Speaker 1: Get in tech with technology with tech Stuff from how
Speaker 1: stuff works dot com. Hey there, and welcome to tech Stuff.
Speaker 1: I'm your host, Jonathan Strickland, senior writer with how stuff
Speaker 1: works dot Com, and today we're going to explore the
Speaker 1: wonderful world of authentication technology and how it's evolved and
Speaker 1: what could be in store for us in the future.
Speaker 1: So the reason why I picked this topic before I
Speaker 1: jump into the whole thing, is because I feel like
Speaker 1: security is becoming a bigger and bigger concern as it
Speaker 1: should be for a lot of people. People are more
Speaker 1: aware of it, I think than they were perhaps five
Speaker 1: years ago. Not everyone is practicing good security measures. Not
Speaker 1: everyone's practicing two factor authentication or multi factor authentication. We'll
Speaker 1: talk about that in this episode, and if you aren't
Speaker 1: familiar with what that's all about, that's why I wanted
Speaker 1: to do this show, was to kind of explain what
Speaker 1: what that actually means and why it is important. Authentication
Speaker 1: is something that we should probably define. First of all,
Speaker 1: it's the process or action of proving something to be true, genuine,
Speaker 1: or valid, So that covers a broad spectrum right authentication.
Speaker 1: You could be talking about authenticating a historical artifact, that's
Speaker 1: a great example. You bring a historical artifact to an expert,
Speaker 1: they authenticate that it is in fact a historical artifact
Speaker 1: and not something that was whipped up in some sort
Speaker 1: of souvenir shop and some out of the way place.
Speaker 1: But authentication has a very special role in the world
Speaker 1: of technology and the world of computers and electronics. It
Speaker 1: gets a bit more specific. It's the process of verifying
Speaker 1: the identity of a user or a program or process.
Speaker 1: You want to make certain everything is authentic so that
Speaker 1: a program or person doesn't get unauthorized access to a system.
Speaker 1: So you're probably familiar with a lot of authentication processes,
Speaker 1: even if you didn't call them that, because you yourself
Speaker 1: have to employ them on a regular basis. Programs do too.
Speaker 1: But I'm not gonna really spend a lot of time
Speaker 1: talking about programs. In fact, I'm really not going to
Speaker 1: dive into it at all because that gets super technical,
Speaker 1: um and really I think it's more important to focus
Speaker 1: on the stuff that you have a direct involvement with, unless,
Speaker 1: of course, you're a programmer, in which case mia culpa.
Speaker 1: So I'm going to focus on authentication technology targeted at humans.
Speaker 1: So one day, maybe I'll do a software one if
Speaker 1: there's a lot of requests for it, but I feel
Speaker 1: like that might just get a little too deep in
Speaker 1: the weeds. So I'm gonna talk about the stuff you
Speaker 1: and I encounter when we try to access or protect
Speaker 1: our technology and our data. Now, there are a ton
Speaker 1: of different ways to do this. Some of them are
Speaker 1: inherently stronger methods of authentication than others and are better
Speaker 1: as far as you know, being more secure. And all
Speaker 1: of these authentication strategies can be divided into three broad categories.
Speaker 1: Those categories are inherence factors, knowledge factors, and ownership factors.
Speaker 1: So when you hear about two factor authentication, we're talking
Speaker 1: about a specific strategy that employs different uh different approaches
Speaker 1: belonging to different factors. Now, that doesn't really mean anything
Speaker 1: unless I expand on it. So an inherence factor relies
Speaker 1: upon the user him or herself. In other words, it
Speaker 1: has something to do with you as a user. It
Speaker 1: has to do with either your physical traits or behavioral traits.
Speaker 1: So a very easy to understand example of this would
Speaker 1: be a fingerprint scanner. Right like you, your fingerprints are
Speaker 1: unique to you. It is something you have inherited is
Speaker 1: inherent in who you are, so it's an inherence factor.
Speaker 1: But there are lots and lots of others, and I'll
Speaker 1: talk about some of those later on this episode. Knowledge
Speaker 1: factors are pretty self explanatory. Those are authentication strategies that
Speaker 1: rely on something that the user knows, like a password
Speaker 1: or a personal identification number otherwise known as a pen.
Speaker 1: Ownership factors are also pretty easy to understand. Those rely
Speaker 1: on something the user possesses, like a key card for
Speaker 1: security door. That would be an ownership factor. Now, on
Speaker 1: top of those categories, you have the additional strategies to
Speaker 1: enable authentication, which includes that two factor authentication that I
Speaker 1: talked about before. And maybe you don't know exactly what
Speaker 1: that means, well, that's why here. Really. Single factor authentication
Speaker 1: relies on just one component to access a system. So,
Speaker 1: for example, a lot of smartphones require users to unlock
Speaker 1: the device with a pin or a swipe pattern or
Speaker 1: a fingerprint scan. But that's it, right You you just
Speaker 1: have to do one of those things. You don't have
Speaker 1: to do multiple things. And once you do, whichever method
Speaker 1: you've enabled on your device, you have access to it.
Speaker 1: There's no secondary requirement. Systems that use single factor authentication
Speaker 1: are weaker than those that require more than one authentication strategy.
Speaker 1: In general, there are some different definitions for strong authentication
Speaker 1: I'll get into and you could argue that some inherence
Speaker 1: factors are so strong as to be fine on their own,
Speaker 1: But in general, going with a single factor is less
Speaker 1: secure than going for a two factor authentication strategy, which
Speaker 1: is exactly what is like. It requires two different authentication factors.
Speaker 1: That means the system will require users to provide authentication
Speaker 1: in two of those three categories. So an example of
Speaker 1: this is an a t M card. If you want
Speaker 1: to use an a t M card, you need to
Speaker 1: provide the card. That's an ownership factor. You have to
Speaker 1: be in possession of the card, and you have to
Speaker 1: supply the pen that's the knowledge factor. So you have
Speaker 1: an ownership factor and a knowledge factor. Those are two factors.
Speaker 1: That's two factor authentication. Possession of one factor should not
Speaker 1: be sufficient to access the respective system, nor should it
Speaker 1: lead to the discovery of the second factor. In other words,
Speaker 1: if you get hold of the card like you get
Speaker 1: hold of someone else's card, ideally there should be no
Speaker 1: indication on the card of what the pen is because
Speaker 1: you need both of those things in order to access
Speaker 1: someone's account. And if you make sure that only one
Speaker 1: of the two things is in possession of somebody else,
Speaker 1: they still can't get your stuff. So that's why you
Speaker 1: want the two factor authentication. You have to possess or
Speaker 1: know both of the authentication requirements independently of each other.
