Google is making autofill on Chrome for mobile more secure

Posted by | Access Control, Android, biometrics, Chrome, computing, cryptography, Google, Identification, identity management, internet security, Mobile, Password, password manager, Security, smartphones, TC | No Comments

Google today announced a new autofill experience for Chrome on mobile that will use biometric authentication for credit card transactions, as well as an updated built-in password manager that will make signing in to a site a bit more straightforward.

Image Credits: Google

Chrome already uses the W3C WebAuthn standard for biometric authentication on Windows and Mac. With this update, this feature is now also coming to Android .

If you’ve ever bought something through the browser on your Android phone, you know that Chrome always asks you to enter the CVC code from your credit card to ensure that it’s really you — even if you have the credit card number stored on your phone. That was always a bit of a hassle, especially when your credit card wasn’t close to you.

Now, you can use your phone’s biometric authentication to buy those new sneakers with just your fingerprint — no CVC needed. Or you can opt out, too, as you’re not required to enroll in this new system.

As for the password manager, the update here is the new touch-to-fill feature that shows you your saved accounts for a given site through a standard Android dialog. That’s something you’re probably used to from your desktop-based password manager already, but it’s definitely a major new built-in convenience feature for Chrome — and the more people opt to use password managers, the safer the web will be. This new feature is coming to Chrome on Android in the next few weeks, but Google says that “is only the start.”

Image Credits: Google


Powered by WPeMatico

Researchers use biometrics, including data from the Oura Ring, to predict COVID-19 symptoms in advance

Posted by | artificial intelligence, biometrics, biotech, coronavirus, COVID-19, Disease, fatigue, fever, Gadgets, Health, Identification, infection, neuroscience, oura, surveillance, TC | No Comments

A team of researchers from the West Virginia University (WVU) Rockefeller Neuroscience Institute (RNI), along with WVU’s Medicine department and staff from Oura Health have developed a platform they say can be used to anticipate the onset of COVID-19 symptoms in otherwise healthy people up to three days in advance. This can help with screening of pre-symptomatic individuals, the researchers suggest, enabling earlier testing and potentially reducing the exposure risk among front-line healthcare and essential workers.

The study involved using biometric data gathered by the Oura Ring, a consumer wearable that looks like a normal metallic ring, but that includes sensors to monitor a number of physiological metrics, including body temperature, sleep patterns, activity, heart rate and more. RNI and WVU Medical researchers combined this data with physiological, cognitive and behavioral biometric info from around 600 healthcare workers and first responders.

Participants in the study wore the Oura Ring, and provided additional data that was then used to develop AI-based models to anticipate the onset of symptoms before they physically manifested. While these are early results from a phase-one study, and yet to be peer-reviewed, the researchers say that their results showed a 90% accuracy rate on predicting the occurrence of symptoms, including fever, coughing, difficulty breathing, fatigue and more, all of which could indicate that someone has contracted COVID-19. While that doesn’t mean that individuals have the disease, a flag from the platform could mean they seek testing up to three days before symptoms appear, which in turn would mean three fewer days potentially exposing others around them to infection.

Next up, the study hopes to expand to cover as many as 10,000 participants across a number of different institutions in multiple states, with other academic partners on board to support the expansion. The study was fully funded by the RNI and their supporters, with Oura joining strictly in a facilitating capacity and to assist with hardware for deployment.

Many projects have been undertaken to see whether predictive models could help anticipate COVID-19 onset prior to the expression of symptoms, or in individuals who present as mostly or entirely asymptomatic based on general observation. This early result from RNI suggests that it is indeed possible, and that hardware already available to the general public could play an important role in making it possible.

Powered by WPeMatico

3D-printed heads let hackers – and cops – unlock your phone

Posted by | 3d printing, biometrics, face id, facial recognition, facial recognition software, Hack, Identification, iOS, iPhone, learning, Mobile, model, Prevention, privacy, Security, surveillance | No Comments

There’s a lot you can make with a 3D printer: from prosthetics, corneas, and firearms — even an Olympic-standard luge.

You can even 3D print a life-size replica of a human head — and not just for Hollywood. Forbes reporter Thomas Brewster commissioned a 3D printed model of his own head to test the face unlocking systems on a range of phones — four Android models and an iPhone X.

Bad news if you’re an Android user: only the iPhone X defended against the attack.

