Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Science Technology

Mouse Scans Palms to Verify ID 145

p00kiethebear writes "'Fujitsu is eyeing a variation on the centuries-old art of palmistry as the latest biometric weapon against unauthorized access to computer systems and facilities. The company has developed a computer mouse that will scan the palm of the user and deliver not a look into the future but verify the identity of that person.', With a .5% error rate I wouldn't be surprised if we saw this in offices within the next few years."
This discussion has been archived. No new comments can be posted.

Mouse Scans Palms to Verify ID

Comments Filter:
  • Slashvertisement? (Score:2, Informative)

    by Speare ( 84249 )

    There've been thumb-reading mice for a while now. google: thumb biometric mouse [google.com] This isn't news, it's another slashvertisement.

    Yawn.

    • Here's the good part.

      The thing attaches to an ordinary PS/2-style mouse port. That's a secure channel!

      So anybody who can land a trojan on the box, can easily capture the valid auth dialogue with the device...

      It wouldn't be too tough to have a bogus "print" stored electrically, and rep[lay it either from the actual port, or read from a location in memory.

      • Actually, now I think of it, there is a HUGE contact area on this thing! Must leave a great print on the reading surface! What an opportunity for capturing palm-prints for forging access.
        • Must leave a great print on the reading surface! What an opportunity for capturing palm-prints for forging access.

          Actually, that's one improvement that this system has over the easily-fooled fingerprint based systems. Since this system uses reflectance measurements from the palm that are affected by deep structures (veins), the palm print left on the mouse won't do a potential cracker any good.

          That said, I suspect that the system really isn't worth the trouble. Other posters have noted that the mouse connects to an ordinary PS2 port, so there's an opportunity for a spoof right there. And the 0.5% error rate sounds good--but only if those are all false negatives. If the system is misidentifying users 0.5% of the time for a database of 700 users, then there will be a truly embarrassing failure rate in a corporation of, say, ten thousand users.

          • by boskone ( 234014 )
            Best practices in security would dictate that this is just part of a strong authentication scheme. I would require users to still use login/password. The chances of the reader misreading and having someone's user/pass is very remote.

            Theoritically, someone could record someone's palm print inline on the ps/2 port, and watch them type their user/pass, then come back later with the spoofing device containing the correct responses to hook inline to the ps/2 port again and log in as that person. But you're talking about a BIG operation to pull this off, plus a lot of chances of getting caught. (you have to physically access their computer twice, PLUS somehow get their user/pass).

            I think it could have a use, but it will need to be integrated into NDS/AD elegantly for it to catch on in the enterprise. And it must be low hassle to implement.
            • Of course, since we have physical access to the machine anyway, we might as well install a keystroke logger as well as record the authentication from the mouse...

              I guess it comes back to what we already knew--as soon as someone has unfettered physical access to a machine, it's security is effectively compromised.

              You want to limit access to a computer? Put it in an office. And lock the door. Know who has keys. Audit those keys.

            • Re:Slashvertisement? (Score:2, Informative)

              by Anonymous Coward
              "The chances of the reader misreading and having someone's user/pass is very remote." Read up on your Schneier. There are 3 types of security--something you have (smartcard), something you know (PIN), and something you are (biometric). The best security should use all 3, like NYSCEDII. And then you should plan on your Ultra Secure System(tm) being compromised. Because sooner or later, it will be. Posting anonymously because this is probably Redundant.
  • heh.... (Score:4, Funny)

    by bdowne01 ( 30824 ) on Sunday September 29, 2002 @12:11PM (#4354106) Homepage Journal
    A lot of good that does from keeping someone from typing 'rm -rf *'. :)
  • by theefer ( 467185 ) on Sunday September 29, 2002 @12:11PM (#4354107) Homepage
    Now you'll eventually have a reason to wash your hands : if you don't, you won't have access to the computer !

    Mom's gonna be happy ...
  • by czion3 ( 612261 )
    In the office can't you just have security guards and tell the employees to lock the door's.
    • In the office can't you just have security guards and tell the employees to lock the door's.
      For the same reason you can't set an IT policy of logging out of your workstation, or changing your password to something different every month or two, or not leaving confidential documents lying face-up on your desk while you visit the powder room or make a coffee run - because it's less convenient for the employee to take minor security measures.