Speaker 1: This also applies to other factors as well. It doesn't
Speaker 1: just have to be knowledge and ownership. It could be
Speaker 1: ownership and inherence. It could be knowledge and inherence. You
Speaker 1: get the idea. So, if you've enabled to factor authentication
Speaker 1: on various online accounts, which I urge you to do
Speaker 1: for any accounts that actually offer it, you've likely had
Speaker 1: to supply a password as well as a code sent
Speaker 1: to you in some way. For example, you might have
Speaker 1: an email account that when you try and access it
Speaker 1: using a brand new device, says all right, well, what's
Speaker 1: your password? So you typed a little password in and
Speaker 1: then says all right, well, now I'm going to send
Speaker 1: you a code via text message. You need to put
Speaker 1: that code into this little box here, and then I'll
Speaker 1: give you access to your email. So the password part
Speaker 1: taps into that knowledge factor because you know the password
Speaker 1: and the text message taps into the ownership factor because
Speaker 1: there's a specific cell phone with a specific cell phone
Speaker 1: number associated with your email account, so you have to
Speaker 1: be an ownership of the cell phone in order to
Speaker 1: receive the text message and complete that authentication strategy. Many
Speaker 1: two factor authentication systems will actually allow you to designate
Speaker 1: specific devices as being safe quote unquote safe, meaning that
Speaker 1: you don't have to do that every single time you
Speaker 1: log in from that specific device. That way, you don't
Speaker 1: end up waiting for a text message every time you
Speaker 1: try and check your email from your personal laptop, computer,
Speaker 1: or smartphone. Now, there are systems that require even more
Speaker 1: forms of authentication, and we typically group these under the
Speaker 1: category multi factor authentication, indicating you've got to supply at
Speaker 1: least two methods in order to access the respective syste them.
Speaker 1: So technically, two factor authentication is a type of multi
Speaker 1: factor authentication. Most of the time, when I encounter it,
Speaker 1: multi factor is being used to mean more than two.
Speaker 1: I haven't personally ever encountered a system where I've had
Speaker 1: to supply more than two factors. But then again, no
Speaker 1: one trusts me with anything that's that important, so no
Speaker 1: big surprise there. Now, confusing matters somewhat is this term
Speaker 1: called strong authentication, which is used in a lot of
Speaker 1: different places, including the European Union. In fact, it's very
Speaker 1: prominently used in the EU. At first glance, you might
Speaker 1: think strong authentication and two factor or multi factor authentication
Speaker 1: are synonymous, that in order of it to be strong,
Speaker 1: it must be at least two factor authentication. But that's
Speaker 1: not actually the case. If a single authentication strategy is
Speaker 1: deemed secure enough, it can fall under the category of
Speaker 1: strong authentication. And so there's a lot of disagreement over
Speaker 1: what the actual definition is. It makes it pretty confusing.
Speaker 1: But let's give you an example. Let's say that there's
Speaker 1: a retinal scanner that scans the pattern of blood vessels
Speaker 1: in your eye. Now that's really difficult to replicate compared
Speaker 1: to other biometric measures such as a fingerprint, which you could,
Speaker 1: in fact, if you're very clever fake. So in the
Speaker 1: European Union, a system that looks at the blood vessels
Speaker 1: in your eye for authentication might be considered strong even
Speaker 1: though it's just a single factor. Let's say you don't
Speaker 1: have to provide any other information, it's just a quick
Speaker 1: skin of the eye and you're in if the system
Speaker 1: is robust enough, and if it's looking at something that
Speaker 1: is difficult enough to replicate, it could still count a
Speaker 1: strong authentication. He could even refer to knowledge based factors.
Speaker 1: So let's say a system requires you to answer a
Speaker 1: series of unrelated questions when you set up your account.
Speaker 1: Accessing the account at a later time requires that you
Speaker 1: rep like hat those answers. You've got to remember how
Speaker 1: you answered the questions when you first set it up.
Speaker 1: It's kind of like the security questions a lot of
Speaker 1: different systems used right now now, Because these questions are
Speaker 1: unrelated and knowledge of one answer doesn't provide any of
Speaker 1: the other answers, that could be considered strong authentication. Now, personally,
Speaker 1: I find that method to be a little on the
Speaker 1: flimsy side. But I'm not the one making definitions. I'm
Speaker 1: just reporting them to you guys. Now we've got the
Speaker 1: basic definitions out of the way, let's dive into a
Speaker 1: bit of history, because you guys know, I love to
Speaker 1: talk about the history of the various technologies and processes
Speaker 1: we've developed over the years. So the concept of authentication
Speaker 1: is ancient. It predates electronics by centuries. Throughout the years,
Speaker 1: people would have to provide some sort of proof of
Speaker 1: their identities. It might require someone else to vouchsafe for
Speaker 1: a person, or it might require a special seal belonging
Speaker 1: to a particular office or noble house place upon an
Speaker 1: official document. You may have heard that a lot of
Speaker 1: those documents would be sealed with wax, and then someone
Speaker 1: would use a signet ring in order to put a
Speaker 1: specific stamp in that wax. That was considered a form
Speaker 1: of authentication. If you saw the proper symbol, then presumably
Speaker 1: it came from the proper place. Not that you couldn't
Speaker 1: create a fake of that if you really wanted to,
Speaker 1: but you know, that was the idea. Or you might
Speaker 1: even just have a password shared between a small group
Speaker 1: of people. So as long as there have been secrets,
Speaker 1: there have been means to identify those who should and
Speaker 1: should not have access to those secrets. And secrets pre
Speaker 1: date the written word. But let's talk about passwords and
Speaker 1: authentication and electronics, because honestly, if I did a full
Speaker 1: episode about the history of passwords, that would not really
Speaker 1: be tech stuff. That would be an awesome, awesome episode
Speaker 1: of stuff they don't want you to know. Hint, hint.
Speaker 1: So computer passwords actually pre d eight personal computers. Back
Speaker 1: in nineteen sixty one, m I T created a password
Speaker 1: system for authorized access to its Compatible Time Sharing System
Speaker 1: or ct s S. Ct S S allowed multiple users
Speaker 1: to access the same computational core. So imagine that you
Speaker 1: are in a room and it's filled. Uh, there's like
Speaker 1: lots of tables everywhere, and every table has a couple
Speaker 1: of different workstations. Every workstation has a screen and a keyboard,
Speaker 1: but not a computer. They just have the keyboard in
Speaker 1: the screen, which are connected via cables to a single computer.
Speaker 1: Everyone is sharing the exact same computer. Well, way back
Speaker 1: in the day, that's how a lot of computer systems
Speaker 1: were made. They didn't have personal devices at every station.
Speaker 1: The stations were just dummy terminals that connected to a
Speaker 1: core system. Also, in those days, time sharing meant that
Speaker 1: the computer actually would divvy up when it was specifically
Speaker 1: available to do your calculations. So let's say you're typing
Speaker 1: in something, you're programming some code, and you send it
Speaker 1: to the computer. It would be responding to each station
Speaker 1: in turn, and it's doing it so fast that it
Speaker 1: feels almost instantaneous, or close enough to it, But in
Speaker 1: fact it would be responding uh. In sequence, as people
Speaker 1: had logged into the various terminals, now obviously using the
Speaker 1: same computer for all these dummy terminals create some challenges.
Speaker 1: How can each individual user maintain control over his or
Speaker 1: her data? How do they maintain their own private files?
Speaker 1: Because every user had a set of private files that
Speaker 1: other users should not be able to access without authorization.
Speaker 1: I mean, one person might be working on a project,
Speaker 1: someone else is working on a totally different project. You
Speaker 1: don't want those files to intermingle. You had the partition
Speaker 1: that stuff, so without a password, you really couldn't do that.
Speaker 1: So if everyone's using a core machine as the processor
Speaker 1: and storage unit, you had to create some means of
Speaker 1: differentiating one user from another. The solution was the password.
Speaker 1: So every user would get a unique password to enter
Speaker 1: into the system, which would then allow that user to
Speaker 1: create an access private files. And it also helped control
Speaker 1: the amount of time any individual user had with the machine.
Speaker 1: Because these machines they were rare. There are only a
Speaker 1: few of them in nineteen sixty one, so the time
Speaker 1: on those machines was very valuable. You you know, people
Speaker 1: were hoarding time. They were trying to do their best,
Speaker 1: you know, you might only get a few hours a week,
Speaker 1: so they would end up partitioning that out through passwords.
