Would allowing the user to login via a set of IPs with face recognition be a secure enough alternative?

Question

I'm trying to figure out how face recognition would be considered a valid and secure enough option of logging into an account.

The way how I see this works is as followed, the user logs into their account via password and enables logging into this account from the current IP address via face recognition. There is no option to provide an IP address. You must enable it for each one. Once the user logs out and wants to login again they can use face recognition which will look into the database for faces that match the user's IP address and on a match will automatically log a user in without the need to provide a username or a password.

Can this be considered a secure enough option to login and what are the risks?

Answer 1

Consider the scenario where a co-worker obtains a photo of someone's portrait, and prints it out. They then use the same network (and thus public IP) to log in, holding that printout up to the webcam. They are then logged in, because the face recognition recognises the face, and the IP is the same.

Face recognition involves "something you are," to which the additional security factors are "something you know" (password, etc.) and "something you have" (token, etc.) Face recognition in combination with something that falls under either of the latter two would be more secure, though you have to weigh up its cost-benefit ratio and whether "something you have" is still compromisable, depending on the situation.

Answer 2

"Secure Enough" depends entirely on your threat, the data you're securing, and if the user has access to local, and or networked resources.

Since you're securing by IP, I assume you're securing an intra or external network.

The only solution I'm aware of that allows you to login via camera is the Intel3d camera.

I asked a similar question below.

How secure is Windows Hello when used with Intel 3D facial recognition?

Answer 3

Absolutely not. Password reuse is already a problem now. What you are doing is actually enforcing password reuse. If your website could become successful enough, someone else will learn. At one point your roommate could build a website targeted you that also use this mechanism as you believed, but it actually passes what is transfered to their server to the roommate's computer, and then the original service.

Needless to say logging in using IP alone isn't secure. But you don't seem to understand this. Say you are working in a secret nuclear project, and no employee there would leak any of the informations. Does that mean you could easily tell everything to a coworker's girlfriend? Say you are running a bank. What happens if a parent sues you because their child steal their money (colluded or not)? And logging in using face recognition alone isn't secure. Combining two insecure mechanisms could hardly get you a secure one.

An obvious improvement to IP authentication is to use tokens (with or without also checking IP depending on situations). In other words, just keep them logged in. Why would they log out at all if they know they are in a secure location?

If the users are supposed to install some programs to use your service, you may also provide the option using face recognition on the client to "lock" the token string, as a precaution by the user. It probably won't be too useful in Windows. But for Android, it might be not that easy for a guest to root your device, extract the token string and restore your device to the original state in a few minutes without being noticed.

I guess you can also use face recognition in addition to passwords to improve the "security" in some special cases such as, you want to disallow users to resell their accounts to someone else, or want to make sure every user knows they are not accidentally using the wrong account for some reason.

Answer 4

Honestly, I'm not sure I agree with this. Face recognition software uses patterns based off of the dimensions and angles of ones face. I'm not sure a simple picture would be enough to trick the system. A picture does represent an image of the target, it does not replicate the targets facial structure or dimensions in a 3d envirenment. Facial recognition software doesn't just use a picture of the person and match it with an existing picture, it also checks for things like eye spacing, nose angles, cheek definition, distance between chin and lips, lip curvatures, etc. Most software of this sort requires you to start out looking straight, then turn your head slightly right, left, then right again, then back to straight. While your doing this it is calculating all the key identifiers and dimensions of your face and matching those to what is saved from the original scan. That is hard to emulate with a picture. Maybe a picture will work for less complicated software, but if the op is going to go through the trouble of all this, I don't think he/she is going to buy the kmart special.

Now, I would be more worried about users being locked out due to tanning, (changes complexion of user), facial gesture not matching via smiling/not smiling it changes dimensions of face, weight gain or lose, etc.

Honestly, this is kind of a loaded question, really it all depends on the hardware and software capabilities of the product in question. Make sure you test the product before you buy it. Ask the developers if it uses 3d facial mapping, ask what its limitations are, does it do indepth comprehensive facial analysis, ie; does it check for width, length, depth, angles, etc. Does it check for background depth/vs facial placement. Most real facial recognition software (well what I consider to be real) will have these features. If the software doesn't use 3d mapping, and doesn't do point to point checks for unique key identifiers such as depth perceptions, distances, etc then look for something better.

When it comes to decisions like this you really get what you pay for. If you are trying to buy software only, and run the software with the built in camera, or a cheap external usb camera bought from staples or bestbuy then no, I would agree with Anders 100% and say anyone with a HD picture of the target would likely be granted access. If you plan on spending a lot of money and buy the whole system which includes a specialized camera that is made soley for this purpose, that has software that is specific to the camera designed to map the face correctly then I'd say yes, go for it. It all comes back to how much are you willing to spend, and is that expense really worth it.

Sorry Anders, I see your post count and know you're a veteran, with extensive knowledge in computer science. I'm just not sure I agree with you on this answer 100%. While you are correct in your statement about using the picture, that is only applicable with low end to mid grade (FTS).