DIY Iris Scanning?

gadzook33 asks: "There have been rumors floating around about DIY iris scanning, using digital cameras for biometric security. Iris scanning presents a fantastic alternative to password-based authentication but hasn't really come to our desktops yet. I've looked around but can't find any concrete material on the subject. Is anyone doing this? Are there any efforts to develop open software for this sort of thing? Are patents holding things up? Given that passwords are an almost defunct technique for protecting data in certain situations, it would be nice to have an alternative."

Re:

[__aaclcg7560]

You failed the DIY iris scanner test. You need to pluck out an eyeball and wave it around in front of the scanner's TP cardboard tube for it to register. A typical newbie problem.

Re:

[rts008]

RTFM, n00b!
Oh, and carry a few spare eyeballs with you- you know...backups!

Re:

[WilliamSChips]

My guess? They hadn't yet said "Open the iris!"

eye scanner

[indy_Muad'Dib]

it seems to be quite possible with a very high resolution camera, something +4mpixels

Re:

[cloricus]

I'm guessing Digg is down as the last few news stories seem to have Diggs level of comments...

The problems I see with using cameras to take the picture is you'd have to have some form of size reference to do the mapping and have some points that align the sample to be compared. Lighting and visual mistake could also cause problems. On top of that dealing with damage (short or long term) to the eye would be a huge problem...Imagine a scratch to your eye or if you had a blood shot eye. So in reality pas

Why would I want to...

[YowzaTheYuzzum]

... give anyone an incentive to gouge out my eyeballs?

Re:

[__aaclcg7560]

Or Minority Report?

Re:

[ResidntGeek]

Or Angels and Demons?

Re:

[slidersv]

or Spaceballs

Better than retina scanning

[jamesh]

which is where you use a laser to illuminate the back of the eye, and a camera to take a picture of the illuminated retina and then use some sophisticated pattern matching to recognize the unique pattern of scars left by previous scans.

Aaargh! Wrong laser!

[myowntrueself]

I thought I told you to label those buttons, Emory?

Re:

[cerberusss]

and then use some sophisticated pattern matching to recognize the unique pattern of scars left by previous scans

I dare anyone to write a regex for this.

Re:Better than retina scanning

[fyonn]

Retina scans are not likely to injure you, but are considered less acceptable than iris scanning as it gives away too much information. Yes, it can uniquely identify you, but it can also divulge various health issues and show if you're pregnant. This is usually information that employees prefer to reveal on their own, than have the door security guard congratulate or commiserate them about information that they haven't told their partner about yet, or might not even know them selves.

dave

Re:

[fyonn]

and of course, it could also be used to affect your future career or health insurance as it reveals to your company things such as high blood pressure, diabetes, drugs use and leukemia. hell, even aids and syphilis.

things most people would rather keep to themselves.

dave

Re:

[cr0sh]

I was under the impression that retinal scans were less acceptable because they were more invasive. From what I understand, in order for the system to get an accurate scan, it has to keep your eyeball immobile. To do that, a vacuum ring is used, the scan occurs, then the vacuum is released. In other words, the machine requires you to open your eye really wide, then it touches and holds onto your eyeball for a brief moment while it scans the retina. Between this discomfort, and the chance for infectious eye

Re:

[putigger]

What you're talking about is simply one retinal imaging system. See Retica Systems [retica.com] for a company that has a non-contact, non-invasive system.

Re:

[cr0sh]

Interesting! I didn't know this - thank you for the link. Looks like (in some manner) they are using the eye's own lens to image the retina - that can't be easy (whether doable by DIY or not is unknown)...

Re:

[putigger]

I work for a biometrics company. There was one product on the market a number of years ago that used a laser. However, one can image the retina for biometric purposes without a laser. In addition, the concept has NEVER been to scar the eye - you simply look at the blood vessels, which are clearly visible. This is no different than with finger and palm vein systems which use infrared to look at blood vessels under the skin. Retinal imaging has a number of advantages from a security point of view, among

Re:

[jamesh]

Was my attempt at humor really that unobvious?

really?

[Unknown_monkey]

Out of all the things to DIY, what would drive you towards a DIY project involving possibly lasers or bright LEDs and your eyes? Some things you shouldn't go bargain on, like never buy the cheap toiler paper. For both my eyes and my brown eye, I think it's worth spending the cash for premium.

Re:really?

[jamesh]

This iris is the front part of the eye (See here [wikipedia.org]). No need for any special sort of illumination above a light bulb. The Iris Recognition [wikipedia.org] article on wikipedia is also somewhat informative, it even mentions the problem of cosmetic contact lenses.