Gone, it seems, are the days of the trusty passcode, which many still find cumbersome, fiddly, and inconvenient — especially when you unlock your phone dozens of times a day. Phone makers are taking to the more convenient unlock methods. Even if Google’s latest Pixel 3 shunned facial recognition, many Android models — including popular Samsung devices — are relying more on your facial biometrics. In its latest models, Apple effectively killed its fingerprint-reading Touch ID in favor of its newer Face ID.

But that poses a problem for your data if a mere 3D-printed model can trick your phone into giving up your secrets. That makes life much easier for hackers, who have no rulebook to go from. But what about the police or the feds, who do?

It’s no secret that biometrics — your fingerprints and your face — aren’t protected under the Fifth Amendment. That means police can’t compel you to give up your passcode, but they can forcibly depress your fingerprint to unlock your phone, or hold it to your face while you’re looking at it. And the police know it — it happens more often than you might realize.

But there’s also little in the way of stopping police from 3D printing or replicating a set of biometrics to break into a phone.

“Legally, it’s no different from using fingerprints to unlock a device,” said Orin Kerr, professor at USC Gould School of Law, in an email. “The government needs to get the biometric unlocking information somehow,” by either the finger pattern shape or the head shape, he said.

Although a warrant “wouldn’t necessarily be a requirement” to get the biometric data, one would be needed to use the data to unlock a device, he said.

Jake Laperruque, senior counsel at the Project On Government Oversight, said it was doable but isn’t the most practical or cost-effective way for cops to get access to phone data.

“A situation where you couldn’t get the actual person but could use a 3D print model may exist,” he said. “I think the big threat is that a system where anyone — cops or criminals — can get into your phone by holding your face up to it is a system with serious security limits.”

The FBI alone has thousands of devices in its custody — even after admitting the number of encrypted devices is far lower than first reported. With the ubiquitous nature of surveillance, now even more powerful with high-resolution cameras and facial recognition software, it’s easier than ever for police to obtain our biometric data as we go about our everyday lives.

Those cheering on the “death of the password” might want to think again. They’re still the only thing that’s keeping your data safe from the law.

Powered by WPeMatico

Fido Alliance adds a biometrics certification program to help fight spoofing

Posted by | biometrics, consumer electronics, facial recognition, Fido Alliance, Identification, Mobile, Security, TC, voice recognition | No Comments

In a move aimed at upping standards across biometric user verification systems, the industry consortium, Fido Alliance, has launched a certification program for biometrics systems.

“The goal of the Biometric Certification Component Program is to provide a framework for the certification of biometric subsystems that can in turn be integrated into FIDO Certified authenticators,” it writes on its website.

While biometric verification systems such as fingerprint readers have been pretty widely adopted in the mobile space already — with Apple introducing its fingerprint biometric, Touch ID, to the iPhone a full five years ago; followed, last fall, by a facial recognition biometric (Face ID) for its high end iPhone X — the Alliance says that, up to now, there hasn’t been a standardized way to validate the accuracy and reliability of biometric recognition systems in the commercial marketplace. Which is where it’s intending the new certification program to come in.

While few would doubt the robustness of Apple’s biometrics components (and testing regime), the sprawlingly diverse Android marketplace hosts all sorts of OEM players — which inevitably raises the risk of some lesser quality components (and/or processes) slipping in.

And in recent years there have been plenty of examples of poorly implemented biometrics, especially in the mobile space — with hackers easily able to crack into various Android devices that were using facial or iris recognition technology in trivially bypassable ways.

In 2017, for example, Chaos Computer Club members used a print out of an eye combined with a contact lens to fox iris scanners on the Samsung Galaxy S8. And that was one of the most sophisticated biometric hacks. Others have just required a selfie of the person to be held up in front of a ‘face unlock’ system to get an easy open sesame.

Where the not-for-profit Alliance comes in — an industry group whose board includes security exec reps from the likes of Amazon, Google and Microsoft, among others — is it’s on a mission to reduce reliance on passwords for digital security because they inject friction into the online experience.

And biometrics do tend to be convenient, given they are attached to each person. Which is why they have been increasingly finding their way into smartphones and all sorts of other consumer electronics — from wearables to car tech, helped by component costs shrinking as biometrics adoption grows.

But it’s no good trying to speed up ID verification if the alternatives being reached for are badly implemented — and end up actively damaging security.

It certainly doesn’t have to be that way.

Apple’s biometrics are not so easily mocked. And while Touch ID is vulnerable to spoofing, like pretty much any fingerprint reader, its depth-mapping Face ID tech is by far the most sophisticated biometric implementation in the consumer electronics space to date. And hasn’t been meaningfully hacked (well, barring attacks by identical twins/strikingly similar looking family members).