      Anything that 'wastes an employees time' ('cuts into employee productivity') are seen as Very Bad Things<tm> in the big bad corporate world of bottom-lines and statistics.

  • Well, why not? Most mice are optical now anyway, this certainly gives that term a whole new meaning...
  • The Switch (Score:3, Interesting)

    by espionage_7 ( 605753 ) on Sunday September 29, 2002 @12:12PM (#4354113)
    Well I would just switch out the mouse with one of my own =)
  • by Anonymous Coward
    if you execute every desktop action using keyboard shortcuts only? I imagine after 10 minutes a popop window appearing: "the computer mouse feels lonely, please pet the mouse a little".
  • .5%? (Score:2, Interesting)

    by Anonymous Coward
    .5% Error Rate means if 1 million people use it, 5000 are going to have errors. That makes it pretty significant. If that half a percent get locked out completlely or half a percent get can get onto other computers without being the right person, then there are still issues to be worked out before it's used widespread.
    • Re:.5%? (Score:2, Insightful)

      by The Whinger ( 255233 )
      Or it means that it gets it wrong 5000 times in 1 million. If it locked me out, and I retried and got in ... then there is no problem with a 0.5% error.
    • and also 1 in 200 will have errors :)

      -Kevin

    • 5% means that if I put my hand on the mouse and it doesn't work, I just remove my hand for a moment, and then put it back on the mouse. Chances are that I'd be in after 20 times.
  • Why a mouse? (Score:3, Interesting)

    by Pyromage ( 19360 ) on Sunday September 29, 2002 @12:15PM (#4354125) Homepage
    Why use a mouse? I mean, mouses are subject to so much wear and tear that the sensors and lenses have to be real beaten on. I don't see a reason not to have a palm-checking USB device instead.

    Something just used for recognition would seem to be a bit more practical. Cheaper because size wouldn't be a significant factor, and also it'd be easier to lock down against theft.

    But a mouse is just asking for trouble. Its got a .5% error rate when clean, but what about when six months old, sweaty, covered in coke, chips, and bodily fluids and has been used for 8 hours a day for the last half year?

    A mouse is a bad idea.
    • what about when six months old, sweaty, covered in coke, chips, and bodily fluids

      Jeez, I'd hate to shate a machine with you! :- )
    • by Anonymous Coward
      sweaty, covered in coke, chips, and bodily fluids and has been used for 8 hours a day for the last half year

      Are we still talking about a mouse here?

    • Re:Why a mouse? (Score:2, Interesting)

      by Calvinhood ( 244352 )
      Because using a mouse you can make the scanning process completely transparent to the user. Heck, hide it well enough, and they don't even have to know about it.

      This could be useful because you now have a way to actually catch unauthorized people trying to get into your system instead of simply keeping them away. Consider this scenario: For whatever reason, Joe Evil manages to get to a computer that's logged on to a network that contains sensitive information. Gleefully, he sits down and uses the mouse to open up windows explorer and starts looking for a client list or something. Meanwhile, the mouse has detected that this person isn't authorized to be on the system, so it's notified security and also loaded a system image that contains totally bogus data for Joe to explore. Joe has no idea that he's accessing false data or that two hulking brutes from security are on their way to have a...discussion with him.
    • The reason that you can fool the present bio system is that they check once or at an interval, and then only a small part of the body.
      With this system they could continuly test and over a wider part of the body. Also you could start to test the way that the user hold the mouse, which adds another factor which could be hard to duplicate.
    • Well yeah.

      Finally, there's a convenience involved in various devices on the USB tree not being able to communicate with each other without relaying through the computer.
  • Comment removed based on user account deletion
  • I do not know about you but I never place rest my palm on the mouse. To do so I find is inconvenient, annoying and impedes my work. Hell even on by ball mouse only 4 finger usually touch it.
  • I wonder how the workplace environment affects that 99.5% accuracy rating. I don't know about anyone else, but most computer mice I've seen seem to be dirt magnets.