Re:

[sumdumass]

I wonder, I have eyes that used to change color about every three weeks. It would go between shades of green to blues. Now it takes longer to notice a change but it still does it every so often. Now, If the colors are included in the scan, I could be locked out but what if something happens and the lens above the eye becomes scratched, wouldn't that give false reading too? I'm not talking anything extravigant either, get some dust in your eye and the first rection is to rub it, you could possibly scratch it

Re:

[Copid]

I wonder, I have eyes that used to change color about every three weeks. It would go between shades of green to blues. Now it takes longer to notice a change but it still does it every so often. Now, If the colors are included in the scan, I could be locked out but what if something happens and the lens above the eye becomes scratched, wouldn't that give false reading too? I'm not talking anything extravigant either, get some dust in your eye and the first rection is to rub it, you could possibly scratch it

Not an alternative...

[Zadaz]

Iris scanning presents a fantastic alternative to password-based authentication...

This is an all too common mistake about biometrics. Security should never rely solely on biometric identification. Unlike a password or a physical key, your biometric information can't be changed. Which is its strength, right? No one can change their fingerprint to match yours!

However, any system can be spoofed or cracked. And if someone figures out how to feed information into a scanner that looks (to it) exactly like my iris, well then I'm fucked. That person is me anywhere they do an iris scan.

It would be like someone stealing your passwords and you not being able to change them.

Useful? Yes. But as an additional level of security, not an alternative.

Re:

[ryanhos]

There is merit in your argument. The basic idea of using biometics as a an additional level of security is unimpeachable. However, you miss two key issues in play here.

1.) A key and irreplaceable component of any authentication instrument is a revocation feature. You state that biometric passwords are not changeable. Biometrics are just as revokable as passwords. In both cases, the user must recognize that the instrument has been compromised and tell his keymaster. In the password case, you simply ch

Re:Not an alternative...

[Vo0k]

"That person is me anywhere they do an iris scan." is true. Except they get "Sorry, you don't have a clearance" as a reply, just like you do. If a building security is based on iris scan, sure they won't be able to enter after your iris pattern is revoked, but so won't you. Meaning no entry to the building, sorry sir, you must look for a job elsewhere, at least till we update our security system.

As for 2), the basic feature of biometrics is that it's simple. You touch a surface or look into a lens, and that's all, no typing passwords, no entering codes or searching your wallet for magnetic card. Take it away and you take away half of the charm of biometrics. You only leave the scare "they will knock you out and take your eye out in a dark backstreet to break in" plus vague and unreliable info about high security, which is neither verifiable nor unhackable and definitely doesn't appeal to management.

It's a bumpy road ahead of biometrics.

Re:Not an alternative...

[Zadaz]

1) Sure, my biometric permissions are revocable, but not re-issuable. At least no security outfit in their right mind would reinstate your biometric print once it had been broken.

If simple biometrics become prevalent, then someone stealing my iris print (for example) would pretty much end my life. I wouldn't be able to have a bank account or any other kind of security. Either my accounts would be wide open to whoever had a copy, or no bank would issue an account to a security risk.

At least until I could grow a new eye. It's identity theft on a very personal level.

2) Sure, they're getting more advanced. They could hardly be more primitive. However there are two problems with making them more sophisticated:
a) You can't make security so sophisticated it can't be broken. (duh.)
b) The more complex a system is the more likely it is to fail. I'm not an expert in the field, but many of the things you propose would ilkley prevent me from accessing my account if I was ill or under the effect of any number of legal drugs. Which is of course unacceptable.

A system that sophisticated will cost a ton of money. Compare that to to the cost of a card reader and 12 button keypad found on most ATMs. The amount of ATM fraud based on stealing user ID's at the terminal is much smaller than cost of installing and maintaining biometric devices and will be for the foreseeable future.

Re:

[darkonc]

A revoked biometric still means that the spoofed person is f*cked -- and someone with a spoofed biometric can do massive mischief until the spoof is discovered.

"No, I'm sorry sir, you did it all yesterday -- I have it right here with a proper biometric scan.... Well -- I'm not trying to accuse you of anything -- but, if you were in Hawaii until this morning, then how did you provide an iris scan here yesterday?"

A key and irreplaceable component of any authentication instrument is a revocation featur

Re:

[ipooptoomuch]

I saw this episode on mythbusters in which they broke into a very *expensive* finger print scanner with a piece of paper. Makes it sound very easy to hack into.

useless

[Lehk228]

iris scanning is useless, you may as well tattoo your root password tot he back of your neck.

anyone with a telephoto lens can steal your key

Re:

[Invidious]

No, they can't. In order to get a good image of someone's iris, particularly without being noticed, you'd need a long (at least 400mm) macro (true macro, 1:1 reproduction) lens with very, very little sperhical abberation or chromatic abberation, and very sharp to boot. And, likely, a buttload of light shining into the person's eye. Since you can't get a lens like that, and it'd be monstrously huge anyway, it's not a problem.

