{"id":21735,"date":"2012-12-01T21:26:20","date_gmt":"2012-12-02T02:26:20","guid":{"rendered":"http:\/\/rbach.net\/blog\/index.php\/"},"modified":"2021-08-26T21:32:01","modified_gmt":"2021-08-27T01:32:01","slug":"i-think-therefore-i-login","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/i-think-therefore-i-login\/","title":{"rendered":"I Think Therefore I Login"},"content":{"rendered":"

\"I<\/a>Forgetting a password could become a thing of the past<\/strong> according to the ZDNet<\/a><\/em> article Brainwaves as Passwords; Secure and Near-Reality<\/a>. John Fontana<\/a> at\u00a0Identity Matters<\/a> says the technology to do so could be here as early as June 2013. Interaxon<\/a><\/strong>, which develops thought-controlled computing<\/strong>, is releasing the Muse headband sensor<\/strong> device that is designed to use brainwaves to login.<\/p>\n

Brainwave sensors<\/h3>\n

\"Muse<\/a>The slim plastic Muse headband fits against a person\u2019s forehead and slips over the ears. The band houses four brainwave sensors<\/strong>. There are not any authentication applications that work with Interaxon\u2019s Muse headband yet. The article notes that the company has a software developer\u2019s kit (SDK) for anyone who wants to do it. However, company CEO Ariel Garten<\/a> says such an app is reasonable and possible.<\/p>\n

\u201cThe user could create a specific brainwave signature or a password<\/strong> they would never have to say out loud or type into a computer,\u201d said Ms. Garten, who spoke at the Blur Conference<\/a> in Broomfield, CO<\/a>. According to Mr.\u00a0Fontana the CEO demonstrated thought-controlled applications and the Muse headband.<\/p>\n

Brainwave login passwords<\/h3>\n

\"government<\/a>While brainwave passwords might conjuror up thoughts of being snatched off the street and having a brain drain, Ms. Garten said the technology isn\u2019t mind reading. \u201cPeople might think the government can read their pin number, but we can\u2019t read your thoughts or images in your head.<\/em>\u201d Muse, which talks to devices via Bluetooth<\/a>, is an electroencephalograph (EEG<\/a>) that records brainwaves and reads the brain’s overall pattern of activity to detect certain states such as relaxed or alert explains the article.<\/p>\n

The brainwaves are turned into binary data and the translated waves are used to control anything electric. Users can learn to manipulate brainwave patterns, like flexing muscles. \u201cThis builds your brain like doing bench press reps in the gym, Ms. Garten claims.<\/em><\/p>\n

\"laptops<\/a>Applications that run on smartphones, tablets, or laptops can be controlled with the mind according to the article. Ms. Garten believes the technology is set to take off, she is quoted in the article, \u201cIn 25 years, interacting with technology using your mind will be as ubiquitous as a gesture is today<\/em>.\u201d<\/p>\n

rb-<\/em><\/strong><\/p>\n

This seems like a cool idea, maybe Sony or Nintendo will take it over. This is not a panacea for passwords.<\/em><\/p>\n

With the small real-world experience with biometrics in the enterprise (Thinkpad T61p laptop) it worked adequately for local machine access, but what about when you have to scale this to 10s of thousands of users? Just imagine the HR issues involved with obtaining employee’s fingerprints or as the article suggests brainwaves.<\/em><\/p>\n

In my environment, where I think biometrics makes sense, there is all the political baggage that comes with biometrics and children and the anti-education, anti-efficiency, and religious groups. I wrote here<\/a> about a Texas school distinct facing the wrath of these groups for RFID<\/a> cards, not biometrics.<\/em><\/p>\n

Then there are the technical issues with any password (character string or biometric) system. The hashed password or brainwave needs to be stored somewhere in binary form. If your AD is compromised you still have a problem.<\/em><\/p>\n

swilson, one of the commenters at ZDNet wrote: “all biometrics are the same! It doesn’t matter what trait they come up with, the same core biometric challenges remain. The challenges he sees are:
\n<\/em><\/p>\n

    \n
  1. How to stop replay attacks?<\/em><\/li>\n
  2. How to secure centrally stored templates that are needed to support ‘federated’ biometric access control from multiple points?<\/em><\/li>\n
  3. What is the real-world sensitivity\/specificity trade-off i.e. quantified False Positive and False Negative Error Rates? Knowing a bit about brain physiology, I am very skeptical that anyone can measure a highly distinctive brain wave with better than 90-95% accuracy.<\/em><\/li>\n
  4. Most basic problem: revokeability. What’s to be done in the event of a compromise, when you cannot cancel and reissue a brain wave, or fingerprint, or iris, or genome?”<\/em><\/li>\n<\/ol>\n
    Related articles<\/h6>\n