    They didn't seem to mention price .. from the description, it sounds expensive!
  • .5% Error Rate (Score:1, Insightful)

    by Anonymous Coward
    So once every 28 weeks, Mallet in the next cubicle is able to use my PC without authorization because the mouse mistook him for me. Or once every 28 weeks, my PC won't let me log on. Either way, I'm not terribly compelled to choose this product over a screensaver password.
    • "So once every 28 weeks, Mallet in the next cubicle is able to use my PC without authorization because the mouse mistook him for me."

      That's like saying once every 28 weeks I identify the color green as orange.

      "Or once every 28 weeks, my PC won't let me log on."

      Those odds sure beats running an IBM hard drive, they don't even last 28 weeks.
  • I'd much rather get my palm scanned than having my eyes lased. Unfortunately I use a laptop with a track-point so this solution is not for me.

    A wild take on some of the coming comments: "privacy inavsion", "Like the movie Gattica", "trating people as criminals" ...

  • Seriously, any person who really wants to access the computer, would just use keyboard shortcuts. All this will do is keep Joe schmoe 133t h4x0r script kiddie from gaining access. ...however if they implemented it into the tab key, I think that might do a little better.

    • From my reading of the article, this'll be pretty much a replacement for the login passwords. So you don't have a valid print, you can't use keyboard shortcuts.
      • They could easily make it so that the keyboard would be locked out untill the mouse verified the identity of the user.
        • NO IT CANT... god you dont know ANYTHING... jesus christ why dont you actually READ the article before you post about it. how would you feel if you submitted a story like that and people such as YOURSELF started posting threadcrapping BULLSHIT like you just did.
          • Um... I don't know what article you read, but I don't see anything in particular about the one that /. linked to which would prevent that idea from being used. Think of a screensaver: if you don't wake it up by having your palm scanned while moving the mouse, you won't be able to put in the password on the keyboard.
  • According to Fujitsu's PR [fujitsu.com], they're guessing that they can achieve a 5% equal error rate -- they actually identified all 700 correctly.

    Of course, this tells us nothing about how easily fooled the system is. Considering the recent success [counterpane.com] of a Japanese researcher in breaking fingerprint systems, I wouldn't trust this for a second.

  • If we saw people eating Jello in offices
  • In the article it states that Fujitsu conducted an experiment identifying a number of palms out of 700 palms and the system had an error rate of 0.5 percent.
    It does not state what kind of errors were made. Failing to identify a palm or, confusing two palms. In the latter case, the error rate goes up dramatically with the number of palms in the database.
  • Why? (Score:2, Insightful)

    by gleffler ( 540281 )
    When other 2-factor systems are much cheaper and more portable (think "This system doesn't have your palm, you can't use it"), why would someone WANT a biometric, palm-scanning whizbang mouse? RSA SecurID (keychain with a changing number, synchronized to a login controller) is a much better solution because it's got client software for many OSes, you can login to any machine that's set up properly just with the fob, and it doesn't freak people out like a palm-scanning mouse will, IMO.
  • My palm doesn't touch the mouse. I use my thumb and pinky to grip the sides with my fingers resting on the buttons. My palm is a good inch off of the top. I use to rest it on the mouse but discovered I hate that sweaty feeling. I changed my form to that more like a pianist would use. Works wonders for those long gaming sessions.

  • There is no one way to hold a mouse, besides having at least one finger on a button. How would this accomodate for the many and different ways to hold mice? backwards, forwards, upsidedown, sidewase, two fingers on the buttons only etc....
  • As traditional "gripped" mice are the most dangerous instrument for repetitive stress syndrome, most people will flat out refuse to use a device that slowly cripples you over time.

    Better come up with a trackball version, stat.
  • by Anonymous Coward
    from having to help every person that I come across that can't figure something in Microsoft Word or Internet Explorer.
    "Sorry, my palm won't work the mouse..."
  • Anybody think this'll actually get used very often? IN a wolrd that values simplicty of security, I doubt I'll ever work in a place that uses these. Not because I don't value security, but because I doubt the comapany would enough to employ these.
  • by neurostar ( 578917 ) <neurostar.privon@com> on Sunday September 29, 2002 @12:41PM (#4354241)

    I personally am not in favor of biometric protection devices. Even if they are 100% effective and never make mistakes reading, I do not feel that they are a wise choice.

