Lenovo Trying Face Recognition For Logins On New Laptops 164
judgecorp writes "Lenovo's new IdeaPads will be using face recognition as a way to replace passwords for users logging onto the laptops. 'Lenovo's VeriFace combines the Windows login and file encryption to password-protect individual files. It identifies users by matching unique features of their faces to photographs taken by the 1.3-megapixel webcam built into the laptop. When Windows users start up their PCs, a camera window pops up in the login frame. The user then just has to adjust their position so their face appears in the window, and VeriFace logs them in automatically.' That could be good, but is the technology really ready for mass market devices? HP ran into trouble when its face recognition software had trouble recognizing people with darker skin."
Fool it with a picture? (Score:2, Insightful)
What's to keep me from holding up a picture of my coworker in front of the camera when I want to log in to her computer?
This sounds easier to fool than the fingerprint sensors that can be spoofed with silly putty.
Old, old news (Score:5, Insightful)
Twins? (Score:1, Insightful)
So apparently they forgot that there's such a thing as identical twins...
Also, what happens if you change your hair or makeup or something else? Suddenly you might not be able to get into your computer
facebook (Score:3, Insightful)
I have been using it for the past couple of months on my netbook. It does a pretty good job as long as you aren't wearing glasses, and you are well lit. Most of the time, the lighting is not good enough, and I would need to remove my glasses. It seems to do well enough discriminating between other people though. I tried it with several different family members and co workers, and it never allowed them. It will log bad attempts, and save pictures of the attempted logins. It also has a mode to detect if a photo is being used to log in. That seemed to work blocking photos as well. I never tried the encryption mode, but since it is Lenovo, I'd bet it has a back door for the Chinese government.
Unless they get it to work in low light though, it's not ready for prime-time.
Lenovos already use finger print (Score:2, Insightful)
Whats wrong with finger print readers? I have a Lenovo laptop with a finger print reader and I couldnt be happier with it. This article is not entirely correct in saying face recognition to replace passwords since passwords are only used as backup authentication with most existing Lenovos. It sounds interesting but I dont really see the point. Unless of course you dont have fingers but then using a keyboard would be a bit hard to start with. Sound more trouble than its worth tho given skin tone issues.
Re:Fool it with a picture? (Score:3, Insightful)
If I'm stealing a total stranger's laptop, I honestly don't give a crap about the data. I'll sell it to someone else who'll reformat it and sell it as "refurbished" on amazon.
The only people who would ever care about your data are the people who know you, and they would have the capability and foresight to bring a picture. This system is almost as idiotic as security through voice recognition.
Re:Easy to defeat (Score:5, Insightful)
Re:Fool it with a picture? (Score:2, Insightful)
Well, the technology may not be there yet, but conceptually, the strongest authentication available is some combination of voice and face recognition, as done by a human.
eg, if you want a new passport, in England, you have to take a picture, and get someone you know to certify it's a true likeness of you. How does that person know it is you? Well, by seeing how you look like, and listening to your voice. I guess?
So, from a theoretical point of view, this system is I feel sound. Just, maybe the technology is not quite there yet ;-)
Beards (Score:2, Insightful)
Denial of Service (Score:5, Insightful)
Method #1 - The Lens Scratch - No need for a special Key! You can use your own!
Method #2 - The Face Punch - Requires shockingly little computational resources!
Re:Fool it with a picture? (Score:3, Insightful)
If you consider just a camera (with no additional sensors spread over a large area), it is a crappy concept. Its the kind of concept that stops being viable once it starts being possible.
Only an awesome 3D camera with an extremely wide angle would not fall into the "just use a printed piece of paper" method. And that non-existent awesome camera would still fall for several other methods, such as well-built models of your face. Even if you're using awesome stereo vision from 2010, the same printed piece of paper in front of any cheap model of a human head will do.
And the kind of AI needed for a computer to detect a person using only image and sound is HARD. So hard that when we actually have this kind of AI, the cheap tech needed to fool it (the hell, to fool real people) will already be available.
The picture allows humans to recognise you. It is meant for humans and humans only.
