Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey Thearon,
Speaker 1: Welcome to tech Stuff. I'm your host, Jonathan Strickland. I'm
Speaker 1: an executive producer with iHeartRadio. And how the tech are you? Well,
Speaker 1: it's time for another tech Stuff classic episode and this
Speaker 1: episode is titled Authentication, Tech and You. It originally published
Speaker 1: on February twenty second, twenty seventeen. Let's have a listen.
Speaker 1: I feel like security is becoming a bigger and bigger
Speaker 1: concern as it should be for a lot of people.
Speaker 1: People are more aware of it, I think than they
Speaker 1: were perhaps five years ago. Not everyone is practicing good
Speaker 1: security measures. Not everyone's practicing two factor authentication or multi
Speaker 1: factor authentication. We'll talk about that in this episode. And
Speaker 1: if you weren't familiar with what that's all about, That's
Speaker 1: why I'm wanted to do the show was to kind
Speaker 1: of explain what that actually means and why it is important.
Speaker 1: Authentication is something that we should probably define. First of all,
Speaker 1: it's the process or action of proving something to be true, genuine,
Speaker 1: or valid. So that covers a broad spectrum right authentication.
Speaker 1: You could be talking about authenticating a historical artifact. That's
Speaker 1: a great example, you bring a historical artifact to an expert,
Speaker 1: they authenticate that it is in fact a historical artifact
Speaker 1: and not something that was whipped up in some sort
Speaker 1: of souvenir shop and some out of the way place.
Speaker 1: But authentication has a very special role in the world
Speaker 1: of technology. In the world of computers and electronics, it
Speaker 1: gets a bit more specific. It's the process of verifying
Speaker 1: the identity of a user or a program or process.
Speaker 1: You want to make certain everything is authentic so that
Speaker 1: a program or person doesn't get unauthorized access to a system.
Speaker 1: So you're probably familiar with a lot of authentication processes,
Speaker 1: even if you didn't call them that, because you yourself
Speaker 1: have to employ them on a regular basis. Programs do too.
Speaker 1: But I'm not gonna really spend a lot of time
Speaker 1: talking about programs. In fact, I'm really not going to
Speaker 1: dive into it at all because that gets super technical,
Speaker 1: and really I think it's more important to focus on
Speaker 1: the stuff that you have a direct involvement with, unless,
Speaker 1: of course, you're a programmer, in which case Mia Kulpa.
Speaker 1: So I'm going to focus on authentication technology targeted at humans.
Speaker 1: So one day maybe I'll do a software one if
Speaker 1: there's a lot of requests for it. But I feel
Speaker 1: like that might just get a little too deep in
Speaker 1: the weeds. So I'm going to talk about the stuff
Speaker 1: you and I encounter when we try to access or
Speaker 1: protect our technology and our data. Now, there are a
Speaker 1: ton of different ways to do this. Some of them
Speaker 1: are inherently stronger methods of authentication than others and are
Speaker 1: better as far as being more secure, And all of
Speaker 1: these authentication strategies can be divided into three broad categories.
Speaker 1: Those categories are inherence factors, knowledge factors, and ownership factors.
Speaker 1: So when you hear about two factor authentication, we're talking
Speaker 1: about a specific strategy that employs different different approaches belonging
Speaker 1: to different factors. Now, that doesn't really mean anything unless
Speaker 1: I expand on it. So an inherence factor relies upon
Speaker 1: the user him or herself. In other words, it has
Speaker 1: something to do with you as a user. It has
Speaker 1: to do with either your physical traits or your behavioral traits.
Speaker 1: So a very easy to understand example of this would
Speaker 1: be a fingerprint scanner. Right, like your fingerprints are unique
Speaker 1: to you, It is something you have inherited, is inherent
Speaker 1: in who you are. So it's an inherence factor, But
Speaker 1: there are lots and lots of others, and I'll talk
Speaker 1: about some of those later on this episode. Knowledge factors
Speaker 1: are pretty self explanatory. Those are authentication strategies that rely
Speaker 1: on something that the user knows, like a password or
Speaker 1: a personal identification number otherwise known as a pen. Ownership
Speaker 1: factors are also pretty easy to understand. Those rely on
Speaker 1: something the user possesses, like a key card for security door.
Speaker 1: That would be an ownership factor. Now, on top of
Speaker 1: those categories, you have the additional strategies to enable authentication,
Speaker 1: which includes that two factor authentication that I talked about before.
Speaker 1: And maybe you don't know exactly what that means, well,
Speaker 1: that's why i'm here. Really, single factor authentication relies on
Speaker 1: just one component to access a system. So, for example,
Speaker 1: a lot of smartphones require users to unlock the device
Speaker 1: with a pin or a swipe pattern or a fingerprint scan.
Speaker 1: But that's it, right, You just have to do one
Speaker 1: of those things. You don't have to do multiple things,
Speaker 1: and once you do, whichever method you've enabled on your device,
Speaker 1: you have access to it. There's no secondary requirement. Systems
Speaker 1: that use single factor authentication are weaker than those that
Speaker 1: require more than one authentication strategy. In general, there are
Speaker 1: some different definitions for strong authentication I'll get into, and
Speaker 1: you could argue that some inherence factors are so strong
Speaker 1: as to be fine on their own, But in general,
Speaker 1: going with a single factor is less secure than going
Speaker 1: for a two factor authentication strategy, which is exactly what
Speaker 1: it sounds like. It requires two different authentication factors. That
Speaker 1: means the system will require users to provide authentication in
Speaker 1: two of those three categories. So an example of this
Speaker 1: is an ATM card. If you want to use an
Speaker 1: ATM card, you need to provide the card. That's an
Speaker 1: ownership factor. You have to be in possession of the card,
Speaker 1: and you have to supply the pen that's the knowledge factor.
Speaker 1: So you have an ownership factor and a knowledge factor.
Speaker 1: Those are two factors. That's two factor authentication. Possession of
Speaker 1: one factor should not be sufficient to access the respective system,
Speaker 1: nor should it lead to the discovery of the second factor.
Speaker 1: In other words, if you get hold of the card
Speaker 1: like you get hold of someone else's card, ideally there
Speaker 1: should be no indication on the card of what the
Speaker 1: pen is because you need both of those things in
Speaker 1: order to access someone's account, and if you make sure
Speaker 1: that only one of the two things is in possession
Speaker 1: of somebody else, they still can't get your stuff. So
Speaker 1: that's why you want the two factor authentication. You have
Speaker 1: to possess or know both of the authentication requirements independently
Speaker 1: of each other. This also applies to other factors as well.
Speaker 1: It doesn't just have to be knowledge and ownership. It
Speaker 1: could be ownership and inherence. It could be knowledge and inherence.