Speaker 1: It was kind of like a controlled ticket system, so
Speaker 1: that a ride doesn't get overwhelmed with a ton of people.
Speaker 1: You have you release a certain number of tickets per hour,
Speaker 1: and you keep the traffic flowing steadily. Same sort of thing,
Speaker 1: except in this case it was with a computer access,
Speaker 1: so it's a way to control the point of entry
Speaker 1: into the system. Now, at that time, the passwords were
Speaker 1: pretty simple, and they were not really secure at all.
Speaker 1: It was more for the matter of convenience than security really.
Speaker 1: After all, this predated the Internet, so external access to
Speaker 1: the system wasn't really a factor. If you wanted to
Speaker 1: get your hands on those sweet sweet private files, you
Speaker 1: actually needed to have physical access to the system itself.
Speaker 1: You couldn't just hack in from across the country. So
Speaker 1: in a way, that's a one factor of authentication all
Speaker 1: by itself. Ownership in this case, the ownership doesn't really
Speaker 1: refer to something that you personally own, but rather your
Speaker 1: physical access to the system. But these passwords weren't encrypted
Speaker 1: or stored in a particularly safe way. They were in
Speaker 1: plain text. So just a year after they debuted this
Speaker 1: password strategy, a graduate student named Alan Share accessed the
Speaker 1: entire list of unencrypted passwords stored on the system and
Speaker 1: printed them out. Now, the reason Shared did this was
Speaker 1: not to access private files created by other people. It
Speaker 1: was so that Shared could get more time on the
Speaker 1: system because every student was allotted just four hours of
Speaker 1: access per week, and he needed more access, and he figured, well,
Speaker 1: there's all these other hours of access that are going
Speaker 1: unused from other students. That's not fair. I'll just take
Speaker 1: their their hours and use them myself. The way he
Speaker 1: did this was he actually created a punch card that
Speaker 1: contained the file name and location for the password list,
Speaker 1: and it also contained a set of instructions that said
Speaker 1: take this file and send it to a printer. So
Speaker 1: he didn't even have to physically look at this file
Speaker 1: at all. He just had to figure out what was
Speaker 1: the file name, where was it located on the system,
Speaker 1: and then include the instructions sent to printer. By the way,
Speaker 1: if you want to know more about how punch cards
Speaker 1: work and the way that they were an integral part
Speaker 1: of early computing, you can actually listen to a classic
Speaker 1: two thousand nine Text Stuff episode titled computers from the past,
Speaker 1: and Chris Pallette and I talked a lot about them
Speaker 1: in that episode. So it's easy in hindsight to criticize
Speaker 1: the M I T strategy. But keep in mind this
Speaker 1: was at a time when unauthorized access to computers was
Speaker 1: exceedingly rare, because well, the computers were exceedingly rare. As
Speaker 1: computers began to proliferate throughout all areas of life, the
Speaker 1: need for more secure access strategies grew. According to Roger Needham,
Speaker 1: who was a professor of computing at Cambridge University, the
Speaker 1: Cambridge Lab came up with a concept to make passwords
Speaker 1: more secure, and that's the concept of hashing. Now, that's
Speaker 1: when you convert passwords of variable lengths into a fixed
Speaker 1: length string of characters using an algorithm for the transformation.
Speaker 1: It's a fancy way of saying, no matter how long
Speaker 1: or short of password is, you put it through a
Speaker 1: series of mathematical processes. Will you convert the password into
Speaker 1: numerals first? Then you do this series of mathematic processes, uh,
Speaker 1: the end result of which is you get a much
Speaker 1: longer string of characters and that represents the password. And
Speaker 1: it doesn't matter how long or short the past the
Speaker 1: original password was. All of the hashed versions of the
Speaker 1: password are the same length. So let's say the hash
Speaker 1: is e D characters long. That means if your base
Speaker 1: password is pass or it's anti disestablishmentarianism or anything else,
Speaker 1: it will end up converted into a string of e
Speaker 1: D characters. So if someone gets hold of the hashed passwords,
Speaker 1: those are the only ones that are being stored on
Speaker 1: the system, they would still have to figure out what
Speaker 1: was the mechanism used to generate the hashes in order
Speaker 1: to guess what the root password was, because otherwise they're
Speaker 1: all going to look like they're eight characters long. You
Speaker 1: won't know which ones were short passwords or long password words. Uh.
Speaker 1: In order to do that, obviously, you have to decide
Speaker 1: upon what the specific sequence of mathematical operations are going
Speaker 1: to be and what seed you're using for those operations. Uh.
Speaker 1: And once you do that, then you're able to make
Speaker 1: these kind of changes. So Needham said that the system
Speaker 1: was created and implemented in the mid to late nineteen sixties,
Speaker 1: so it wasn't very long after the m I T
Speaker 1: H rollout of passwords. Now later, still, computer scientists began
Speaker 1: to develop more secure hashing strategies. This includes salting passwords,
Speaker 1: which means adding characters to a password before you hash it.
Speaker 1: So a simple example of this is using a computer's
Speaker 1: clock to insert digits into the password and then hashing
Speaker 1: the new password, which makes it even harder for a
Speaker 1: hacker to figure out the route password from the hash
Speaker 1: because they need to know at what time that operation
Speaker 1: was performed on the original path pas word um, otherwise
Speaker 1: they wouldn't be able to replicate the original password. Now
Speaker 1: this is easier to understand if I give you an example.
Speaker 1: So let's say your password has been set to let's
Speaker 1: say tech stuff. You chose tech stuff as your password.
Speaker 1: First of all, that was dumb. Don't do that. Don't
Speaker 1: pick a word that's easy to guess, even if it's
Speaker 1: a name like tech stuff, which is granted an awesome show.
Speaker 1: But you've chosen tech stuff for this example. You access
Speaker 1: the system at two thirty five in the afternoon. Let's
Speaker 1: say that the computer converts that into military time, so
Speaker 1: that gives you fourteen thirty five, and then it salts
Speaker 1: your password with those numbers. So instead of it just
Speaker 1: saying text stuff, now it says T one e four
Speaker 1: C three H five stuff. That password then gets hashed
Speaker 1: into that eight character long version stored on the computers.
Speaker 1: By the way, that eighty characters is just an arbitrary example.
Speaker 1: I'm that doesn't really mean anything. I just need a
Speaker 1: number for the example. Now, let's say you access the
Speaker 1: same system the following day, but this time it's one
Speaker 1: twenty three in the afternoon. Remember it was two thirty
Speaker 1: five the day before, but now it's one twenty three
Speaker 1: the next day. The salted password is going to be
Speaker 1: different because it's going to convert one tree to military time,
Speaker 1: and then it's going to salt the password that way,
Speaker 1: so it would be T one E three C two
Speaker 1: H three stuff. The hashed value will end up being
Speaker 1: different as well, because it's inserted those new numbers. So
Speaker 1: that means that if the hacker gets two versions of
Speaker 1: your hashed password, they're still going to be different from
Speaker 1: each other. It's all going to be dependent upon the
Speaker 1: time you try to access the system. Now, the system
Speaker 1: itself it knows when you were accessing it, so it's
Speaker 1: able to do all of this decoding easily like that.
