The challenge of authenticating real humans in a digital world
The consequences of digital authentication
This increasing dependence on digital authentication may actually result in less security. While cameras, sensors and other devices can make authentication easier for people to accomplish, they carry their own weaknesses.
When a system seeks to authenticate an individual, it must compare the information the person is presenting – what they know, what they have or who they are – against a previously stored database of authorized users. As the Equifax security breach makes clear, those databases are themselves vulnerable to attack. Information stolen from there could be used somewhere else – for instance, to identify which bank a particular person uses and answer security questions when calling to transfer money. Or the database itself could be corrupted, altering information so an attacker would be able to fake his way into a physical space or system.
Another potential security threat inherent in biometrics in particular is that criminals don’t need to guess a password, or force someone to reveal it: The simple presence of the victim – even at gunpoint – can supply the fingerprint or face to authenticate and unlock a system.
Future complications
As authentication becomes more complicated, using multiple factors and secure communications between sensors and databases, users become less willing to jump through all the hoops. So security managers try to make the process easier for them without weakening the protections. This commonly happens on websites that urge users to log in using their Facebook or Google accounts; those sites rely on the advanced security of the tech giants rather than creating their own authentication systems.
In one futuristic scenario, authentication could occur without a user even noticing: When you walk into a store, facial recognition could identify and authenticate you. Then, at checkout, you’d need only to scan your purchases and leave – the store will automatically charge the credit card of your choice. This isn’t science fiction: Amazon has patented a system for doing exactly this in its Amazon Go cashier-less convenience stores.
This is possible in part because of the increasingly common practice of computer systems authenticating each other – so the store’s system would recognize you, connect to the credit card company and authorize your purchase all on its own.
It may be more convenient, and even more secure, than a magnetic strip on a plastic card in your wallet. But the potential dangers will require much higher security for private information, particularly biometric data. A real identity still comes down to flesh and blood.
Jungwoo Ryoo is Professor of Information Sciences and Technology at Altoona campus, Pennsylvania State University. This article is published courtesy of The Conversation (under Creative Commons-Attribution / No derivative).