Speaker 1: You get the idea. So, if you've enabled two factor
Speaker 1: authentication on various online accounts, which I urge you to
Speaker 1: do for any accounts that actually offer it, you've likely
Speaker 1: had to supply a password as well as a code
Speaker 1: sent to you in some way. For example, you might
Speaker 1: have an email account that when you try and access
Speaker 1: it using a brand new device, says, all right, well
Speaker 1: what's your password? So you typed a little password in
Speaker 1: and then says all right, well, now I'm going to
Speaker 1: send you a code via text message. You need to
Speaker 1: put that code into this little box here, and then
Speaker 1: I'll give you access to your email. So the past
Speaker 1: this word part taps into that knowledge factor because you
Speaker 1: know the password and the text message taps into the
Speaker 1: ownership factor because there's a specific cell phone with a
Speaker 1: specific cell phone number associated with your email account, so
Speaker 1: you have to be an ownership of the cell phone
Speaker 1: in order to receive the text message and complete that
Speaker 1: authentication strategy. Many two factor authentication systems will actually allow
Speaker 1: you to designate specific devices as being safe quote unquote safe,
Speaker 1: meaning that you don't have to do that every single
Speaker 1: time you log in from that specific device. That way,
Speaker 1: you don't end up waiting for a text message every
Speaker 1: time you try and check your email from your personal laptop, computer,
Speaker 1: or smartphone. Now, there are systems that require even more
Speaker 1: forms of authentication, and we typically group these under the
Speaker 1: category multi factor authentication, indicating you've got to supply at
Speaker 1: least two methods in order to access the respective system.
Speaker 1: So technically, two factor authentication is a type of multi
Speaker 1: factor authentication. Most of the time, when I encounter it,
Speaker 1: multi factor is being used to mean more than two.
Speaker 1: I haven't personally ever encountered a system where I've had
Speaker 1: to supply more than two factors. But then again, no
Speaker 1: one trusts me with anything that's that important, so no
Speaker 1: big surprise there. Now, confusing matters somewhat. Is this term
Speaker 1: called strong authentication, which is used in a lot of
Speaker 1: different places, including the European Union. In fact, it's very
Speaker 1: prominently used in the EU. At first glance, you might
Speaker 1: think strong authentication and two factor or multi factor authentication
Speaker 1: are synonymous, that in order for it to be strong,
Speaker 1: it must be at least two factor authentication, But that's
Speaker 1: not actually the case. If a single authentication strategy is
Speaker 1: deemed secure enough, it can fall under the category of
Speaker 1: strong authentication. And so there's a lot of disagreement over
Speaker 1: what the actual definition is. It makes it pretty confusing.
Speaker 1: But let's give you an example. Let's say that there's
Speaker 1: a retinal scanner that scans the pattern of blood vessels
Speaker 1: in your eye. Now that's really difficult to replicate compared
Speaker 1: to other biometric measures such as a fingerprint, which you could,
Speaker 1: in fact, if you're very clever fake. So in the
Speaker 1: European Union, a system that looks at the blood vessels
Speaker 1: in your eye for authentication might be considered strong even
Speaker 1: though it's just a single factor. Let's say you don't
Speaker 1: have to provide any other information, it's just a quick
Speaker 1: scan of the eye and you're in If the system
Speaker 1: is robust enough, and if it's looking at something that
Speaker 1: is difficult enough to replicate, it could still count as
Speaker 1: strong authentication. It could even refer to knowledge based factors.
Speaker 1: So let's say a system requires you to answer a
Speaker 1: series of unrelated questions when you set up your account.
Speaker 1: Accessing the account at a later time requires that you
Speaker 1: replicate those answers. You've got to remember how you answered
Speaker 1: the questions when you first set it up. It's kind
Speaker 1: of like the security questions a lot of different systems
Speaker 1: use right now. Now, because these questions are unrelated and
Speaker 1: knowledge of one answer doesn't provide any of the other answers,
Speaker 1: that could be considered strong authentication. Now, personally, I find
Speaker 1: that method to be a little on the flimsy side,
Speaker 1: but I'm not the one making definitions. I'm just reporting
Speaker 1: them to you guys. Now we've got the basic definitions
Speaker 1: out of the way, let's dive into a bit of history,
Speaker 1: because you guys know, I love to talk about the
Speaker 1: history of the various technologies and processes we've developed over
Speaker 1: the years. So the concept of authentication is ancient. It
Speaker 1: predates electronics by centuries. Throughout the years, people would have
Speaker 1: to provide some sort of proof of their identities. It
Speaker 1: might require someone else to vouchsay for a person, or
Speaker 1: it might require a special seal belonging to a particular
Speaker 1: office or noble house, placed upon an official document. You
Speaker 1: may have heard that a lot of those documents would
Speaker 1: be sealed with wax, and then someone would use a
Speaker 1: signet ring in order to put a specific stamp in
Speaker 1: that wax. That was considered a form of authentication. If
Speaker 1: you saw the proper symbol, then presumably it came from
Speaker 1: the proper place. Not that you couldn't create a fake
Speaker 1: of that if you really wanted to, but you know
Speaker 1: that was the idea. Or you might even just have
Speaker 1: a password shared between a small group of people. So
Speaker 1: as long as there have been secrets, there have been
Speaker 1: means to identify those who should and should not have
Speaker 1: access to those secrets. And secrets predate the written word.
Speaker 1: But let's talk about passwords and authentication and electronics, because honestly,
Speaker 1: if I did a full episode about the history of passwords,
Speaker 1: that would not really be tech stuff. That would be
Speaker 1: an awesome, awesome episode of stuff they don't want you
Speaker 1: to know. Hint, hint. So computer passwords actually pre date
Speaker 1: personal computers. Back in nineteen sixty one, MIT created a
Speaker 1: password system for authorized access to its Compatible Time Sharing
Speaker 1: System or CTSS. CTSS allowed multiple users to access the
Speaker 1: same computational core. So imagine that you are in a
Speaker 1: room and it's filled. There's like lots of tables everywhere,
Speaker 1: and every table has a couple different workstations. Every workstation
Speaker 1: has a screen and a keyboard, but not a computer.
Speaker 1: They just have the keyboard in the screen, which are
Speaker 1: connected via cables to a single computer. Everyone is sharing
Speaker 1: the exact same computer. Well, way back in the day,
Speaker 1: that's how a lot of computer systems were made. They
Speaker 1: didn't have personal devices at every station. The stations were
Speaker 1: just dummy terminals that connected to a core system. Also,
Speaker 1: in those days, time sharing meant that the computer actually
Speaker 1: would divvy up when it was specifically available to do
Speaker 1: your calculation. So let's say you're typing in something, you're
Speaker 1: programming some code, and you send it to the computer.
Speaker 1: It would be responding to each station in turn, and
Speaker 1: it's doing it so fast that it feels almost instantaneous,
Speaker 1: or close enough to it, but in fact it would
Speaker 1: be responding in sequence. As people had logged into the
Speaker 1: various terminals now obviously using the same computer for all
Speaker 1: these dummy terminals create some challenges. How can each individual
Speaker 1: user maintain control over his or her data? How do
Speaker 1: they maintain their own private files? Because every user had
Speaker 1: a set of private files that other users should not
Speaker 1: be able to access without authorization. I mean, one person
Speaker 1: might be working on a project, someone else is working
Speaker 1: on a totally different project. You don't want those files
Speaker 1: to intermingle. You had to partition that stuff. So without
Speaker 1: a password, you really couldn't do that. So if everyone
Speaker 1: using a core machine as the processor in storage unit,
Speaker 1: you had to create some means of differentiating one user
Speaker 1: from another. The solution was the password, So every user
Speaker 1: would get a unique password to enter into the system,
Speaker 1: which would then allow that user to create and access
Speaker 1: private files. And it also helped control the amount of
Speaker 1: time any individual user had with the machine. Because these
Speaker 1: machines they were rare. There were only a few of
Speaker 1: them in nineteen sixty one, so the time on those
Speaker 1: machines was very valuable. You know, people were hoarding time.