Speaker 1: There's no problem for the system, but it makes it
Speaker 1: difficult for a hacker to figure out what your password
Speaker 1: was based upon the hashed value that appears inside the system. Now,
Speaker 1: of course, hackers can bypass all that and try to
Speaker 1: hack a password using brute force. That's when someone and
Speaker 1: usually it's a computer program not a person these days,
Speaker 1: submits endless guesses into a password protected account in order
Speaker 1: to gain access. There's no need to work backward from
Speaker 1: hashed values. Using this approach, you're just guessing the root
Speaker 1: password from the get go. But it takes a lot
Speaker 1: of time, particularly if the user has created a strong password.
Speaker 1: So the longer and more complex a password, the less
Speaker 1: likely and traditional computer can hack it in a reasonable
Speaker 1: amount of time. Given enough time and enough computing power,
Speaker 1: any password can ultimately be cracked by brute force. But
Speaker 1: the more complex it is and the longer it is,
Speaker 1: the more time it requires to a point where it
Speaker 1: can approach time that last centuries, which means no one's
Speaker 1: going to bother to do it because they're not going
Speaker 1: to be around to actually see it work. Assuming you've
Speaker 1: picked a good strong password. That's why you should never
Speaker 1: use real words or even names as a password. They're
Speaker 1: too easy for a computer to guess using what's called
Speaker 1: a dictionary attack. So make sure you create those really
Speaker 1: strong passwords, and as always, I like to recommend using
Speaker 1: a password management program so that way you don't have
Speaker 1: to remember those strong passwords, because obviously the downside to
Speaker 1: creating a strong password is there difficult to remember. It's
Speaker 1: really easy to remember a word like tech stuff, but
Speaker 1: that's not very secure. Unfortunately, the more secure approach is
Speaker 1: also difficult to remember. And you don't want to just
Speaker 1: write stuff down someplace because that kind of defeats the
Speaker 1: purpose of having a secret password. Having a really good
Speaker 1: password management system and then just having to remember one
Speaker 1: good master password simplifies things. So I recommend that I've
Speaker 1: got a lot more to say about authentication strategy, but
Speaker 1: before I get into it, let's take a quick break
Speaker 1: to thank our sponsor. Okay, so I think we've covered
Speaker 1: passwords pretty thoroughly. Let's talk about some other authentication strategies.
Speaker 1: One of the earliest authentication systems in electronics was the
Speaker 1: personal identification number, or PEN. And technically, yeah, if you
Speaker 1: say PEN number, you're repeating yourself, just as if you
Speaker 1: were to say a t M machine. And I still
Speaker 1: do it just like a lot of people. If someone
Speaker 1: can realistically argue that irrespective is a word, I can
Speaker 1: argue pen number is acceptable. Dang it, so don't write me.
Speaker 1: The PEN debuted on the world scene in nineteen sixty seven.
Speaker 1: That's when Barclay's of London introduced the first a t
Speaker 1: M system, which a man named John Shepherd Barron invented
Speaker 1: Barkley's to come up with a method that kept customers
Speaker 1: finances safe. Otherwise, anyone might be able to access anyone
Speaker 1: else's money, and that does not make for a very
Speaker 1: positive banking experience. I mean it does for the person
Speaker 1: who makes off with all the cash, but for everybody
Speaker 1: else it's pretty negative. The solution was the PEN, which
Speaker 1: was a numeric code unique to the customer. The standard
Speaker 1: for pen management is actually called I s O nine
Speaker 1: five six four DASH one is DASH one. Technically, the
Speaker 1: standard allows for a spectrum of pen lengths. We're mostly
Speaker 1: used to four digits, but it doesn't have to just
Speaker 1: before you could go from four that's the minimum number
Speaker 1: of digits you can use, but you can use up
Speaker 1: to twelve digits. But we humans tend to have trouble
Speaker 1: remembering lots of unrelated numbers, and if you're choosing lots
Speaker 1: of related numbers, and that makes it pretty easy for
Speaker 1: people to guess your pen. So most A t M s,
Speaker 1: especially in the banking and finance industry, would require a
Speaker 1: pen of four digits in length, which dates back to
Speaker 1: the first A t M system. So why why were
Speaker 1: why was the number four picked in the very beginning?
Speaker 1: Why just four digits? Well, that's because John Shepherd Barron,
Speaker 1: who originally was going to use a six digit pen system,
Speaker 1: found his wife Caroline, had trouble remembering anything more than
Speaker 1: four digits, so he sensed that there could be a
Speaker 1: possible problem with longer pens and decided to stick with
Speaker 1: four digits instead of six. That's why we have that Now.
Speaker 1: Those early A t M s didn't accept plastic cards
Speaker 1: with a magnetic stripe on them the way modern ones do,
Speaker 1: and obviously the chip and pin system was decades away.
Speaker 1: So instead, what you would use as a check, you
Speaker 1: would actually insert a check into the machine, and each
Speaker 1: check had information encoded upon it that allowed the A
Speaker 1: t M to read the information on it, for example,
Speaker 1: how much money it represented and who it was supposed
Speaker 1: to go to. You would couple this with the proper
Speaker 1: pen and then the a t M could dispense cash
Speaker 1: at all hours of the day, which eliminated the need
Speaker 1: for people to make time to access the bank during
Speaker 1: bank hours, which we all know are the shortest hours
Speaker 1: in the world. If you'd like to learn more about
Speaker 1: a t t m s and how they work, be sure
Speaker 1: to check out the classic episode of tech Stuff called
Speaker 1: appropriately Enough, How a t M S Work. I republished
Speaker 1: it in February two fifteen, so you can listen to that,
Speaker 1: but it actually dates much further than that. Uh, this
Speaker 1: is really a blast from the past with some of
Speaker 1: the stuff in this episode. Now, another strategy is to
Speaker 1: use tokens. That's very popular for authentication strategies. There's several
Speaker 1: versions of these, including tokens that have a static code
Speaker 1: that acts like a key to a system's lock. Now,
Speaker 1: those are not terribly secure because if someone else gets
Speaker 1: hold of that token, they can pretty much get into
Speaker 1: the system. They represent kind of a single factor method
Speaker 1: of authentication on their own. For example, if you work
Speaker 1: in a building that requires you to tap a security
Speaker 1: card to a panel in order to unlock the door,
Speaker 1: that's a single factor approach, right, There's no other need
Speaker 1: to submit any other proof that you should have access.
Speaker 1: As long as you possess the security card, you can
Speaker 1: enter the building. It's just like having a physical key
Speaker 1: to a physical lock. Uh. You could pair that with
Speaker 1: another factor and then make the security stronger. Right, there
Speaker 1: could be some other additional information or element that you'd
Speaker 1: have to supply apart from just owning the card, and
Speaker 1: that would make it a two factor authentication approach, and
Speaker 1: that would make it a stronger secure system. Now, there
Speaker 1: are a lot of tokens that are used in two
Speaker 1: factor authentication, and one of the most common is a
Speaker 1: device with a small led screen that displays a string
Speaker 1: of seemingly random numbers when you activate it, and those
Speaker 1: seemingly random numbers change when you activate it over time.
Speaker 1: Let's say that you you to pull out this token
Speaker 1: in order to access a system. It's asking for this code.
Speaker 1: You press the little button, the numbers light up, and
Speaker 1: you type the numbers into the system and it gives
Speaker 1: you access. And then the next day you want to
Speaker 1: access it again, you pull up the token, you press
Speaker 1: a button, a totally different set of numbers shows up,
Speaker 1: you type those into the system, you get access to it.
Speaker 1: What the heck is going on how does that work?