Static Iris Scanning is useless, not dynamic

[iendedi]

While it is true that one could hold up a photo of your iris to a camera and spoof a static iris scanner, doing the same to a dynamic scanner is not practical.

What is a dynamic iris scanner? One that looks not only for the unique patterns of the eye, but also simultaneously measures retinal response to stimuli such as dimming and brightening of the display. This is much more difficult to spoof (you would essentially need to build a model of the target's eye that could respond to external stimuli and then hold that up to the scanner).

Combined with facial recognition, dynamic iris scanning is very potent. First it recognizes your face and then your eye and then the retinal response with stimuli that is timed to be somewhat random. Just don't try to log on after a night of pubbing.

Better Yet, Go Multi-Tier

[DumbSwede]

I personally would like to see multi-tier biometric authentication built into the OS. Log on with a password and a finger scan; any File I/O challenge with voice recognition; visit a secure site, submit to iris scan. Mix it up, occasionally challenge with authentication questions when actions seem either dangerous (downloading executables) or deviate from usual usage patterns. How aggressive to be in challenging for authentication and what types should be settable by the user. This kind of thing might be very useful in keeping your teenage kids from downloading Kazza like malware on your family computer, not just keeping your computer secure from crooks and spys.

Re:

[corychristison]

Or better yet, you could have a biometric finger-scanning keyboard.

Each key will be a finger-print scanner. If you type home-row then match the keystrokes to fingers that are supposed to be used. When you press down on a key, it will take a photo/whatever of your finger and analyze it to a small database at the system[/kernel?] level to see if they match up.

If the finger print doesn't match, keypress is ignored.

You would need some incredibly quick fingerscanners for each key, and it would be VERY p

Re:

[deevnil]

I wonder if a touchpad could be hacked enough to make a crude fingerprint scanner for, at least, the pesky admin password. I get prompted enough that *everyone* would see me authenticating updates, unlocking the screensaver.. and they would hear the eerie, "Thank you for disabling the countdown. Welcome back." robotic voice. With all the exploding laptops out there, and such a suggestive security through intimidation policy you would be safe from potential intruders so long as they have a sufficiently overa

Standard warning:

[Strolls]

Do not look into laser with remaining eye.

Re:

[theonetruekeebler]

Do not look into laser with remaining eye.

For years, Steve Wozniak carried around a photo ID card identifying him as a "Laser Safety Officer." In the picture he's wearing an eyepatch.

Biometrics is very hard to get right.

[gweihir]

Face and Iris recognition have been fooled with printed pictures. Fingerprint sensors with $5 fakes. The list goes on. There is really not a lot of defenses available against this.

And you cannot change your face or iris, like you can change a password....

Re:

[WilliamSChips]

The SGC changed their iris [wikipedia.org]!

Little red lights

[G1975a]

Aren't the little red lights on the bottom of my mouse iris scanners? That's what they told me at work.

How I would do it...

[cr0sh]

I would start out with a cheap USB web camera. First, I would hack it in some manner to allow it to macro-focus. I would go down to goodwill or a pawn shop and pick up the cheapest, most busted VHS video camera being sold. From this I should be able to get much of the optical components and the needed eyecup.

I would attempt to obtain a fake eyeball of some sort. While it wouldn't work perfectly, it would give me some sort of method by which to focus with. Mounted with some tape to the eyecup, and then positioned in front of the webcam, I would be able to determine the focus fairly quickly.

I would then set up some kind of "ring illumination", wherein I would create a "ring" of LEDs - red/green/blue/IR - through which the webcam would peer. Focussing again might have to be adjusted. This ring would be set up in such a fashion so that I could trigger which set(s) of LED's would be active at once - likely via USB control, too.

Once I had that set up, and focussing correct, I would then work on the software. For this DIY project, I would simply set things up to take multiple image captures of my own eye, process the images through some filters to reduce the information to just my iris (cue on the white of eyeball, and black of the pupil), then (in some manner), use these images to create an "eigeniris" image, some kind of "average" of all the images I took (over several days or months, in different levels/conditions, so as to have the best average available). Then, the software could take an image, compare it to the "eigeniris", determine if it falls within range, and use that to trigger or deny access (to whatever).

That would be the route I would take if I was doing this. Overall, the hardware portion seems the simplest to implement - the software is where you will bog down. Just like any other pattern recognition project, I would imagine...