Speaker 1: They were trying to do their best. You know, you
Speaker 1: might only get a few hours a week, so they
Speaker 1: would end up parsioning that out through passwords. It was
Speaker 1: kind of like a controlled ticket system so that a
Speaker 1: ride doesn't get overwhelmed with a ton of people. You
Speaker 1: release a certain number of tickets per hour and you
Speaker 1: keep the traffic flowing steadily. Same sort of thing, except
Speaker 1: in this case it was with a computer access so
Speaker 1: as a way to control the point of entry into
Speaker 1: the system. We're going to take a quick break from
Speaker 1: talking about authentication tech to thank our sponsors. Now, at
Speaker 1: that time, the passwords were pretty simple, and they were
Speaker 1: not really secure at all. It was more for the
Speaker 1: matter of convenience than security really. After all, this predated
Speaker 1: the Internet, so external access to the system wasn't really
Speaker 1: a factor. If you wanted to get your hands on
Speaker 1: those sweet, sweet private files, you actually needed to have
Speaker 1: physical access to the system itself. You couldn't just hack
Speaker 1: in from across the country. So in a way, that's
Speaker 1: one factor of authentication all by itself. Ownership in this case,
Speaker 1: the ownership doesn't really refer to something that you personally owned,
Speaker 1: but rather your physical access to the system. But these
Speaker 1: weren't encrypted or stored in a particularly safe way. They
Speaker 1: were in plain text. So just a year after they
Speaker 1: debuted this password strategy, a graduate student named Alan Scherer
Speaker 1: accessed the entire list of unencrypted passwords stored on the
Speaker 1: system and printed them out. Now, the reason Shared did
Speaker 1: this was not to access private files created by other people.
Speaker 1: It was so that Share could get more time on
Speaker 1: the system because every student was allotted just four hours
Speaker 1: of access per week, and he needed more access, and
Speaker 1: he figured, well, there's all these other hours of access
Speaker 1: that are going unused from other students. That's not fair.
Speaker 1: I'll just take their hours and use them myself. The
Speaker 1: way he did this was he actually created a punch
Speaker 1: card that contained the file name and location for the
Speaker 1: password list, and it also contained a set of instructions
Speaker 1: that said take this file and send it to a printer.
Speaker 1: Didn't even have to physically look at this file at all.
Speaker 1: He just had to figure out what was the file name,
Speaker 1: where was it located on the system, and then include
Speaker 1: the instructions send to printer. By the way, if you
Speaker 1: want to know more about how punch cards work and
Speaker 1: the way that they were an integral part of early computing,
Speaker 1: you can actually listen to a classic two thousand and
Speaker 1: nine Tech Stuff episode titled Computers from the past, and
Speaker 1: Chris Palette and I talked a lot about them in
Speaker 1: that episode. So it's easy in hindsight to criticize the
Speaker 1: MIT strategy. But keep in mind this was at a
Speaker 1: time when unauthorized access to computers was exceedingly rare, because well,
Speaker 1: the computers were exceedingly rare. As computers began to proliferate
Speaker 1: throughout all areas of life, the need for more secure
Speaker 1: access strategies grew. According to Roger Needham, who was a
Speaker 1: professor of computing at Cambridge University, the Cambridge Lab came
Speaker 1: up with a concept to make passwords more secure, and
Speaker 1: that's the concept of hashing. Now, that's when you convert
Speaker 1: passwords of variable lengths into a fixed length string of
Speaker 1: characters using an algorithm for the transformation. It's a fancy
Speaker 1: way of saying, no matter how long or short a
Speaker 1: password is, you put it through a series of mathematical processes.
Speaker 1: Will you convert the password into numerals first? Then you
Speaker 1: do this series of mathematic processes, the result of which
Speaker 1: is you get a much longer string of characters and
Speaker 1: that represents the password. And it doesn't matter how long
Speaker 1: or short the original password was. All of the hashed
Speaker 1: versions of the password are the same length. So let's
Speaker 1: say the hash is eighty characters long. That means if
Speaker 1: your base password is pass or its anti disestablishmentarianism or
Speaker 1: anything else, it will end up converted into a string
Speaker 1: of eighty characters. So if someone gets hold of the
Speaker 1: hashed passwords, those are the only ones that are being
Speaker 1: stored on the system, they would still have to figure
Speaker 1: out what was the mechanism used to generate the hashes
Speaker 1: in order to guess what the root password was, because
Speaker 1: otherwise they're all going to look like they're eighty characters long.
Speaker 1: You won't know which ones were short passwords or long passwords.
Speaker 1: In order to do that, obviously, you have to decide
Speaker 1: upon what the specific sequence of mathematical operations are going
Speaker 1: to be and what seed you're using for those operations.
Speaker 1: And once you do that, then you're able to make
Speaker 1: these kind of changes. So Needham said that the system
Speaker 1: was created and implemented in the mid to late nineteen sixties,
Speaker 1: so it wasn't very long after the MIT rollout of passwords.
Speaker 1: Now later, still, computer scientists began to develop more secure
Speaker 1: hashing strategies. This includes salting passwords, which means adding characters
Speaker 1: to a password before you hash it. So a simple
Speaker 1: example of this is using a computer's claw to insert
Speaker 1: digits into the password and then hashing the new password,
Speaker 1: which makes it even harder for a hacker to figure
Speaker 1: out the root password from the hash because they need
Speaker 1: to know at what time that operation was performed on
Speaker 1: the original password, otherwise they wouldn't be able to replicate
Speaker 1: the original password. Now, this is easier to understand if
Speaker 1: I give you an example. So let's say your password
Speaker 1: has been set to let's say tech stuff. You chose
Speaker 1: tech stuff as your password. First of all, that was dumb.
Speaker 1: Don't do that. Don't pick a word that's easy to guess,
Speaker 1: even if it's a name like tech stuff, which is
Speaker 1: granted an awesome show. But you've chosen tech stuff for
Speaker 1: this example. You access the system at two thirty five
Speaker 1: in the afternoon. Let's say that the computer converts that
Speaker 1: into military time, so that gives you fourteen thirty five,
Speaker 1: and then it salts your password with those numbers, so
Speaker 1: instead of it just saying text stuff, now it says
Speaker 1: T one E four C three H five stuff. That
Speaker 1: password then gets hashed into that eighty character long version
Speaker 1: stored on the computers. By the way, that eighty characters
Speaker 1: is just an arbitrary example. It doesn't really mean anything.
Speaker 1: I just need a number for the example. Now, let's
Speaker 1: say you access the same system the following day, but
Speaker 1: this time it's one twenty three in the afternoon. Remember
Speaker 1: it was two thirty five the day before, but now
Speaker 1: it's one twenty three the next day. The salted password
Speaker 1: is going to be different because it's going to convert
Speaker 1: one to twenty three to military time, and then it's
Speaker 1: going to salt the password that way, so it would
Speaker 1: be T one E three C two H three stuff.
Speaker 1: The hashed value will end up being different as well,
Speaker 1: because it's inserted those new numbers. So that means that
Speaker 1: if the hacker gets two versions of your hashed password,
Speaker 1: they're still going to be different from each other. It's
Speaker 1: all going to be dependent upon the time you tried
Speaker 1: to access the system. Now itself, it knows when you
Speaker 1: were accessing it, so it's able to do all of
Speaker 1: this decoding easily. There's no problem for the system, but
Speaker 1: it makes it difficult for a hacker to figure out
Speaker 1: what your password was based upon the hashed value that
Speaker 1: appears inside the system. Now, of course, hackers can bypass
Speaker 1: all that and try to hack a password using brute force.