Speaker 1: How does how does how does the token magically know
Speaker 1: what numbers to create? It's actually a pretty elegant system,
Speaker 1: as it turns out. I'll give an example of one
Speaker 1: way this can happen. It's not the only way, but
Speaker 1: it's a pretty common one. So in most of these devices,
Speaker 1: the token has a low power clock which is synchronized
Speaker 1: to the system that it is related to, and it
Speaker 1: also has a serial number associated with the specific token.
Speaker 1: The token uses those two values to generate what is
Speaker 1: called a p r n G value, and p r
Speaker 1: n G stands for pseudo random number generator and it
Speaker 1: means pretty much what sounds like. It can create a
Speaker 1: string of numbers that appears to be random, though ultimately
Speaker 1: those numbers are in fact determined by an ordered series
Speaker 1: of calculations. But you have to know what those calculations
Speaker 1: are and what the two different numbers were to start
Speaker 1: off with in order to get the pseudo random result.
Speaker 1: So when you're typing in the string of numerals into
Speaker 1: a system, the system runs the same pr n G
Speaker 1: operation using the same time stamp and the serial number
Speaker 1: for the token. Now, that obviously requires the system to
Speaker 1: quote unquote know what your tokens serial number is, So
Speaker 1: you have to have an official registered token, and if
Speaker 1: the system's results match the one that you typed in,
Speaker 1: you're authenticated. So typically these codes that you generate have
Speaker 1: a shelf life of a certain amount of time. Let's
Speaker 1: say it's thirty minutes. So you use the token and
Speaker 1: it takes the closest time at the thirty minute mark
Speaker 1: from when you push the button. So you push the
Speaker 1: button at two thirty five. It says to thirty and
Speaker 1: it runs the operation. It gives you some some numbers.
Speaker 1: You type it into the system. The system looks at
Speaker 1: it's clock. It says, oh, it's to thirty seven. Well,
Speaker 1: the closest half hour mark was too thirty, So I'll
Speaker 1: use that to start off with. I happen to know
Speaker 1: that the serial number for this particular token is such
Speaker 1: and such. I'll use that to perform the same number
Speaker 1: of operations and it should create the exact same result.
Speaker 1: If it doesn't create the same result, it means that
Speaker 1: you've somehow spanned over that time limit and you're gonna
Speaker 1: have to generate a new code and insert it again,
Speaker 1: or something has gone wrong, or you're just trying to
Speaker 1: access the system that you don't actually have a token for,
Speaker 1: which would be kind of foolish because you have to
Speaker 1: be incredibly lucky to just magically type in the right
Speaker 1: string of numbers in order to get access. Another great
Speaker 1: area to explore is biometrics. I love this field because
Speaker 1: when implemented properly, it's pretty difficult to replicate biometrics. That
Speaker 1: all has to do with our physical attributes, right, It's
Speaker 1: tough for bad guys to get into a system that
Speaker 1: are it happens to be based on our physical traits.
Speaker 1: We did an episode called Biometrics Digital Fingerprinting back in
Speaker 1: two thousand fourteen. But let me give you a quick
Speaker 1: rundown of the history of biometrics. First of all, fingerprints
Speaker 1: have long been used as a means of identification. Actually,
Speaker 1: centuries before the practice was officially adopted by law enforcement.
Speaker 1: On ancient business transactions, merchants and customers would sometimes use
Speaker 1: fingerprint marks in clay tablets as a kind of signature.
Speaker 1: It would identify the person who had purchased a good
Speaker 1: from someone else. It wouldn't be until the late eighteen
Speaker 1: hundreds the law enforcement jumped on the fingerprint bandwagon. Once
Speaker 1: the establishment accepted the fact that no two sets of
Speaker 1: fingerprints were alike, which was something that ancient people had
Speaker 1: known forever, but it just hadn't been accepted as a
Speaker 1: scientific fact for a very long time. A couple of
Speaker 1: people named as a Zul Hawk and Edward Henry created
Speaker 1: a system for indexing and classifying fingerprints for the purposes
Speaker 1: of criminal investigation. Now. They based that partly on a
Speaker 1: classification system that was developed by another man named Sir
Speaker 1: Francis Galton, but that system was more for academic purposes
Speaker 1: right to to describe fingerprints, whereas Henry wanted a system
Speaker 1: that could be used in investigations, legal investigations, criminal investigations.
Speaker 1: Mark Twain actually wrote a story in the eighteen nineties
Speaker 1: in which a character put on trial asks that his
Speaker 1: fingerprints be compared to some left at the scene of
Speaker 1: a crime in order to prove his innocence. In nineteen
Speaker 1: sixty three, the Hughes Research Laboratory published a research paper
Speaker 1: about fingerprint automation. The lab which is today known as
Speaker 1: hr L Laboratories, which I guess makes it another repetitive term,
Speaker 1: because I'm assuming HRL already stands for Hughes Research Laboratory,
Speaker 1: so the new name could be interpreted as Hughes Research
Speaker 1: Laboratory Laboratory. So stop bugging me about pen numbers, is
Speaker 1: what I'm saying. Anyway. It used to be the search
Speaker 1: and Development division of Hughes Aircraft. Today it's owned by
Speaker 1: Boeing in General Motors. But back in the nineteen sixties,
Speaker 1: the lab published a paper about automated fingerprint identification. It
Speaker 1: kind of acts as the foundation for fingerprints scanning today.
Speaker 1: It's basically automating a system that has been performed manually,
Speaker 1: which is where you take two sets of fingerprints. You
Speaker 1: have your reference set and you have your submitted set,
Speaker 1: and you want to compare those together and look for
Speaker 1: points of similar similarity. And if you have enough points
Speaker 1: of similarity, the likelihood of the fingerprints belonging to someone
Speaker 1: else drops to near zero. So it means someone who
Speaker 1: happens to have very similar fingerprints to the person in question,
Speaker 1: the reference happened to be in the same geographic region
Speaker 1: around the same time, and if there are enough sufficient
Speaker 1: points of similarity, this becomes increasingly unlikely. So while researchers
Speaker 1: worked on creating automated systems for fingerprint identification. Others were
Speaker 1: working on similar systems for facial recognition and voice identification strategies. Essentially,
Speaker 1: any aspect of a person that would be intrinsically unique
Speaker 1: to him or her was considered an interesting value to
Speaker 1: quantify and classify for good or for ill. In nine,
Speaker 1: the first commercial hand geometry systems launched. Dylan, you ever
Speaker 1: have to use a hand geometry system where it measures
Speaker 1: your hand? Dylan shaking his head. No, I did. I
Speaker 1: It was a regular part of the University of Georgia
Speaker 1: when I was there. So this is a scanner that
Speaker 1: looks at the hand, the shape of a person's hand,
Speaker 1: and compares it to a database and it authenticates the
Speaker 1: person based on hand geometry. So you have to set
Speaker 1: up your profile right you you scan your hand for
Speaker 1: the first time, and it associates your hand geometry with
Speaker 1: you the person. Every time you scan your hand later on,
Speaker 1: it goes and references that database and says, hey, does
Speaker 1: this match with the hand that we measured that first time,
Speaker 1: And if the answer was yes, it authenticated you. So
Speaker 1: my university's food hall had one of these. If you
Speaker 1: wanted to eat, you had to stick your hand in
Speaker 1: the machine. Uh. Kind of got a little bit sort
Speaker 1: of flash gordon esque. You know, you sit there wondering
Speaker 1: if you're gonna get your hand back after you put
Speaker 1: your hand in there. But I mean, if you want
Speaker 1: tater tots, you just had to do it, or in
Speaker 1: my case, chili cheese fries, which I ate way too frequently.
