One Year

I was reading an article of a guy named Ken Hess who asked the question '

Is multi-factor authentication the solution for identity theft?

http://www.zdnet.com/is-multi-factor-authentication-the-solution-for-identity-theft-7000017340/

What I liked is that he is being plain direct stating :

‘I deleted my Facebook account due to privacy concerns. I don't like the fact that I have to worry about someone stealing my identity from some cheesy website. I don't like feeling paranoid when I go to a bookstore and want to connect to their WiFi. And I really don't like knowing that somewhere, someone spends their days trying to empty my bank account. These things really annoy me. They annoy me to the point of asking some authority to take action against them directly and indirectly.’

In fact, I'm drawing  a line in the sand today. I'll give the sites I use one year from July 1, 2013 to implement multi-factor authentication or I'll stop using the site or service. Sites such as Twitter, Facebook, other social networking sites, banks, PayPal, Ebay, Gmail, etc. all need to setup some sort of secure login in the form of multi-factor authentication.

It's really no longer an option not to have it.

How many identities, credit card numbers, and passwords have to be compromised before we take action?

One year.

Setup some way to identify me as me or I'll stop using the site. If we all take this stand, we'll be taking a stand for a safer Internet and a stronger stance against cybercriminals.

Multi-factor authentication will decrease the number of identity thefts. There's no perfect way to thwart criminals because they spend their time trying not to make an honest living. You have to spend yours making sure that they receive diminishing returns for their efforts.’

We should all do the same by acting this way and give any company who we are dealing with one year, just ‘One Year’. 

And you’ll see that 2014 will never be like 2014.

Performance of biometrics

The most common performance metrics to rate the performance of a biometric factor, solution or application are the False Acceptance Rate FAR and the False Rejection Rate FRR.

When using a biometric application for the first time the user needs to enroll to the system. The system requests fingerprints, a voice recording or another biometric factor from the operator, this input is registered in the database as a template which is linked internally to a user ID. The next time when the user wants to authenticate or identify himself, the biometric input is compared to the template(s) in the database by a matching algorithm which responds with acceptance (match) or rejection (no match).

The FAR or False Acceptance rate is the probability that the system incorrectly authorizes a non-authorized person, due to incorrectly matching the biometric input with a template. The FAR is normally expressed as a percentage, following the FAR definition this is the percentage of invalid inputs which are incorrectly accepted..

The FRR or False Rejection Rate is the probability that the system incorrectly rejects access to an authorized person, due to failing to match the biometric input with a template. The FRR is normally expressed as a percentage, following the FRR definition this is the percentage of valid inputs which are incorrectly rejected.

You want both the FAR and the FRR to be low as possible. FAR and FRR are very much dependent on the biometric factor that is used and on the technical implementation of the biometric solution. Furthermore the FRR is strongly person dependent, a personal FRR can be determined for each individual.  Also FRR might increase due to environmental conditions or incorrect use, for example when using dirty fingers on a fingerprint reader. Mostly the FRR lowers when a user gains more experience in how to use the biometric device or software.

FAR and FRR are key metrics for biometric solutions, some biometric devices or software even allow to tune them so that the system more quickly matches or rejects. Both FRR and FAR are important, but for most applications one of them is considered most important.

For example when biometrics are used for logical or physical access control, the objective of the application is to disallow access to unauthorized individuals under all circumstances. It is clear that a very low FAR is needed for such an application, even if it comes at the price of a higher FRR.

But when surveillance cameras are used to screen a crowd of people for missing children, the objective of the application is to identify any missing children that come up on the screen. When the identification of those children is automated using a face recognition software, this software has to be set up with a low FRR. As such a higher number of matches will be false positives, but these can be reviewed quickly by surveillance personnel.

When it comes to the quality of performance of biometrics the quality of the enrollment is critical.

Passwords are big business

http://www.youtube.com/watch?v=Srh_TV_J144

Passwords are Passé

http://jikakisina.blogspot.nl

Security & Usability

Traditionally, access to secure areas or sensitive information has been controlled by possession of a particular artifact (such as a card or key) and/or knowledge of a specific piece of information such as a Personal Identification Number (PIN) or a password. Today, many people have PINs and passwords for a multitude of devices, from the car radio and mobile phone, to the computer, web-based services and their bank information.

Herein lies a major difficulty involving the trade-off between usability, memorability and security. Methods for increasing security, such as regularly changing PINs and passwords, increasing their length, ensuring they do not form words and ensuring all are different, makes them more difficult to remember and, therefore, error-prone. Alternatives to the traditional Personal Identification Number (PIN) have also been investigated for instance using pictures instead of numbers.

Of course, traditional methods rely upon the assumption that the artifact (such as key or card) will be in the possession of the rightful owner and that the information to activate it will be kept secret. Unfortunately, neither of these assumptions can be wholly relied upon.

It has been noted that if people are permitted to choose their own passwords they tend to select ones which are easily guessed. People tend to choose ones that are related to their everyday life. They choose passwords which are easy to remember, and, typically, easily predicted, or they change all PINs to be the same. Also, people are often lax about the security of this information and may deliberately share the information, say with a spouse or family member, or write the PIN down and even keep it with the card itself.

Biometric techniques may ease many of these problems: they can confirm that a person is actually present (rather than their token or passwords) without requiring the user to remember anything. So far, however, the growth of biometrics technologies has been driven by a mainly system-centred approach, dealing with the problems of unique digital identifier extraction, template handling and recognition algorithms.

I’m a huge advocate of User Centric Design. Yet in a corporate world, what the end user wants is often insufficiently taken into account by the designer or decision maker. This is less the case in consumer facing applications, but when it comes to applications for employees my experience is that usability isn’t high on the priorities list.

It's time IT need to involve the pro user in what security means in their professional life, just like the Bring-Your-Own-Device wave,  we should be thinking how to facilitate Bring-Your-Own-Identity. The first thing to do is to place the user in the centre focussed on how users want to experience security, they are already convinced of the necessity. User Centric Design will result in better usability, quicker adaptation and higher productivity.