Speaker 1: That's when someone and usually it's a computer program not
Speaker 1: a person these days, submits endless guesses into a password
Speaker 1: protected account in order to gain access. There's no need
Speaker 1: to work backward from hashed values. Using this approach, you're
Speaker 1: just guessing the root password from the get go. But
Speaker 1: it takes a lot of time, particularly if the user
Speaker 1: has created a strong password. So the longer and more
Speaker 1: complex a password, the less likely a traditional computer can
Speaker 1: hack it in a reasonable amount of time. Given enough
Speaker 1: time and enough computing power, any password and ultimately be
Speaker 1: cracked by brute force. But the more complex it is
Speaker 1: and the longer it is, the more time it requires
Speaker 1: to a point where it can approach time that last centuries,
Speaker 1: which means no one's going to bother to do it
Speaker 1: because they're not going to be around to actually see
Speaker 1: it work. Assuming you've picked a good strong password, So
Speaker 1: why you should never use real words or even names
Speaker 1: as a password. They're too easy for a computer to
Speaker 1: guess using what's called a dictionary attack, So make sure
Speaker 1: you create those really strong passwords and as always, I
Speaker 1: like to recommend using a password management program so that
Speaker 1: way you don't have to remember those strong passwords, because
Speaker 1: obviously the downside to creating a strong password is they're
Speaker 1: difficult to remember. It's really easy to remember a word
Speaker 1: like tech stuff, but that's not very secure. Unfortunately, the
Speaker 1: more secure approach is also difficult to remember, and you
Speaker 1: don't want to just write stuff down someplace because that
Speaker 1: kind of defeats the purpose of having a secret password.
Speaker 1: Having a really good password management system and then just
Speaker 1: having to remember one good master password simplifies things. So
Speaker 1: I recommend that. Well, I've got a lot more to
Speaker 1: say about authentication strategies, but before I get into it,
Speaker 1: let's take a quick break to thank our sponsor. Okay,
Speaker 1: so I think we've covered passwords pretty thoroughly. Let's talk
Speaker 1: about some other authentication strategies. One of the earliest authentication
Speaker 1: systems and electronics was the personal identification number, or PEN.
Speaker 1: And technically, yeah, if you say PEN number, you're repeating yourself,
Speaker 1: just as if you were to say ATM machine. And
Speaker 1: I still do it just like a lot of people.
Speaker 1: If someone can realistically argue that irrespective is a word,
Speaker 1: I can argue pen number is acceptable, dang it, so
Speaker 1: don't write me. The PEN debuted on the world scene
Speaker 1: in nineteen sixty seven. That's when Barclays of London introduced
Speaker 1: the first ATM system, which a man named John Shepherd
Speaker 1: barn invented Barclays to come up with a method that
Speaker 1: kept customer's finances safe. Otherwise, anyone might be able to
Speaker 1: access anyone else's money, and that does not make for
Speaker 1: a very positive banking experience. I mean it does for
Speaker 1: the person who makes off with all the cash, but
Speaker 1: for everybody else it's pretty negative. The solution was the PEN,
Speaker 1: which was a numeric code unique to the customer. The
Speaker 1: standard for pen management is actually called ISSO nine five
Speaker 1: six y four dash one ISO ninety five sixty four
Speaker 1: dash one. Technically, this standard allows for a spectrum of
Speaker 1: pen lengths. We're mostly used to four digits, but it
Speaker 1: doesn't have to just before you could go from four
Speaker 1: that's the minimum number of digits you can use, but
Speaker 1: you can use up to twelve digits. But we humans
Speaker 1: tend to have trouble remembering lots of unrelated numbers, and
Speaker 1: if you're choosing lots of related numbers, then that makes
Speaker 1: it pretty easy for people to guess your pin. So
Speaker 1: most ATMs, especially in the banking and finance industry, would
Speaker 1: require a pin of four digits in length, which dates
Speaker 1: back to the first ATM system. So why was the
Speaker 1: number four picked in the very beginning? Why just four digits? Well,
Speaker 1: that's because John Shepherd Barren, who originally was going to
Speaker 1: use a six digit pen system, found his wife Caroline,
Speaker 1: had trouble remembering anything more than four digits, so he
Speaker 1: sensed that there could be a possible problem with longer
Speaker 1: pins and decided to stick with four digits instead of six.
Speaker 1: That's why we have that now. Those early ATMs didn't
Speaker 1: accept plastic cards with a magnetic stripe on them the
Speaker 1: way modern ones do, and obviously the chip and pin
Speaker 1: system was decades away. So instead, what you would use
Speaker 1: as a check you would actually insert a check into
Speaker 1: the machine, and each check had information encoded upon it
Speaker 1: that allowed the ATM to read the information on it,
Speaker 1: for example, how much money it represented and who it
Speaker 1: was supposed to go to. You would couple this with
Speaker 1: the proper pen, and then the ATM could dispense cash
Speaker 1: at all hours of the day, which eliminated the need
Speaker 1: for people to make time to access the bank during
Speaker 1: bank hours, which we all know are the shortest hours
Speaker 1: in the world. If you'd like to learn more about
Speaker 1: ATMs and how they work, be sure to check out
Speaker 1: the classic episode of tech stuff called appropriately Enough How
Speaker 1: ATMs Work. I republished it in February twenty fifteen, so
Speaker 1: you can listen to that, but it actually dates much
Speaker 1: further than that. This is really a blast from the
Speaker 1: past with some of the stuff in this episode. Now,
Speaker 1: another strategy is to use tokens. That's very popular for
Speaker 1: authentication strategies. There's several versions of these, including tokens that
Speaker 1: have a static code that acts like a key to
Speaker 1: a system's line. Now, those are not terribly secure because
Speaker 1: if someone else gets hold of that token, they can
Speaker 1: pretty much get into the system. They represent kind of
Speaker 1: a single factor method of authentication on their own. For example,
Speaker 1: if you work in a building that requires you to
Speaker 1: tap a security card to a panel in order to
Speaker 1: unlock the door, that's a single factor approach, right. There's
Speaker 1: no other need to submit any other proof that you
Speaker 1: should have access. As long as you possess the security card,
Speaker 1: you can enter the building. It's just like having a
Speaker 1: physical key to a physical lock, you could pair that
Speaker 1: with another factor and then make the security stronger. Right,
Speaker 1: there could be some other additional information or element that
Speaker 1: you'd have to supply apart from just owning the card,
Speaker 1: and that would make it a two factor authentication approach,
Speaker 1: and that would make it a stronger secure system. Now,
Speaker 1: there are a lot of tokens that are used in
Speaker 1: two factor authentication, and one of the most common is
Speaker 1: a device with a small led screen that displays a
Speaker 1: string of seemingly random numbers when you activate it, and
Speaker 1: those seemingly random numbers change when you activate it over time.
Speaker 1: Let's say that you pull out this token in order
Speaker 1: to access a system it's asking for this code. You
Speaker 1: press a little button, the numbers light up, and you
Speaker 1: type the numbers into the system and it gives you access.