    Bruce Schneider wrote a good column about biometrics here [counterpane.com]. I don't like the fact that some biometrics are very easy to steal. This means that once someone discovers your biometric "password" they can use it anywhere because you can't change your password.

    So I personally would be wary about having too much faith in such a device. /p neurostar

    • by JoeBuck ( 7947 ) on Sunday September 29, 2002 @08:54PM (#4356322) Homepage

      To paraphrase Schneider: if someone steals your palmprint (for example, by getting a print off a surface that you touched and making a duplicate good enough to fool the scanner), where do you go to be issued a new palm?

      Biometrics are ok if they are only part of what you need to get into the system (e.g. the right fingerprint plus the right password).

  • As several people have pointed out, locking the mouse would still leave us with keyboard access.

    Of course, the keyboard could also be locked, but who the hell would want to type with one hand on the mouse?

    Since neither of those options are good, the only thing left is to use it for authentication at the beginning of a session. So if I'm only going to use it as a fancy password (which is stupid anyway, considering the error rate), what benefit is there to having it on the mouse? None.

    And I believe we can all see the negative side-effects of sticking even more stuff on something we move rather aggressively all the time...
    • I suppose this would be good for authenticating most softcore computer users. I personally do not use the mouse much, and I don't think a lot of other people here do either.
  • If the mouse scans your veins every time you let go and grab it again, and it has a 0.5% error rate, wouldn't it just keep locking you out at random intervals?

    A palm scanner to get into some secret lab isn't a bad idea -- but a mouse that does scans your palm? It's like (approximate Simpsons quote) nuts and gum -- together at last!
  • by spoonist ( 32012 )
    This article [counterpane.com] from our friend Bruce Schneier is a good one on using gelatin to defeat biometric finger print authenticators:

    This gelatin fake finger fools fingerprint detectors about 80% of the time.

  • I like anyone else can see the benefit of such technology in the workplace or in the general enviroment of our lives, but has anyone thought about the downside to the technology at the same time?

    Criminals will have a slightly easier time getting access to systems they might not have been able to get to with the old personal ID number system. Unless you're of vulcan descent getting a PIN from someone's brain required some beating, but with the scanning technology all they'd have to do is chop a hand or gouge an eye and they'll have access to everything you did.

  • Hey, let me eat some of that gelatin [techtarget.com]...

    wow, I now have full access!

  • Let's hope they don't try and use this for verifying your age on porn sites. "SCANNING... *BZZT* ERROR. PALMS TOO HAIRY TO SCAN." :)
  • What ever happened to the SmartChair that reads ass-prints?
    • by Anonymous Coward
      What ever happened to the SmartChair that reads ass-prints?

      In your case that is the same as facial recognition technology.
  • Dan's Data did an interesting review [dansdata.com] of fingerprint scanners. Apparently they (well, that particular one anyway) are remarkably easy to fool - using jelly.

    Personally, I'm happy with passwords - you can change those...
  • Gosh, why don't they just embed a smart card under the skin in or around the palm area. I mean, what is to prevent me from beating up the guy with the palm this mouse system wants to use, and then forcing his hand ont he mouse to circumvent the security system? Besides, who uses a mouse in VI anyways. Real men just yank and paste lines with YY/P commands. Oh wait, thats right... the drivers for this only work in Windoze!
  • by carpe_noctem ( 457178 ) on Sunday September 29, 2002 @01:12PM (#4354356) Homepage Journal
    Will someone write an application for this mouse to read your palm? That would be a nice touch each morning when checking the 'ol inbox.
  • 'The company has developed a computer mouse that will scan the palm of the user and deliver not a look into the future but verify the identity of that person.'
    Well, if someone were to rewrite fortune for this, you would have a customized one every time you logged on!
  • I'm using a Microsoft Optical mouse on my main computer - I've been using this thing for about three years and where my thumb and pointer fingers rest against the plastic the silver paint has been completely worn away. The amount of wear and tear a security mouse would take in an office, especially with 'floating seating' like alot of call centers and programming cube farms have these days, would make this absolutely pointless.
  • by Anonymous Coward
    As it stands, the system of using passwords to prove identity is the best-working piece of the whole security puzzle. I'm not defending passwords; they are crappy and easy to "engineer". My point is that the rest of the security situation is worse off than that.

