Your Face is Your Password

Proof of identity is the most fundamental of security

require-ments. Yet, in today’s digital world, the centuries-old password, with all its well-known shortcomings, is still the prevalent means of personal authentication. Nobody likes them. Customers dislike passwords because they’re difficult to remember. Vendors dislike them because they’re insecure, especially since most customers write them down to remember them. However, passwords are still the primary method of identification today.

Conventionally, there are two alternatives to passwords–the system can check either “something you have” (such as a smart card or digital ID) or “something you are” (such as a fingerprint or iris pattern). The latter comprise the field of “biometrics”. 

In practice, most smart cards and tokens require a user password or PIN as well, just as in the non-digital world, your signature or photograph is used with a credit card or passport. Similarly, digital IDs (public-key certificates) require a password to protect your private key. So, something-you-have isn’t really an alternative to the password. That brings us to biometrics.

The idea that the computer should be able to automatically recognize and verify some unique characteristic of a user is very appealing. But, in spite of at least 20 years’ efforts in biometrics, no system has proved to be viable enough for mass implementation, especially over the Internet. The biggest problem with biometric systems–and one that’s essentially intractable–is that they require special hardware. That is, they cost money–to buy, install, and maintain. 

An intriguing new “cognometric” (measurement of knowledge) authentication method called Passfaces tries to get round these problems. This new technology developed by ID Arts, a UK-based company, is catching on as a secure method of authentication. The theory behind it is like this. We may find it difficult to remember a person’s name, but we’re extremely good at the apparently more difficult task of remembering and recognizing individual faces. 

Passfaces uses this innate ability of remembering and recognizing faces, which has developed over millions of years of evolution, as the basis of a cognometric (from Latin “cognoscere”–to learn, to know, and Greek “metron”–measure) identity verification system. Most importantly though, images are never forgotten–just as we recognize a friend, relative, or colleague we may not have seen for months or even years, so also, we always recognize images we use as Passfaces–even after long periods of disuse. This technology is essentially a something-you-know (like passwords and

PINs) authentication method, but without the problems inherent in such schemes. This system also has the characteristics of a something-you-are (biometric authentication) method. The complete set of faces (friends, relatives, colleagues famous persons, etc, and

Passfaces) known to any individual is as unique as their fingerprint and is effectively “hardwired” into their brain. This system verifies the identity of an individual by testing that knowledge–just as a biometric system tests a fingerprint. 

Passfaces are supported by extensive academic input and experiment. It’s now been demonstrated both by inference and direct neurological measurement that we have in our brains a special component whose sole function is to recognize faces. The speed of operation and reliability of this component is significant in making Passfaces an intuitive and effective method. 

A human infant is born with a capacity to recognize faces and shows a preference for looking at faces well within the first hour of birth. The infant can recognize its mother after only two days. We know that we’ve seen a familiar face before, after only twenty-thousandths of a second (20 ms). In one experiment people recognized schoolmates they hadn’t seen for 35 years, with over 90 percent accuracy.

The brain has a short-term “iconic” memory (like a computer’s cache) which holds the image before it’s transferred to long-term memory. The iconic memory is overwritten by a new image, so we need to see something for a finite time (about one second) if we’re to remember it. 

The part of the brain primarily concerned with face recognition is in the right parietal lobe (right side upper middle), but other parts are also involved. Generally, the right side of the brain is concerned with pictures and spatial relationships, the left has more to do with abstract processes like mathematics and

language. Passwords use the left half of the brain, while Passfaces use the right.How we remember faces is the least-known of face-related brain processes. Some faces are more distinctive than others, and the more distinctive the face, the easier it is to remember it. People of all genders and races have broad agreement on whether a face is distinctive and whether it’s attractive. The context in which we know the face is also important. 

How we recognize faces 



It appears that the brain stores faces in some sort of spatial relationship. The more distinctive a face, the fewer other faces there are like it, the more quickly it’s recognized because there are more elements that are unique to it. Emotion helps–one is more likely to recognize a face with a definite expression than a neutral one. We all also appear to agree on ascribing personality to different types of faces despite the demonstrated fact that there’s no correlation between any type of face and personality. Context is important. As adults, we tend to recognize people whom we perceive as important to us. The quality of the image may be very poor or distorted, or of only a small number of pixels; we can still recognize someone we already know. If you’ve just seen a face, you’ll recognize it again more quickly. This is called “repetition priming”. Moreover, if you’ve just seen a face that has a relationship to another, you’ll recognize the other more quickly. The speed of recognition also depends on how familiar we are with that person’s race. The phenomenon called the “other race effect” describes how we appear to recognize someone of our own race quicker than those of another race. However, other research indicates that if we’re used to interacting with other races, we’re almost as effective with them as with our own.

Identifying to whom a face belongs is a further and somewhat different process. It’s interesting that there appears to be no tying up between faces and names. Thus, inability to put a name to a face is common. There’s also no evidence that a person’s ability to recognize faces deteriorates with age. If any, the evidence is that adults are better at this than children. 

How Passface works



Having gone through this quick guide to how we recognize faces, let’s come to how Passface works. Passface is based on the ability of the human brain to remember faces. You enroll (create your password) by memorizing four random images of real, but anonymous faces. To logon, you have to select these faces from a random array of decoy faces. This method has great potential. It’s highly secure (users can’t “write down” their faces and can only be “robbed” of them at the point of sale), very user-friendly and intuitive (since images of people are easier to remember than passwords). Finally, Passface is less intrusive than most other biometric techniques, and comparatively inexpensive to implement.