Speaker 1: I digress. In Partially funded by the FBI, researchers began
Speaker 1: to develop fingerprints scanners. Now. The first of those used
Speaker 1: capacity of detection, which wasn't terribly precise in the nineteen seventies.
Speaker 1: Most smartphones these days actually use this approach. Capacity of touch.
Speaker 1: Screens use that Essentially, touching the screen alters an electric
Speaker 1: field on the phone because we conduct electricity. It's a
Speaker 1: very weak electric field, but we conduct electricity. Touching a
Speaker 1: device that has an electric field running across the surface
Speaker 1: disrupts that electric field, and it actually allows a device
Speaker 1: to detect the presence and orientation of a touch, so
Speaker 1: it knows, you know, the X and y axis of
Speaker 1: where you are touching on a screen. That's why if
Speaker 1: you wear non capacitive gloves while trying to work an iPhone,
Speaker 1: nothing happens because it cannot hold that capacitance, So the
Speaker 1: screen isn't a resistive touch screen. It can't detect a
Speaker 1: touch unless that capacitance is there. Our capacitive aspect is there,
Speaker 1: rather not capacity inse Sorry about that misspoke. Well, speaking
Speaker 1: of the iPhone, the touch i D on the iPhone
Speaker 1: five S and later models actually uses capacitive touch to
Speaker 1: authenticate a fingerprint, just like this system did in nine
Speaker 1: except these days it's way more precise than the tech
Speaker 1: was capable of back in the seventies, so it's much
Speaker 1: less likely to give a either a false positive or
Speaker 1: to deny someone access to their phone. It may require
Speaker 1: you to scan a second time if you and get
Speaker 1: a good representation of your fingerprint when you were trying
Speaker 1: to unlock the phone, but it's not likely to deny
Speaker 1: you because it cannot identify your fingerprint now. In nineteen
Speaker 1: two doctors Erin Sepia and Leonard Flam proposed that I
Speaker 1: rides could be unique to a person. And you might say, well,
Speaker 1: what are I rides? Well, I ride is the plural
Speaker 1: for iris, so we're talking about the pigmented membranes surrounding
Speaker 1: the pupil in your eye. By six, these two ophthalmologists
Speaker 1: received a patent for their approach to use I rides
Speaker 1: for authentication and identification purposes. By the first IRIS identification
Speaker 1: security systems became part of the Defense Nuclear Agency. So
Speaker 1: all those spy movies where you see someone leaning forward
Speaker 1: and getting their eyes scanned, that's a real thing. Our
Speaker 1: irises or I rides, i should say, are unique to us,
Speaker 1: and so that is a pretty tricky thing to replicate.
Speaker 1: You probably have seen at least one or two movies
Speaker 1: where someone got hold of somebody's eyeball and got access
Speaker 1: that way, or knocked a person out then force their
Speaker 1: eye open and held their head up to the scanner.
Speaker 1: But in general not easy to replicate without access to
Speaker 1: somebody who already you know, is authorized to enter that area.
Speaker 1: Over the next several years, advances in biometrics opened up
Speaker 1: new opportunities, not just for authentication or security. So facial
Speaker 1: recognition is a great example. It's been incorporated into dozens
Speaker 1: of technologies, probably most notably into our cameras, including the
Speaker 1: cameras on our smartphones. And sometimes it's a simple implementation
Speaker 1: which just detects a face in order to focus properly
Speaker 1: on a subject. Uh, sometimes it's more complicated, so it
Speaker 1: might allow for automatic tagging of images because it can
Speaker 1: recognize people based on their facial features. You probably had
Speaker 1: some experience with this, and some capacity organizations also began
Speaker 1: to form around this time to create standards for biometric implementations.
Speaker 1: This would reduce the chance of competing technologies with varying
Speaker 1: degrees of efficiency and accuracy from interfering with each other,
Speaker 1: and by two thousand three, the US government began to
Speaker 1: formally coordinate biometric implementations. Meanwhile, the International Civil Aviation Organization
Speaker 1: created a global standard to incorporate biometric data into travel
Speaker 1: documentation like passports, and ten years later you could find
Speaker 1: biometric solutions built directly into personal electronics like laptops and smartphones.
Speaker 1: In fact, I had a fingerprint scanner from before, or
Speaker 1: you just you would actually have to slide your finger
Speaker 1: kind of like a copier against the little panel and
Speaker 1: if your fingerprint matched, it would unlock your computer for you.
Speaker 1: I actually had that one. Here at how stuff works.
Speaker 1: I miss it sometimes. Well. I got a lot more
Speaker 1: to say, but first let's take another quick break to
Speaker 1: think our sponsor. All right, things like fingerprint scanners are
Speaker 1: not foolproof. It is possible, although challenging, to lift a
Speaker 1: person's fingerprint from something they've handled, scan it, and replicate it.
Speaker 1: A couple of different ways to do this, Some of
Speaker 1: them require access to some equipment and materials most of
Speaker 1: us don't have in our homes, so it's not like
Speaker 1: it's practical for the average person. But the point is,
Speaker 1: with the right determination and the right know how, and
Speaker 1: specifically the right materials, you can create a fake fingerprint.
Speaker 1: And you might use something like latex or even wood glue,
Speaker 1: and you could lift a fingerprint and use it to
Speaker 1: fool certain authentication systems. If the system is just looking
Speaker 1: for a particular pattern on a fingerprint, the copy could
Speaker 1: be good enough to fool the system, particularly if you
Speaker 1: can overlay the copy on top of your own finger
Speaker 1: This would provide the capacity of connections. So in other words,
Speaker 1: let's say I've got a latex finger print and I
Speaker 1: need to access a phone. Well, if I just lay
Speaker 1: the latex down against the capacity screen, it's not really
Speaker 1: gonna affect anything. If I put an actual, living, living
Speaker 1: tissue behind it, that's a different story. So how do
Speaker 1: you defeat that sort of security vulnerability? Well, I had
Speaker 1: the opportunity to speak with Dr P, who is the
Speaker 1: Chief Technology officer of good X, to talk about a
Speaker 1: fingerprint scanner with an additional measure of of of security
Speaker 1: to counteract those sort of spoofing attempts. Here's what we
Speaker 1: talked about, Dr P. Let's start off by talking about
Speaker 1: how biometrics are transforming security in the technology field, specifically
Speaker 1: for things like consumer tech. Because my listeners are very
Speaker 1: interested in that, the concept of of using biometrics to
Speaker 1: access various devices. I think probably the example most of
Speaker 1: them would be familiar with it would be smartphones. Uh,
Speaker 1: can you talk a little bit about how that has
Speaker 1: developed over the last few years and and why it
Speaker 1: is such a a compelling component for security. Well, I
Speaker 1: think one of the story I actually met, which is
Speaker 1: a part of my experience too, is uh summing up
Speaker 1: really well, is the since the more and more phone
Speaker 1: has a fingerprint, uh said, more and more people using it.
Speaker 1: Is the one guy, an over friend of my agency,
Speaker 1: totally forgot the pass code now is using fingerprints on
Speaker 1: the phone all the time. And one of my point
Speaker 1: I don't use the officer also I forgot the pass
Speaker 1: code as well. So it is a kind of tells
Speaker 1: you the consumer behavior doesn't changed and so much. Yeah,
Speaker 1: they used to obviously everyone have a pass code, and
Speaker 1: nowadays they do, but they they don't use it anymore.