Speaker 1: And then the next day you want to access it again,
Speaker 1: you pull up the token, you press a button, a
Speaker 1: totally different set of numbers shows up, you type those
Speaker 1: into the system, you get access to it. What the
Speaker 1: heck is going on? How does that work? How does
Speaker 1: how does the token magically know what numbers to create?
Speaker 1: It's actually a pretty elegant system as it turns out.
Speaker 1: I'll give an example of one way this can happen.
Speaker 1: It's not the only way, but it's a pretty common one.
Speaker 1: So in most of these devices, the token has a
Speaker 1: low power clock which is synchronized to the system that
Speaker 1: it is related to, and it also has a serial
Speaker 1: number associated with the specific token. The token uses those
Speaker 1: two values to generate what is called a pr NG value,
Speaker 1: and pr NG stands for pseudo random number generator and
Speaker 1: it means pretty much what sounds like. It can create
Speaker 1: a string of numbers that appears to be random, though
Speaker 1: ultimately those numbers are in fact determined by an ordered
Speaker 1: series of calculations. But you have to know what those
Speaker 1: calculations are and what the two different numbers were to
Speaker 1: start off with in order to get the pseudorandom result.
Speaker 1: So when you're typing in the string of numerals into
Speaker 1: a system, the system runs the same pr NG operation
Speaker 1: using the same time stamp and the serial number for
Speaker 1: the token. Now, that obviously requires the system to quote unquote,
Speaker 1: know what your token's serial number is, so you have
Speaker 1: to have an official registered token, and if the system's
Speaker 1: results match the one that you typed in, you're authenticated.
Speaker 1: So typically these codes that you generate have a shelf
Speaker 1: life of a certain amount of time. Let's say it's
Speaker 1: thirty minutes. So you use the token, and it takes
Speaker 1: the closest time at the thirty minute mark from when
Speaker 1: you push the button. So you push the button at
Speaker 1: two thirty five. It says two thirty, and it runs
Speaker 1: the operation. It gives you some numbers. You type it
Speaker 1: into the system. The system looks at its clock. It says, oh,
Speaker 1: it's two thirty seven. Well, the closest half hour mark
Speaker 1: was two thirty, so I'll use that to start off with.
Speaker 1: I happen to know that the serial number for this
Speaker 1: particular token is such and such. I'll use that to
Speaker 1: perform the same number of operations, and it should create
Speaker 1: the exact same result. If it doesn't create the same result,
Speaker 1: it means that you've somehow spanned over that time limit
Speaker 1: and you're going to have to generate a new code
Speaker 1: and insert it again, or something has gone wrong, or
Speaker 1: you're just trying to access the system that you don't
Speaker 1: actually have a token for, which would be kind of
Speaker 1: foolish because you'd have to be incredibly lucky to just
Speaker 1: magically type in the right string of numbers in order
Speaker 1: to get access. Another great area to explore is biometrics.
Speaker 1: I love this field because, when implemented properly, it's pretty
Speaker 1: difficult to replicate biometrics. That all has to do with
Speaker 1: our physical attributes, right, It's tough for bad guys to
Speaker 1: get into a system that happens to be based on
Speaker 1: our physical traits. We did an episode called Biometrics Digital
Speaker 1: Fingerprinting back in twenty fourteen. But let me give you
Speaker 1: a quick rundown of the history of biometrics. First of all,
Speaker 1: fingerprints have long been used as a means of identification.
Speaker 1: Actually centuries before the practice was officially adopted by law enforcement.
Speaker 1: On ancient business transactions, merchants and customers would sometimes use
Speaker 1: fingerprint marks in clay tablets as a kind of signature.
Speaker 1: It would identify the person who had purchased a good
Speaker 1: from someone else. It wouldn't be until the late eighteen
Speaker 1: hundreds the law enforcement jumped on the fingerprint bandwagon once
Speaker 1: the establishment accepted the fact that no two sets of
Speaker 1: fingerprints were alike, which was It's something that ancient people
Speaker 1: had known for ever, but it just hadn't been accepted
Speaker 1: as a scientific fact for a very long time. A
Speaker 1: couple of people named Azizul Hawk and Edward Henry created
Speaker 1: a system for indexing and classifying fingerprints for the purposes
Speaker 1: of criminal investigation. Now. They based that partly on a
Speaker 1: classification system that was developed by another man named Sir
Speaker 1: Francis Galton, but that system was more for academic purposes
Speaker 1: right to describe fingerprints, whereas Henry wanted a system that
Speaker 1: could be used in investigations, legal investigations, criminal investigations. Mark
Speaker 1: Twain actually wrote a story in the eighteen nineties in
Speaker 1: which a character put on trial asks that his fingerprints
Speaker 1: be compared to some left at the scene of a
Speaker 1: crime in order to prove his innocence. In nineteen sixty three,
Speaker 1: the Hughes Research Laboratory published a research paper about fingerprint automation.
Speaker 1: The lab which is today known as HRL Laboratories, which
Speaker 1: I guess makes it another repetitive term, because I'm assuming
Speaker 1: HRL already stands for Hughes Research Laboratory, so the new
Speaker 1: name could be interpreted as Hughes Research Laboratory Laboratory. So
Speaker 1: stop bugging me about pen numbers, is what I'm saying. Anyway,
Speaker 1: It used to be the research and development division of
Speaker 1: Hughes Aircraft. Today it's owned by Boeing in General Motors.
Speaker 1: But back in the nineteen sixties, the Lab published a
Speaker 1: paper about automated fingerprint identification. It kind of acts as
Speaker 1: the foundation for fingerprints scanning today. It's basically automating a
Speaker 1: system that has been performed manually, which is where you
Speaker 1: take two sets of fingerprints. You have your reference set
Speaker 1: and you have your submitted set, and you want to
Speaker 1: compare those together and look for points of similarity. And
Speaker 1: if you have enough points of similarity, the likelihood of
Speaker 1: the fingerprints belonging to someone else drops to near zero.
Speaker 1: So it means someone who happens to have very similar
Speaker 1: fingerprints to the person in question, the reference happened to
Speaker 1: be in the same geographic region around the same time,
Speaker 1: and if there are enough sufficient points of similarity, this
Speaker 1: becomes increasingly unlikely. So while researchers worked on creating automated
Speaker 1: systems for fingerprint identification, others were working on similar systems
Speaker 1: for facial recognition and voice identification strategies. Essentially, any aspect
Speaker 1: of a person that would be intrinsically unique to him
Speaker 1: or her was considered an interesting value to quantify and
Speaker 1: classify for good or for ill. In nineteen seventy four,
Speaker 1: the first commercial hand geometry systems launched. Dylan, you ever
Speaker 1: have to use a hand geometry system where it measures
Speaker 1: your hand? Dylan shaking his head. No, I did. It
Speaker 1: was a regular part of the University of Georgia when
Speaker 1: I was there. So this is a scanner that looks
Speaker 1: at the hand, the shape of a person's hand, and
Speaker 1: compares it to a database and it authenticates the person
Speaker 1: based on hand geometry. So you have to set up
Speaker 1: your profile right you scan your hand for the first time,
Speaker 1: and it associates your hand geometry with you the person.