    Most of the security threats people have to worry about in the real world have to do with attacks that bypass authentication entirely (most buffer overflows), or that trick valid users into doing stupid things (most viruses), or that hijack the software valid users run into doing their bidding (most viruses and worms).

    Go over all the high-profile security issues of the past year. How many of them would have been mitigated by using biometric authentication instead of passwords? Few, if any. I'll bet 99% of the Klez E-mail I get has its true origin in a valid, properly authenticated user.
  • Hairy palms will interfere with the scanner.
  • Hey Bob, can you show me how to use this new app? Oh wait, I guess you'll have to tell me how to use it. Actually, this sucks... let's just go to your computer.

    I wonder if what they'll do about my laptop mouse.

    -a
  • Almost all computer users look at monitors. So put thoses inexpensie LCD cameras in monitors and do a face scan. Less engineering than a mouse.
  • by charlie ( 1328 ) <charlie AT antipope DOT org> on Sunday September 29, 2002 @02:10PM (#4354601) Homepage Journal
    Like a rather large number of people, I have atopic eczema. This means that patches of my skin get red, sore, and swollen, then subsequently dry out and turn flaky and opaque before falling off. It's unsightly, sometimes painful, and itches like hell -- but it's not infectious. Nor is it curable. (Spot the "opaque" bit. That's important, in the context of this gadget.) The only treatments we've got for it are palliative, and it can be triggered by stress, allergies, or other environmental. factors. Finally, just for fun, one of the commonest parts of the body to be affected is ... the palm of the hand.

    So now a visible percentage of the population are now going to be intermittently locked out of their computers by a stress-related illness. Isn't technology great?

    • Dude, the whole purpose of biometrics is NOT to increase security (while it might stop password guessing as an attack there are tons of ways to get past it). Its to reduce tech support costs because people forgot their password. As long as you use a reasonably strong password you have JUST AS GOOD of security as biometric scanning.
  • That may prevent me from chopping off your hand in order to gain access to your machine. Just a thought.

    The press releases for new identification technologies are so slick and appealing (in general), but all the "new" technologies suffer the same basic flaw: the determined individual can not be stopped whether that individual is set on stealing your files or crashing an airliner into a skyscraper.


  • "Yah! uh-huh...no. It's not contagious...sure... no, yes - yes I'll meet you there. The Bawls bar on 2nd right? uh-huh... yah! lemme just check my email"
    *click*
    Please identify!
    "Christ! I just went to the bathroom!"
    Place your palm in full contact with the mouse
    Stupid! {places palm on mouse}
    Identification incomplete
    "What?"
    Please state your name
    Rob
    full name
    Robert Malda
    Please state supplementary identifier
    "Which one?"
    Orientation
    "Lesbian!"
    OS Orientation
    "Linux"
    bzzzt!
    "BSD"
    bzzzt!
    "Oh for Christ's sake! -- OSX!"
    ding! Access granted.
  • by Anonymous Coward
    1. *click* remove mouse
    2. *click* plug in new mouse
    3. PROFIT!
    • I'm sure that since the mouse will have to scan your hand, there will be software on the computer involved. And because of that, don't you think the computer will not let any other mice work w/the computer? It will probably send a code to the computer.

      Coward.
  • So how long before someone writes a linux driver for it?
  • As flawed as this possibly is, imagine if in an airliner, the pilots and co-pilots stations only responded to authorized palms... otherwise it'd go into autopilot. Of course, control could be released by insertion of a secret code into a keypad that only certain ground security people would know and could tell the someone on the plane via radio in a pinch...
    • "Of course, control could be released by insertion of a secret code into a keypad that only certain ground security people would know and could tell the someone on the plane via radio in a pinch..."