Speaker 1: They think of printing. That is certainly take over a
Speaker 1: majority of the authentication. And then the other thing was
Speaker 1: the in the case of like in China market where
Speaker 1: a lot of mobile payment. Now, if you were in China,
Speaker 1: you could literally live without It's like a critic, right,
Speaker 1: you can live without a cash but that you in China,
Speaker 1: you can live without critic car and the cash. You
Speaker 1: can use your phone and mobile payment literally do everything
Speaker 1: from convenience store to buying ticket to hotel payment everything.
Speaker 1: It's quite uh, but all that things obviously going through
Speaker 1: think of your in the authentication right, and so the
Speaker 1: authentication part is obviously really important. You want to make
Speaker 1: certain that the person who is utilizing a device, particularly
Speaker 1: one that can be used as a means of commerce,
Speaker 1: a means of purchase. You want to make sure that
Speaker 1: the the identity of the person holding the phone is
Speaker 1: in fact the person authorized to use that device for
Speaker 1: that purpose. And that kind of comes in with the
Speaker 1: the sensors that you've been working on in the recent
Speaker 1: past where it's not just looking for the pattern of
Speaker 1: a fingerprint, which, as some people have pointed out, is
Speaker 1: something that is uh possible to spoof. If you go
Speaker 1: and you have the right scanners and you have the
Speaker 1: right you know, even three D printer technology, you could
Speaker 1: potentially create a fake fingerprint and access sensors that are
Speaker 1: only capable of detecting the fingerprint layout. You are working
Speaker 1: on technology that goes a step further than that. Can
Speaker 1: you talk about that a little bit? Yes? Uh, yeah,
Speaker 1: this is the one technology we recently released to the market.
Speaker 1: Is uh. You at the same time when you scan
Speaker 1: recording as snit is a thinker frame pattern, you're also
Speaker 1: detecting the dynamic bluff flow in your fingerchieps. So that
Speaker 1: enabled the sensor tells this thinker print pattern is from
Speaker 1: a a life person versus h a mark up spoof.
Speaker 1: So that further enhanced the security level of thinkerprint authentication
Speaker 1: because the most of the spoof measure we know obviously
Speaker 1: is uh it's not a life object. So this basically
Speaker 1: enabled the security level one level up from so I
Speaker 1: think it will block out the most if not order
Speaker 1: protect show. Right, So people who would be you know,
Speaker 1: people who would normally rely on something like a a
Speaker 1: fake fingerprint made from say silicone or rubber. That wouldn't
Speaker 1: work on this particular type of device or this particular sensor,
Speaker 1: I should say that will be incorporated into other devices,
Speaker 1: whether it's a phone or a secure entry point or
Speaker 1: whatever it may be, because it will lack that blood flow,
Speaker 1: and without the blood flow, the the device quote unquote
Speaker 1: knows it is not a valid authentication. Am I getting
Speaker 1: that correct? Correct? Right? You're absolutely correct, wonderful. So let's
Speaker 1: talk a little bit about how this how this sensor
Speaker 1: actually does detect that blood flow. What are you using
Speaker 1: in order for the technology to to quote unquote know
Speaker 1: that blood is flowing behind that fingerprint? Yeah, so what
Speaker 1: we I think we're using this technology, uh injury the
Speaker 1: a obstacle sense in the same area as a finger
Speaker 1: train setor and so. And we also put in a
Speaker 1: small led emitter emitting an infrared light through the sentor
Speaker 1: glass cover, so that sending the light in to your fingerchip,
Speaker 1: and then the optical center detected the scatter line of
Speaker 1: your fingertip, so the blood blow itself well, changing the
Speaker 1: scatter lize the intensity. So this is a very common
Speaker 1: technique to use. Like in the hospital, they are pometer
Speaker 1: we use all the time. You know, it's you're in
Speaker 1: the hospital bed, the putout your fingertips. There's the same principle,
Speaker 1: except that in this case we just use it to
Speaker 1: detected the blood blows of a detecting the host. Give
Speaker 1: that right. So in some ways you could even argue
Speaker 1: this is this is a a simpler use of a
Speaker 1: technology that's been put to use specifically for those monitoring
Speaker 1: devices and hospitals where you know you need to have
Speaker 1: more specific information. It's not like your smartphone necessarily is
Speaker 1: going to tell you what the oxygen levels are in
Speaker 1: your blood, although I guess you could technically develop sensors
Speaker 1: that could do that. You're right. But on the other hand,
Speaker 1: obviously is that fontify everything I got? That boy is
Speaker 1: one level up? Right? You also need a longer time,
Speaker 1: you mean, not something average you that we're waiting to wait? Right,
Speaker 1: So why wait? We do providing a simple way to
Speaker 1: also provide a heartbeat the heart great on the it's
Speaker 1: a sensor, so user could just to leave the bigative
Speaker 1: on the sensor for you that kind as that will
Speaker 1: report the heart great. But there is a kind of
Speaker 1: side benefit of this technology, right, and so one potential
Speaker 1: application for being able to detect heart rate. Obviously you
Speaker 1: have medical applications, but you also have applications within the
Speaker 1: health and fitness sector where people might be using their
Speaker 1: smartphone while out on say a jog, and they want
Speaker 1: to make sure that they're keeping their heart rate within
Speaker 1: a specific target zone. That could be something that you
Speaker 1: would use that sort of sensor technology for beyond its
Speaker 1: authentication capabilities. So it's really interesting to me that we're
Speaker 1: looking at a technology that for a long time people
Speaker 1: thought of as sort of science fiction. You know, you
Speaker 1: saw you would see in movies that someone would put
Speaker 1: their finger down and get a scan and that would
Speaker 1: give them access to stuff. And now we're realizing that's
Speaker 1: convenient because you unless something terrible has happened, you always
Speaker 1: have your finger with you. But but as well as
Speaker 1: we've discussed, it's it's not full proof unless you have
Speaker 1: this second day dairy layer of protection and uh in
Speaker 1: this case, that detection of blood flow. Uh So what
Speaker 1: sort of devices might we see this incorporated into. I
Speaker 1: mean again, smartphones are are an obvious example. Are there
Speaker 1: others that uh that you either have your eye on
Speaker 1: or you could see as being a potential in the future. Yeah,
Speaker 1: the other uh we not the mobile device then you're
Speaker 1: looking at it maybe save the same for example, I
Speaker 1: people using UH code and see. But at the same
Speaker 1: time you could even in the codett could implement the
Speaker 1: press camera, right and so not only you use the code,
Speaker 1: you also on top of that you can use think
Speaker 1: of right now there over so that will add you know,
Speaker 1: actual layer of security. Yeah, and your your doors. So
Speaker 1: many times people you know now they're wireless, they control
Speaker 1: a door become more and more popular and you may
Speaker 1: enable a scan there for people to do that. There's
Speaker 1: a lot of us Like the car, right they the
Speaker 1: atom is the same way people steal your key today
Speaker 1: can just drive away with your car. But if you
Speaker 1: have one different scanner in the car or on the key,
Speaker 1: that will obviously they protect your car better. You can
Speaker 1: stock you can lose your key, but the people still
Speaker 1: kind of drive away with your car. So there's a
Speaker 1: way of using is the one benefit of the mobile
Speaker 1: application is uh it's really driving their cars and the
Speaker 1: side and the power way done imagine is a biting
Speaker 1: devisorshipping every year, so they scale the economy make it
Speaker 1: costs coming down so much so you enable all those
Speaker 1: other applications. Yeah, you hit upon something really interesting there,
Speaker 1: because we've seen that. We've seen the smartphone and cell
Speaker 1: phone technologies drive a lot of development in what you
Speaker 1: might think initially are unrelated technology simply because as you say,
Speaker 1: the economies of scale provide this this economic imperative. It's
Speaker 1: not even an incentive, it's an imperative to develop uh, smaller,
Speaker 1: more efficient, more economic sensors and other technologies. So, for example,
Speaker 1: beyond this fingerprint sensing technology that could be used in
Speaker 1: multiple applications, a lot of the development we've seen in
Speaker 1: the virtual reality space, in in just gaming in general,
Speaker 1: and a lot of technologies. The reason why it's possible
Speaker 1: is because the smartphone has acted as a platform that
Speaker 1: people have been developing for for years to increase, increase
Speaker 1: the number of features, increase its security, increase its applicability
Speaker 1: for lots of different uh possible uses, and we end
Speaker 1: up seeing that spill over into seemingly unrelated uses. And UH,
Speaker 1: I think that's a great story in general, just that
Speaker 1: it illustrates that work in one particular platform benefits in
Speaker 1: ways that you can't necessarily anticipate from the beginning. And uh,
Speaker 1: and certainly when it comes to things like authentication and security,
Speaker 1: you want to see those benefits being applied to a
Speaker 1: broader spectrum of uses because we're getting to a world.
