CybersecurityThe challenge of authenticating real humans in a digital world

By Jungwoo Ryoo

Published 8 November 2017

There are three main ways of proving an identity. One involves something you know – like a password or your mother’s maiden name. A second method of authentication is with something you have – such as a key to your home’s front door or a smart card to swipe at work. A third way is by digitally authenticating the individual human being – who you are – with some aspect of your biology. This increasing dependence on digital authentication may actually result in less security. While cameras, sensors and other devices can make authentication easier for people to accomplish, they carry their own weaknesses. It may be more convenient, and even more secure, than a magnetic strip on a plastic card in your wallet. But the potential dangers will require much higher security for private information, particularly biometric data. A real identity still comes down to flesh and blood.

Professor Jungwoo Ryoo, (left) of Pennsylvania State University // Source: psu.edu

Proving identity is a routine part of modern daily life. Many people must show a driver’s license to buy alcohol at a store, flash an ID card to security guards at work, enter passwords and passcodes to retrieve email and other private information, and answer security validation questions when calling banks or credit card companies for customer service.

Authentication is also getting easier for people: Take the iPhone, for example. Unlocking the early versions required a multi-digit passcode. Then Apple introduced Touch ID, which would unlock the phone with a fingerprint reader. The latest version, just out, is the iPhone X, which can use its camera to perform facial recognition to authenticate a user.

As a software security researcher looking at authentication technologies for hand-held devices, I am fully aware that the technologies change, but the challenge remains the same: How can a digital system authenticate an analog human’s identity?

Three factors of identity
There are three main ways of proving an identity. One involves something you know – like a password or your mother’s maiden name. This method assumes the authorized user will have information no unauthorized user does. But that’s not always the case: For 145.5 million Americans affected by the Equifax security breach revealed in September 2017, reams of previously private information may now be known to criminals.

A second method of authentication is with something you have – such as a key to your home’s front door or a smart card to swipe at work. This assumes a limited number of people – possibly as few as one, but it could be a small group of users, like a family or co-workers – are allowed to enter a physical space or use a digital service.

A third way is by authenticating the individual human being – who you are – with some aspect of your biology. There are various type of these biometrics, such as fingerprints, facial recognition, iris scanning and voiceprints. This strategy, of course, assumes that the bodily feature is unique to the particular individual – and, crucially, that the digital system involved can tell the difference between people.

Using two or more methods together can improve security and is called two-factor, or multi-factor, authentication.