Speaker 1: Every time you scan your hand later on, it goes
Speaker 1: in references that database and says, hey, does this match
Speaker 1: with the hand that we measured that first time, And
Speaker 1: if the answer was yes, it authenticated you. So my
Speaker 1: university's food hall had one of these. If you wanted
Speaker 1: to eat, you had to stick your hand in the machine.
Speaker 1: Kind of got a little bit sort of Flash Gordon esque.
Speaker 1: You know, you sit there wondering if you're going to
Speaker 1: get your hand back after you put your hand in there.
Speaker 1: But I mean if you want tater tots, you just
Speaker 1: had to do it, or in my case, chili cheese fries,
Speaker 1: which I ate way too frequently. I digress. In nineteen
Speaker 1: seventy five, partially funded by the FBI, researchers began to
Speaker 1: develop fingerprint scanners. Now. The first of those used capacitive detection,
Speaker 1: which wasn't terribly precise in the nineteen seventies. Most smartphones
Speaker 1: these days actually use this approach. Capacitive touch screens use that. Essentially,
Speaker 1: touching the screen alters an electric field on the phone
Speaker 1: because we conduct electricity. It's a very weak electric field,
Speaker 1: but we conduct electricity. Touching a device that has an
Speaker 1: electric field running across the surface disrupts that electric field,
Speaker 1: and it actually allows a device to detect the presence
Speaker 1: and orientation of a touch, so it knows the X
Speaker 1: and y axis of where you are touching on a screen.
Speaker 1: That's why if you wear non capacitive gloves while trying
Speaker 1: to work an iPhone, nothing happens because it cannot hold
Speaker 1: that capacitance. So the screen isn't a resistive touch screen.
Speaker 1: It can't detect a touch unless that capacitance is there.
Speaker 1: Our capacitive aspect is there. Rather not capacitants. Sorry about
Speaker 1: that misspoke. Well, speaking of the iPhone, the touch ID
Speaker 1: on the iPhone five S and later models actually uses
Speaker 1: capacitive touch to authenticate a fingerprint, just like this system
Speaker 1: did in nineteen seventy five, except the days it's way
Speaker 1: more precise than the tech was capable of back in
Speaker 1: the seventies, so it's much less likely to give a
Speaker 1: either a false positive or to deny someone access to
Speaker 1: their phone. It may require you to scan a second
Speaker 1: time if you didn't get a good representation of your
Speaker 1: fingerprint when you were trying to unlock the phone, but
Speaker 1: it's not likely to deny you because it cannot identify
Speaker 1: your fingerprint now. In nineteen eighty five, two doctors Aaron
Speaker 1: Sefir and Leonard Flom proposed that irides could be unique
Speaker 1: to a person. And you might say, well, what a
Speaker 1: I rides? Well, iride is the plural for iris, so
Speaker 1: we're talking about the pigmented membrane surrounding the pupil in
Speaker 1: your eye. By nineteen eighty six, these two ophthalmologists received
Speaker 1: a patent for their approach to use irides for authentication
Speaker 1: and identification purposes. By nineteen ninety five, the first IRIS
Speaker 1: identification security systems became part of the Defense Nuclear Agency.
Speaker 1: So all those spy movies where you see someone leaning
Speaker 1: forward and getting their eye scanned, that's a real thing.
Speaker 1: Our irises or eye rides, i should say, are unique
Speaker 1: to us, and so that is a pretty tricky thing
Speaker 1: to replicate. You probably have seen at least one or
Speaker 1: two movies where someone got hold of somebody's eyeball and
Speaker 1: got access that way, or knocked a person out then
Speaker 1: forced their eye open and held their head up to
Speaker 1: the scanner, But in general not easy to replicate without
Speaker 1: access to somebody who already is authorized to enter that area.
Speaker 1: Over the next several years, advances in biometrics opened up
Speaker 1: new opportunities, not just for authentication or security. So facial
Speaker 1: recognition is a great example. It's been incorporated into dozens
Speaker 1: of technologies, probably most notably into our cameras, including the
Speaker 1: cameras and our smartphones. And sometimes it's a simple implementation
Speaker 1: which just detects a face in order to focus properly
Speaker 1: on a subject. Sometimes it's more complicated, so it might
Speaker 1: allow for automatic tagging of images because it can recognize
Speaker 1: people based on their facial features. You probably had some
Speaker 1: experience with this in some capacity. Organizations also began to
Speaker 1: form around this time to create standards for biometric implementations.
Speaker 1: This would reduce the chance of competing technologies with varying
Speaker 1: degrees of efficiency and accuracy from interfering with each other,
Speaker 1: and by two thousand and three, the US government began
Speaker 1: to formally coordinate biometric implementations. Meanwhile, the International Civil Aviation
Speaker 1: Organization created a global standard to incorporate biometric data into
Speaker 1: travel documentation like passports, and ten years later, in twenty thirteen,
Speaker 1: you could find biometric solutions built directly into personal electronics
Speaker 1: like laptops and smartphones. In fact, I had a fingerprint
Speaker 1: scanner from before twenty thirteen where you just you would
Speaker 1: actually have to slide your finger kind of like a
Speaker 1: copier against the little panel and if your fingerprint matched,
Speaker 1: it would unlock your computer for you. I actually had
Speaker 1: that one. Hear at how stuff works, I miss it sometimes. Well,
Speaker 1: I've got a lot more to say, but first let's
Speaker 1: take another quick break to think our sponsor. All right,
Speaker 1: things like fingerprint scanners are not foolproof. It is possible,
Speaker 1: although challenging, to lift a person's fingerprint from something they've handled,
Speaker 1: scan it and replicate it. A couple of different ways
Speaker 1: to do this. Some of them require access to some
Speaker 1: equipment and materials most of us don't have in our homes,
Speaker 1: so it's not like it's practical for the average person.
Speaker 1: But the point is, with the right determination and the
Speaker 1: right know how, and specifically the right materials, you can
Speaker 1: create a fake fingerprint. And you might use something like
Speaker 1: latex or even wood glue, and you could lift a
Speaker 1: fingerprint and use it to fool certain authentication systems. If
Speaker 1: the system is just looking for a particular pattern on
Speaker 1: a fingerprint, the copy could be good enough to fool
Speaker 1: the system, particularly if you can overlay the copy on
Speaker 1: top of your own finger This would provide the capacitive connections. So,
Speaker 1: in other words, let's say I've got a latex fingerprint
Speaker 1: and I need to access a phone. Well, if I
Speaker 1: just lay the latex down against the capacitive screen, it's
Speaker 1: not really gonna affect anything. If I put an actual
Speaker 1: living tissue behind it, that's a different story. So how
Speaker 1: do you defeat that sort of security vulnerability. Well, I
Speaker 1: had the opportunity to speak with doctor P who's the
Speaker 1: chief technology officer of goodex to talk about a fingerprint
Speaker 1: scanner with an additional measure of security to counteract those
Speaker 1: sort of spoofing attempts. Here's what we talked about, doctor p.
Speaker 1: Let's start off by talking about how biometrics are transforming
Speaker 1: security in the technology field, specifically for things like consumer tech,
Speaker 1: because my listeners are very interested in that, the concept
Speaker 1: of using biometrics to access various devices. I think probably
Speaker 1: the example most of them would be familiar with it
Speaker 1: would be smartphones. Uh, can you talk a little bit
Speaker 1: about how that has developed over the last few years
Speaker 1: and and why it is such a compelling component for security.