Speaker 1: In fact, we're already there. We're in a world where
Speaker 1: more and more of our devices are interconnected in ways
Speaker 1: where if you are able to get unauthorized access to them,
Speaker 1: you could potentially cause a great deal of mischief and harm.
Speaker 1: Um So where do you see the future going? If
Speaker 1: you had to put on your prognosticator hat, what do
Speaker 1: you think the next big step in authentication is going
Speaker 1: to be? Well, are they already happening? The I R
Speaker 1: S scan on the phone? Right? That the same song
Speaker 1: as the donkey already there is also incremented, and I
Speaker 1: think it would become more goal popular. And they the
Speaker 1: next level of people already talking is a fingerprints scan
Speaker 1: and will getting into the display area as I think
Speaker 1: rumor is the d I phone may have this function.
Speaker 1: And uh, then I think you're going beyond. You're going
Speaker 1: to see more and more maybe medical reading, right because
Speaker 1: they the mobile device is so powerful and with us
Speaker 1: all the time, you can really use as a platform
Speaker 1: for monitoring your house because it's wheezy all the time.
Speaker 1: So we see a lot of those censor well happened,
Speaker 1: and so I think, I think that is uh, that's
Speaker 1: a kind of next a few years it we're going
Speaker 1: to be more and more those things to the interesting. Well, sir,
Speaker 1: thank you so much for joining our show and answering
Speaker 1: my questions. This has been a fascinating conversation, and I
Speaker 1: know that my listeners are always really interested to learn
Speaker 1: not just about how technology works, but but why those
Speaker 1: applications are so important. I think I think you've done
Speaker 1: a great job at doing that. So thank you very
Speaker 1: much for joining me today. My presure, thank you. As
Speaker 1: for the future, what if you could authenticate your identity
Speaker 1: just through thinking? Researchers over at Binghampton University developed a
Speaker 1: process in which they could identify or at least they
Speaker 1: claim they can identify a person based on their brain
Speaker 1: wave activity alone. So here's what they did. They took
Speaker 1: a sample of fifty people. It's not a big sample size,
Speaker 1: but it's interesting fifty people, fitted each person with an
Speaker 1: electro and cephalogram or e G headset. Then they showed
Speaker 1: each person a series of five images, and those images
Speaker 1: prompted various emotional and cognitive responses. Now, those responses are
Speaker 1: unique to each individual. So let's say that you and
Speaker 1: I are looking at the same photo, and just for
Speaker 1: argument's sake, it's a picture of my adorable dog, Tibolt,
Speaker 1: and both of us just think he's accused a little
Speaker 1: dog in the world because he is. I mean, come on, Well,
Speaker 1: the way your brain manifests that information and the way
Speaker 1: my brain manifests that information, even if we both feel
Speaker 1: the same way, is going to be different. So theoretically,
Speaker 1: once you record responses from people, these brain responses to
Speaker 1: these images, and assign each of those responses to the
Speaker 1: respective identity, you can authenticate a person's identity just by
Speaker 1: showing him or her the same series of images and
Speaker 1: looking for matches. If there's no match, then the person
Speaker 1: you're looking at isn't who you think they are, and
Speaker 1: they're likely a pod person. Maybe I should add that
Speaker 1: no one I know of is actually talking about using
Speaker 1: brain waves for authentication just yet. The study said that
Speaker 1: the researchers had a success rate identifying subjects based on
Speaker 1: brain waves, and it came out in so in other words,
Speaker 1: they put these fifty people through the test of recording
Speaker 1: all of these responses. Then I assume they used a
Speaker 1: blind method where somebody would end up looking at the
Speaker 1: responses that were coming in from an unknown subject and
Speaker 1: they would be able to match that person's responses to
Speaker 1: one that was already in the database, thus saying, Oh,
Speaker 1: that's Jill, because when Jelsey is a picture of tibaled,
Speaker 1: her heart grows three sizes that day. We've got to
Speaker 1: stop showing those pictures. She's having heart trouble. Trouble. It's terrible.
Speaker 1: Tile is just so cute. Anyway, I should add that. Uh. Also,
Speaker 1: if you wanted to use this as an authentication strategy,
Speaker 1: it would be pretty tricky because it requires an e
Speaker 1: G headset. It's not exactly the most convenient authentication technology
Speaker 1: around now. If we ever develop a less cumbersome method
Speaker 1: for measuring measuring brainwave activity with precision, that's important, that
Speaker 1: could become an authentication technology of the future. It's literally
Speaker 1: the way you think, and that would be much much
Speaker 1: more difficult, if not impossible, to replicate unless you had
Speaker 1: some sort of recording of a person's brain waves and
Speaker 1: you could somehow you know, push those out to cover
Speaker 1: up your own brainwave activity. I think I might have
Speaker 1: just written a science fiction novel accidentally. Anyway, that wraps
Speaker 1: it up for this episode. If you want to know
Speaker 1: more about authentication, or biometrics or anything else, really just
Speaker 1: check out how stuff works dot com. Our site is
Speaker 1: pretty awesome, you guys, and it can teach you pretty
Speaker 1: much how anything works. And if we don't have what
Speaker 1: you're looking for, you can actually let us know, and
Speaker 1: there's a good chance that someone will create a new
Speaker 1: writing assignment. It will go out to a writer, they
Speaker 1: will research it and they'll write it, and we'll create
Speaker 1: a new article and then you'll have your answer. Also,
Speaker 1: remember you can get in touch with me with any
Speaker 1: suggestions you might have for future episodes, guests I should
Speaker 1: have on the show, or really anything else. The email
Speaker 1: address for the show is tech stuff at how stuff
Speaker 1: works dot com, or you can drop me a line
Speaker 1: on Facebook or Twitter. The show's handle at both is
Speaker 1: tech Stuff H s W. And I'll talk to you
Speaker 1: again really soon. For more on this and thousands of
Speaker 1: other topics. Is it how stuff works dot com. Whe