What if someone has my face? Biometric systems principal limitations

In the last post, we found out that face or iris of an eye or fingerprint or voice or any other unique human biological attribute could be used to prove your identity. In other words, to convince someone that you are who you are. Can you use bio along in protecting critical security asset?

It seems natural for us to recognise someone by his appearance. Mother nature build us in this way and spend a fair amount of time to polish this mechanism. What about artificial systems that are used for the same purpose? How good are they? Some of them are better then we are in a narrow area of biometric parameters reading. For example, in recognising iris footprint. Accuracy, in general, is not an issue.

Problems come from two different places:

• If someone's learned to fake your biometric parameter, you are screwed up. And you cannot do anything, because you cannot change it. If someone learned to fake your face, you could not replace your own. The same is about the fingerprint, iris, voice. The only going you have is to terminate everywhere usage of this parameter.

• The second thing is that none of these systems understands the context. They just do not know anything about our day-to-day world. What is a photo? What is being alive? What is breathing? What is happening now outside? Is it ok to have one and a half noses and three eyes? Most biosystems deceptions are based on this fact.

Thus using bio along is threatening, cause you can easily lose access to a resource if something went wrong. Use it only as a second factor to protect critical information. You can still use for low critical assets.