The Password Is Dead

Active liveness prompts users to complete an action, such as a smile, frown, raise their eyebrows or wink. The firm is working on passive liveness, which instead of requiring the user’s participation will detect “the way light particles hit your cornea and how they’re absorbed, because the way that light particles are absorbed by human tissue is different from the way light particles are absorbed by paper or glossy paper or a video screen.”

Hoyos stressed the importance of distinguishing between authorization and authentication. With authorization, he said, “you may have somebody at an ATM claiming to be you, asking the bank to dispense money to them.” If the user has the right credentials, he or she can be authorized. With authentication, though, the system will “validate the identity of the person, plus it’s going to validate the identity of the device, and then it’s going to make sure that device is owned by the person whose identity has been verified,” Hoyos explained.

Biometrics are already being used by many different companies, Hoyos said. “Our company itself is engaged with probably about a dozen different companies at different levels of deployment to do everything from having the bank employees access their enterprise system, tying biometrics to active directories, [to having] customers access Internet banking and mobile banking,” Hoyos said.

Hoyos Labs aleady uses multiple biometrics to protect users’ identities, and Hoyos predicts the entire industry is moving in that direction. “Let’s say you have one lock on the door to your apartment, versus having two locks or three locks. If you have two locks, your apartment door’s going to be more secure. If you have three locks, you’re going to be even more secure, but it’s going to be more inconvenient. You have to use three different keys, or maybe you have a master key for all three of them, which would defeat the purpose. The point is, if you combine multiple biometrics, it’s the same thing as having multiple locks on the door. As you combine more locks, more biometrics in the same transaction, you enact more barriers to entry to the hacker.”

The HoyosID software can be used by any size firm, Hoyos said, even if the IT department is only one or two people. The cost of the service is based on each user per month. “In the case of active directory, for example, which is for employees to have single sign-on to their systems, it could be anywhere from $15 to $20 per year per employee. In the case of customers, it’s a fee that could be anywhere from 25 cents to 50 cents per customer per month,” he explained.

Hoyos noted that biometrics don’t represent a final step in preventing fraud. As long as there’s money to be made, there will be criminals ready to steal it. What this technology does provide, though, is “degrees of security.”

“Criminals and fraudsters are always going to outsmart these technologies. There’s no technology that’s 100% failsafe or foolproof. That doesn’t exist, and if anyone tells you that, you should immediately stop talking to them,” he said.