      The more people that know that password, the more brittle it is. If you have hundreds of airports, and a few tens of people at each airport (someone has to be awake and not sick at all times) that know the code--there are thousands of possible places to get it from. And how easy is it to change? Make it too easy, and an accomplice will simply change it to a key shared by the terrorists.

      Technology is not a panacea. How about (bullet|blast)proof doors between the cockpit and passenger compartment? If no hijacker can get into the cockpit, they can't take over the flight.

  • Seems like a halfway decent idea, until, of course, you ask, does my palm actually touch the mouse. At least for me, my palm doesn't touch the mouse at all. If I wanted my palm to touch the mouse, my fingers would be dragging along in front of the mouse and my arm would have to be in a poor ergonomic position. Maybe they should check how people actually hold a mouse before they start doing things like this with it.
  • probability will indicate this scheme will fail at the rate of about 1.2 times a year on average -- assuming 250 working days and you only authenticate once per day. however -- if this was really implemented, people will probabbly time out after 15 minutes / out to lunch / in meeting / whatever; so it will fsck up probabbly every month or so. i dunno -- just seem like passwords are so much more reliable.
  • An article in c't (www.heise.de) a while back really opened my eyes as to how immature biometric testing still is. They managed to fool every system they tested (fingerprints and irisscan).

    The companies selling this stuff are really pushing this as 'secure' and the way the media are raving about this, I imagine a lot of ppl are fooled by this.

    Even when the system itself wouldn't be easily fooled I would hate to see what happens if people start bypassing this in hard/software. You would have to have physical protection of the hardware to avoid bypassing the scanner and have very ingenious software to make this secure.
  • See this Counterpane article from May. [counterpane.com]
    Seems to me the sOme common gelatin trick would work here as well...you just need more of it.

    Another issue that this may create - the chopping off of hands. Think about this...in the early 90's insurance companies tried to reduce their car theft losses by encouraging the use of car alarms and passive security measures (eg, only your key will unlock the steering column). The result...lower incidence of car theft..sort of. While noone now breaks into and steals a car parked on the street, the incidence of "car jacking" or the violent theft of a running car from the owner at gun point. More often than not this results in serious physical harm or evenb death to the car owner. That almost never happened in the "old days" before car alarms.....

    So this may, for access to the right kind of data, encourage the kidnapping of perwsons, the "removal" of a hand, and the making or a "hand cast" as in the article (a whole hand print is much harder to come across than a single fingerprint)to use to circumvent this "cool" mouse...

    So, be careful what you wish for....

  • I wonder if the jello finger trick works against it?
  • 0.5% (Score:3, Interesting)

    by Cryptnotic ( 154382 ) on Sunday September 29, 2002 @05:23PM (#4355513)
    Is that 0.5% rate the "false positive" or "false negative" error rate? If it is a false positive rate, then that means 1 in 200 times, the wrong person will be allowed access. That is much worse than the false negative, i.e., 1 in 200 times the correct person will have his authentication fail.

  • by skoda ( 211470 ) on Sunday September 29, 2002 @05:29PM (#4355537) Homepage
    [i]With a .5% error rate I wouldn't be surprised if we saw this in offices within the next few years[/i] A 1/2% error rate is a 1 in 200 error rate. That's not very good. That means you could walk through a large office and have a fair chance of being falsely recognized by the id system.
  • A second angel followed and said, "Fallen! Fallen is Babylon the Great, which made all the nations drink the maddening wine of her adulteries."
    9A third angel followed them and said in a loud voice: "If anyone worships the beast and his image and receives his mark on the forehead or on the hand, 10he, too, will drink of the wine of God's fury, which has been poured full strength into the cup of his wrath. He will be tormented with burning sulfur in the presence of the holy angels and of the Lamb
  • Remember that hoax a couple of years ago about a company that was going to implant ID chips in the palm of everyone's right hand, readable by the mouse to authenticate online purchases... ...intentionally recalling the passage in the Book of Revelations, "And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark, or the name of the beast, or the number of his name?"

  • Will excessive hair growth interfere with the readings?

"A mind is a terrible thing to have leaking out your ears." -- The League of Sadistic Telepaths

Working...