So there’s clearly a world of difference (and, well, cost) between a well architected biometric recognition system which puts security considerations front and center, vs the awful sloppy stuff we’ve seen in recent years — where OEMs were just rushing to compete.

Biometrics has certainly often been treated more as a convenience gimmick for device marketing purposes, rather than viewed as a route to evolve (and even potentially enhance) device security.

The Alliance’s certification program is using accredited independent labs to test that biometric subcomponents meet what it dubs “globally recognized performance standards for biometric recognition performance and Presentation Attack Detection (PAD)” — and thus that they are “fit for commercial use”.

PAD refers to various methods that can be used to try to attack and circumvent biometric systems, such as using silicon or gelatine fingerprints, or deploying harvested facial or video imagery of the device owner.

So it looks like the Alliance’s hope for the program is to ‘upskill’ biometric implementations — or at least weed out the really stupid stuff.

“For customers, such as regulated online service providers, OEMs and enterprises, it provides a standardized way to trust that the biometric systems they are relying upon for fingerprint, iris, face and/or voice recognition can reliably identify users and detect presentation attacks,” it writes.

Speed is another goal too, as it says prior to this certification program due diligence was carried out by enterprise customers (or at least by those “who had the capacity to conduct such reviews”) — which required biometric vendors to repeatedly prove performance for each customer.

Whereas going forward vendors can use the program to test and certify just once to validate their system’s performance and re-use that third-party validation across the market — gaining what the Alliance bills as” substantial time and cost savings”.

Commenting in a statement, Brett McDowell, executive director of the Alliance, said: “While border control and law enforcement markets have mature assessment programs for their biometric systems, we were surprised that no such program existed for this rapidly growing consumer market.”

“With biometrics being a popular option for mobile and web applications implementing Fido Authentication, there is a growing need for those service providers to appropriately assess the risk of fraud from lost or stolen devices,” he added.

Asked whether the program had been introduced in response to particular concerns about weak consumer biometrics — given some of the aforementioned examples of poor implementations — McDowell also told us: “With the rise of any new technology, there’s a risk that some suppliers may over emphasize visible features at the expense of security considerations as they rush to market.

“This program, motivated by our online services community, mitigates that risk for mobile and desktop biometrics by providing a commercial-grade benchmark and independent lab assessment for performance features and spoof attack detection security considerations. Another benefit of the program is a clear way for service providers to prove compliance with strong authentication regulation, which is becoming the norm for financial services. This trend is expected to expand to other sectors as passwords continue to be exploited at increasingly alarming rates.”

Currently only one lab has been accredited to perform components testing for the program.

The lab, iBeta, is located in the U.S. but a spokeswoman for the Fido Alliance told us: “The Alliance is actively working to bring in additional labs.”

She added that the Alliance will update this list as more are added.

This post was updated with additional comment from McDowell 

Powered by WPeMatico

Facebook acquires biometric ID verification startup

Posted by | Apps, biometrics,, Facebook, Fundings & Exits, M&A, Mobile, Security, Social, Startups, TC | No Comments

 Facebook has confirmed to TechCrunch that it’s acquired… The startup offered an API that let other companies quickly verify someone’s government-issued identification card, like a driver’s license, was authentic. The Boston-based startup will shut down as both its team and technology are rolled into Facebook. Read More

Powered by WPeMatico

iPhone X’s Face ID raises security and privacy questions

Posted by | Apple Pay, artificial intelligence, authentication, biometrics, cupertino, face id, facial biometrics, Fingerprint, iOS, iPhone, iphone 5s, iPhone X, Mobile, privacy, Security, smartphones, TC, Touch ID | No Comments

 Offering to gate the smorgasbord of personal content that lives on a mobile device behind a face biometric inevitably raises lots of security questions, even as always on face-scanning tech being housed in a smartphone raises privacy concerns… Read More

Powered by WPeMatico

Swiss system ups security and reliability of finger-based biometrics

Posted by | biometrics, EPFL, Gadgets, science, Security, TC | No Comments

 Biometrics may not be the perfect solution for security, but they can be useful — as long as they’re robust and well thought out. TouchID is all well and good, but you wouldn’t secure a nuclear site with it. Well, movies aside, you probably should secure a nuclear site with a fingerprint, regardless. But this new system from Swiss researchers is a step in the right direction. Read More

Powered by WPeMatico