It depends. If you can afford distributing sensors all over the place, it is POSSIBLE to avoid cheating. You can add cameras and distance sensors over a large area and youll stop most forms of cheating. High-tech cheaters can get away by standing in front of the system and using a special set-up to project a different image inside the camera.
If all you want is a small sensor embedded on a laptop computer, its a stupid concept.
Re:Ehmmm... Photo? (Score:5, Insightful)
The facial recognition has been circumvented on these with a photo of moderate quality. Since the camera doing the recognition is a 1.3mp camera, the absolute most you'll need to beat it is a 2mp photo, and likely a lot less than that will work. A new/clean driver's license photos might work, but a worn one probably wouldn't.
The only way I see them preventing a simple photograph from circumventing this is using two cameras, scanning at different angles, and making sure the two images are slightly different but still match. In that case you would need a fairly complicated rig to get the cameras to look at two photos at once in order to fool them. Much better, but not exactly secure.
As it is now, these are even less secure than fingerprint readers, which can be beaten with a lifted fingerprint (laptop readers require a transparency, but doors can be done with black dust and tape).
The reality is biometrics never work like the movies. An image of your face can be recorded in high enough quality to fool a scanner, your voice can be recorded in high enough quality to fool a scanner, a good camera (around $1k or so) can even get a high quality copy of your retina from a long enough distance that you'd never know it happened, which could then fool a scanner. Fingerprints have always been a joke to bypass. In many cases you can lift the necessary print right off the scanner - you might as well have a sticky note on the screen with your password on it.
All of them are easier to bypass than a simple non-dictionary password. A pass-phrase is several orders of magnitude more secure than the lot, and the easiest to remember. It's only when you want to make passwords super secure that people start writing them on stickies and slapping them on their monitors (note that I have actually experienced this in secure government facilities - it's extremely common when very complex passwords are required). You might as well just use biometrics then, for all the good it is doing you.
Re:Terrible Idea (Score:2, Insightful)
What about combining this with a normal password? Then an attacker would need both your picture and your password.
OTOH, you might want to keep a picture of yourself, in case you get injured at your head and the bandage makes your computer not recognize you.
Re:so... (Score:3, Insightful)
Why just dandy, it will unlock for both of them! And anybody who has a decent photo of either of them too!
Seriously, the current state of biometrics are laughably insecure. A simple non-dictionary password, even a 6-8 digit PIN, beats a biometric lock any day of the week.
Basically, when you see a machine or door with a biometric lock, it's like securing your wireless network with WEP. All you are doing is saying "Please don't break in - thanks!" You aren't actually protecting anything.
Until they can reliably tell the difference between a photo and a live image (they can barely recognize dark faces, let alone discriminate against a photo) this is less than worthless. The same is true for all biometrics - fingerprint scanners can often be beaten with dust and tape, and if not a transparency of the print works as well as the original.
Oh come on (Score:4, Insightful)
People still don't get it.... (Score:2, Insightful)
1) They are a secret
2) They can be changed at will
3) They don't require a physical feature (you can keep them in your mind).
Biological features are thought to be great because of their uniqueness. But the problem is that once they are compromised, it is permanent. So they are never good by themselves.
Re:It doesn't work. (Score:3, Insightful)
"Sometimes it won't let me in even though is my exact same face (maybe different way of combing it)"
You comb your face? Just get a razor, man!
Re:Who the hell would trust this? (Score:3, Insightful)
You would need either two or 3 cams to pass the 3d test.
Actually that would get past the photo issue, but you'd need to put the cameras on other end of the laptop corners.
Re:Who the hell would trust this? (Score:3, Insightful)
Why not ? (Score:3, Insightful)
1- The best security is something you know + something you have, so password + face sounds good.
2- Oftentimes, when you use only one of the two (password, key card...) or even with both, people misuse security so much (staying logged in, reusing passwords, weak passwords...) that face on its own feels better.
3- And it can re-authenticate periodically without being too intrusive, which is good, too. It could maybe even detect as soon as the user changes ?
The one question is , how often do webcams fail, because the day I'm locked out of my computer by a faulty cam, I'll be pissed.