Speaker 2: Well, I think one of the story I actually met,
Speaker 2: which is a part of my experience too, is some
Speaker 2: is out really well is the since the more and
Speaker 2: more phone has a fingerprint, Uh thanks, more and more
Speaker 2: people using it? Is one guy and Agen say, totally
Speaker 2: forgot the past code. Now he's using fingerprints on the
Speaker 2: phone all the time, and one on my phone. I
Speaker 2: don't use offering also I forgot the past code as well,
Speaker 2: So it is a kind of Chelsea. The consumer behavior
Speaker 2: has changed so much. Yeah, they used to obviously everyone
Speaker 2: have a pass code and Uh, nowadays they do, but
Speaker 2: they didn't use it anymore. They think of present. That
Speaker 2: is certainly take over majority of the authentication meant And
Speaker 2: then the other thing was the in the case of
Speaker 2: like in China market where a lot of mobile payment. Now,
Speaker 2: if you were in China you could literally live without
Speaker 2: it's like a critical you can live without a catch.
Speaker 2: But in China you can live without critic and the
Speaker 2: catch you can use your phone and mobile payment literally
Speaker 2: do everything from convenience store to buying ticket to hotel
Speaker 2: payment everything. It's quite a but all that is obviously
Speaker 2: going through thinkation.
Speaker 1: Right, and so the authentication part is obviously really important.
Speaker 1: You want to make certain that the person who is
Speaker 1: utilizing a device, particularly one that can be used as
Speaker 1: a means of commerce, a means of purchase. You want
Speaker 1: to make sure that the identity of the person holding
Speaker 1: the phone is in fact the person authorized to use
Speaker 1: that device for that purpose. And that kind of comes
Speaker 1: in with the sensors that you've been working on in
Speaker 1: the recent past, where it's not just looking for the
Speaker 1: pattern of a fingerprint, which, as some people have pointed out,
Speaker 1: is something that is possible to spoof if you go
Speaker 1: and you have the right scanners and you have the
Speaker 1: right you know, even three D printer technology, you could
Speaker 1: potentially create a fake fingerprint and access US sensors that
Speaker 1: are only capable of detecting the fingerprint layout. You are
Speaker 1: working on technology that goes a step further than that.
Speaker 1: Can you talk about that a little bit?
Speaker 2: Yes, this is the one new technology we recently released
Speaker 2: to the market. Is you at the same time when
Speaker 2: you scan, recording or setting it in the fingerprint pattern,
Speaker 2: you're also detecting the dynamic bluff flow in your fingerchap.
Speaker 2: So that enable the sensor tells this fingerprint pattern it's
Speaker 2: from a life person versus a mackup spoof. So that
Speaker 2: further you enhanced the security level of the fingerprint authentication,
Speaker 2: right because the most of the spoof method we know
Speaker 2: obviously is UH, it's not by life object. So this
Speaker 2: basically enables the security level one level up from UH.
Speaker 2: So I think it will block the most, if not all,
Speaker 2: the potential spoof master.
Speaker 1: Right, So, people who would be you know, people who
Speaker 1: would normally rely on something like a fake fingerprint made
Speaker 1: from say silicone or rubber, that wouldn't work on this
Speaker 1: particular type of device or this particular sensor, I should
Speaker 1: say that will be incorporated into other devices, whether it's
Speaker 1: a phone or a secure entry point or whatever it
Speaker 1: may be, because it will lack that blood flow, and
Speaker 1: without the blood flow, the device quote unquote knows it
Speaker 1: is not a valid authentication. Am I getting that correct?
Speaker 2: Correct?
Speaker 1: Correct? You're absolutely crackt wonderful. So let's talk a little
Speaker 1: bit about how this how this sensor actually does detect
Speaker 1: that blood flow. What are you using, uh in order
Speaker 1: for the technology to to quote unquote know that blood
Speaker 1: is flowing behind that fingerprint.
Speaker 2: Yeah, so what we I think we're using this technology, uh,
Speaker 2: integrating the obstacle sensor in the same area as a
Speaker 2: fingerprin sensor and so, and we also put in a
Speaker 2: small led emitter emitting an infrared light through the center
Speaker 2: glass cover, so that sending the light into your finger tip,
Speaker 2: and then the optical censor detect the scatter light of
Speaker 2: your fingertip, so the blood flow itself will change in
Speaker 2: the scatter light the intensity. So this is a very
Speaker 2: common technique to use, like in the hospital, the oxidometer
Speaker 2: we use all the time. You know, if you're in
Speaker 2: the hospital bed, just put on your fingertips. It's the
Speaker 2: same principle, except that in this case we just used
Speaker 2: it to detact to the blood blow instead of uh,
Speaker 2: attacking the oxygen them.
Speaker 1: Right. So in some ways you could even argue this
Speaker 1: is this is a a a simpler use of a
Speaker 1: technology that's been put to use specifically for those monitoring
Speaker 1: devices and hospitals where you know you need to have
Speaker 1: more specific information. It's not like your smartphone necessarily is
Speaker 1: going to tell you what the oxygen levels are in
Speaker 1: your blood, although I guess you could technically develop sensors
Speaker 1: that could do that.
Speaker 2: You're right about. On the other hand, obviously, is fontify everything.
Speaker 2: I got one level up? Right, you also need a
Speaker 2: longer time, you mean's not a something average you that
Speaker 2: we're winning to wait right. By way, we do providing
Speaker 2: a simple way to also provide the heartbeat, the heart rate.
Speaker 2: There's the censor, so user could u fingerative on the center, well,
Speaker 2: I will report a heart rate. This is a kind
Speaker 2: of side benefit of the.
Speaker 1: Technology, right, and so one potential application for being able
Speaker 1: to detect heart rate. Uh. Obviously you have medical applications,
Speaker 1: but you also have applications within the health and fitness sector.
Speaker 1: Where people might be using their smartphone while out on
Speaker 1: say a jog, and they want to make sure that
Speaker 1: they're keeping their heart rate within a specific target zone.
Speaker 1: That could be something that you would use that sort
Speaker 1: of sensor technology for beyond its authentication capabilities. So it's
Speaker 1: really interesting to me that we're looking at a technology
Speaker 1: that for a long time people thought of as sort
Speaker 1: of science fiction. You know, you saw you would see
Speaker 1: in movies that someone would put their finger down and
Speaker 1: get a scan and that would give them access to stuff.
Speaker 1: And now we're realizing that's convenient because you unless something
Speaker 1: terrible has happened, you always have your finger with you.
Speaker 1: But but as as we've discussed, it's it's not fool
Speaker 1: proof unless you have this second dairy layer of protection, uh,
Speaker 1: in this case, that detection of blood flow. So what
Speaker 1: sort of devices might we see this incorporated into. I
Speaker 1: mean again, smartphones are are an obvious example. Are there
Speaker 1: others that, uh that you either have your eye on
Speaker 1: or you could see as being a potential in the future.
