sort of phishing attack but I guess somewhere along the email chain the attachment got stripped off for being too suspicious.