Speaker 2: Yeah, the other uh, we not looking beyond the mobile device,
Speaker 2: and then you're looking at the maybe say the same
Speaker 2: but for example if using code, but at the same time,
Speaker 2: you could have even in the code friend scanner, right,
Speaker 2: and so not only you use the code, you also
Speaker 2: on top of that you can use the fingerprints out
Speaker 2: the owner. So that will add uh, you know, extra
Speaker 2: layer of security and your your doors. So many times
Speaker 2: people you know now they're wireless, they control door become
Speaker 2: more and more popular and you may enable a scanner
Speaker 2: for people to do that. There's a lot of us
Speaker 2: like the car, right they are the most is the
Speaker 2: same way people steal your key today can just drive
Speaker 2: away with your car. But if you have a fingerprints
Speaker 2: scanner in the car or on the key, that will
Speaker 2: obviously protect your car better. You can buck you can
Speaker 2: lose your key, but the people still can of drive
Speaker 2: away with your car. Right, So there's a thic way
Speaker 2: of using it. The one benefit of the mobile app
Speaker 2: is really driving their costs and the size and the
Speaker 2: power way done. Imagine it's a bidding devisorshipping every year,
Speaker 2: so they scale the economy make it cost coming down
Speaker 2: so much, so you enable all those other applications.
Speaker 1: Yeah, you hit upon something really interesting there because we've
Speaker 1: seen that we've seen the smartphone and cell phone technologies
Speaker 1: drive a lot of development in what you might think
Speaker 1: initially are unrelated technology simply because, as you say, the
Speaker 1: economies of scale provide this this economic imperative. It's not
Speaker 1: even anive incentive. It's an imperative to develop a smaller,
Speaker 1: more efficient, more economic sensors and other technologies. So, for example,
Speaker 1: beyond this fingerprint sensing technology that could be used in
Speaker 1: multiple applications, a lot of the development we've seen in
Speaker 1: the virtual reality space, in just gaming in general, and
Speaker 1: a lot of technologies. The reason why it's possible is
Speaker 1: because the smartphone has acted as a platform that people
Speaker 1: have been developing for for years to increase the number
Speaker 1: of features, increase its security, increase its applicability for lots
Speaker 1: of different possible uses, and we end up seeing that
Speaker 1: spill over into seemingly unrelated uses. And I think that's
Speaker 1: a great story in general, just that it illustrates that
Speaker 1: work in one particular platform benefits in ways that you
Speaker 1: can't necessarily anticipate from the beginning, and certainly when it
Speaker 1: comes to things like authentication and security, you want to
Speaker 1: see those benefits being applied to a broader spectrum of
Speaker 1: uses because we're we're getting to a world in fact
Speaker 1: we're already there. We're in a world where more and
Speaker 1: more of our devices are interconnected in ways where if
Speaker 1: you are able to get unauthorized access to them, you
Speaker 1: could potentially cause a great deal of mischief and harm.
Speaker 1: So where do you see the future going? If you
Speaker 1: had to put on your prognosticator hat, what do you
Speaker 1: think the next big step in authentication is going to be?
Speaker 2: Well, there is already happening the iris scan on the
Speaker 2: phone right, that is also inment, and I think it
Speaker 2: will become more gold popular, and the next level of
Speaker 2: people already talking is a fingerprint scan and will get
Speaker 2: in into the display area. As I think rumor is
Speaker 2: the UIFO may have its function. And then I think
Speaker 2: going beyond you're going to see more and more maybe
Speaker 2: medical related because the mobile device is so powerful and
Speaker 2: with us all the time. It can't really use that
Speaker 2: platform for monitoring your house, right because it's with you
Speaker 2: all the time. So we see a lot of those
Speaker 2: were happening, and so I think I think that is ah,
Speaker 2: that's a kind of next few years. We're going to
Speaker 2: see more and more of those things coming.
Speaker 1: To the interesting. Well, sir, thank you so much for
Speaker 1: joining our show and answering my questions. This has been
Speaker 1: a fascinating conversation, and I know that my listeners are
Speaker 1: always really interested to learn not just about how technology works,
Speaker 1: but but why those applications are so important. I think
Speaker 1: I think you've done a great job at doing that.
Speaker 1: So thank you very much for joining me today my pressure.
Speaker 2: Thank you.
Speaker 1: As for the future, what if you could authenticate your
Speaker 1: identity just through thinking? Researchers over at Binghampton University developed
Speaker 1: a process in which they could identify or at least
Speaker 1: they claim they can identify a person based on their
Speaker 1: brain wave activity alone. So here's what they did. They
Speaker 1: took a sample of fifty people. It's not a big
Speaker 1: sample size, but it's interesting. Fifty people, fitted each person
Speaker 1: with an electro encephalogram or EEG headset. Then they showed
Speaker 1: each person a series of five hundred images, and those
Speaker 1: images prompted various emotional and cognitive responses. Now those responses
Speaker 1: are unique to each individual. So let's say that you
Speaker 1: and I are looking at the same photo, and just
Speaker 1: for argument's sake, it's a picture of my adorable dog, TIBLT,
Speaker 1: and both of us just think he's accused of little
Speaker 1: dog in the world because he is. I mean, come on, well,
Speaker 1: the way your brain manifests that and the way my
Speaker 1: brain manifests that information, even if we both feel the
Speaker 1: same way, is going to be different. So theoretically, once
Speaker 1: you record responses from people, these brain responses to these images,
Speaker 1: and assign each of those responses to the respective identity,
Speaker 1: you can authenticate a person's identity just by showing him
Speaker 1: or her the same series of images and looking for matches.
Speaker 1: If there's no match, then the person you're looking at
Speaker 1: isn't who you think they are, and they're likely a
Speaker 1: pod person. Maybe I should add that no one I
Speaker 1: know of is actually talking about using brain waves for
Speaker 1: authentication just yet. The study said that the researchers had
Speaker 1: a one hundred percent success rate identifying subjects based on
Speaker 1: brain waves, and it came out in twenty sixteen. So,
Speaker 1: in other words, they put these fifty people through the
Speaker 1: test of recording all of these responses. Then I assume
Speaker 1: they used a blind mesas where somebody would end up
Speaker 1: looking at the responses that were coming in from an
Speaker 1: unknown subject and they would be able to match that
Speaker 1: person's responses to one that was already in the database,
Speaker 1: thus saying, oh, that's Jill. Because when Jilsey is a
Speaker 1: picture of Timbalt, her heart grows three sizes that day.
Speaker 1: We've got to stop showing those pictures. She's having heart
Speaker 1: travel trouble. It's terrible. Tipple's just so cute. Anyway, I
Speaker 1: should add that. Also, if you wanted to use this
Speaker 1: as an authentication strategy, it would be pretty tricky because
Speaker 1: it requires an EEG headset. It's not exactly the most
Speaker 1: convenient authentication technology around now. If we ever develop a
Speaker 1: less cumbersome method for measuring measuring brainwave activity with precision,
Speaker 1: that's important, that could become an authentication technology of the future.
Speaker 1: It's literally the way you think, and that would be
Speaker 1: much much more difficult, if not possible, to replicate unless
Speaker 1: you had some sort of recording of a person's brain
Speaker 1: waves and you could somehow, you know, push those out
Speaker 1: to cover up your own brainwave activity. I think I
Speaker 1: might have just written a science fiction novel accidentally. I
Speaker 1: hope you all enjoyed that classic episode Authentication Tech and
Speaker 1: you from February twenty second, twenty seventeen, and I hope
Speaker 1: you are all well, and I'll talk to you again
Speaker 1: really soon. Tech Stuff is an iHeartRadio production. For more
Speaker 1: podcasts from iHeartRadio, visit the iHeartRadio app, Apple Podcasts, or
Speaker 1: wherever you listen to your favorite shows.