Subject: [Speechsc] Just to see if anyone is still out there

From: Eric Burger <[email-masked]>
Date: Thu, 17 Jul 2008 08:07:08 -0400

For the folks who care about biometrics:
http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstrat=ts_071508&nladname=071508securitystrategiesal
_______________________________________________
Speechsc mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/speechsc
Supplemental web site:
&lt;http://www.standardstrack.com/ietf/speechsc&gt;

---

From: "Judith Markowitz" <[email-masked]>
Date: Thu, 17 Jul 2008 19:50:13 -0500

I was also noticing a lack of activity. What is the status of the newest
MRCP V2 draft? 

Judith Markowitz

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of Eric Burger
Sent: Thursday, July 17, 2008 7:07 AM
To: [email-masked]
Subject: [Speechsc] Just to see if anyone is still out there

For the folks who care about biometrics:
http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstra
t=ts_071508&nladname=071508securitystrategiesal
_______________________________________________
Speechsc mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/speechsc
Supplemental web site:
&lt;http://www.standardstrack.com/ietf/speechsc&gt;

---

From: William Meisel <[email-masked]>
Date: Thu, 17 Jul 2008 20:15:01 -0700

Am I missing something, or does the linked article (and the referenced
professor) simply misunderstand biometric id? Having the biometric token (a
fingerprint is the example) should neither allow the thief to recreate the
fingerprint (assuming it is features of the fingerprint that are
encoded--hopefully without announcing what each feature is) nor allow the
thief to access the system, since they would need to have the finger (not
the token) to do so. It would not be necessary for the individual to
reenroll a new finger.

The same is true of speaker authentication.

-- Bill 

Bill Meisel
President, TMA Associates
Publisher & Editor, Speech Strategy News
(818)708-0962
www.tmaa.com

> From: Eric Burger <[email-masked]>
> Date: Thu, 17 Jul 2008 08:07:08 -0400
> To: <[email-masked]>
> http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstrat=
> ts_071508&nladname=071508securitystrategiesal

---

From: "Judith Markowitz" <[email-masked]>
Date: Sat, 19 Jul 2008 11:52:12 -0500

Hi Bill, 
The attached article presents the picture in about as simplistic and naïve a
way as possible. Consequently, it leads the reader to false conclusions. 

Biometrics can be faked (called "spoofing") but it is generally not a
trivial process and, in most cases, it is done with the raw biometric data.
That is, fingerprint or face (etc.) images and voice recordings. It is much
harder to re-engineer a biometric model/template, although that is not
impossible. 

There are a number of ways to capture raw biometrics. The best way is to
hack a database that stores them. Other methods involve capture at the
sensor and on the transmission channel.  

If you look at these approaches to capturing biometrics you can easily see a
theme: security. You also see that the security that is needed (and too
often missing) has nothing really to do with biometrics, itself. It is the
same kind of security that is missing for PIN and password systems. So, it
doesn't really help much to have multi-factor authentication if all of them
are captured in transit or stolen from a hacked database. 

In short, if government and private industry would take the time and spend
the money to secure their networks, databases, and other systems many of
these threats would be eliminated. That's why the data interchange format
that I'm working on with the American National Standards Institute includes
encryption and supports other security. 

Judith Markowitz

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf
Of William Meisel
Sent: Thursday, July 17, 2008 10:15 PM
To: Eric Burger; [email-masked]
Subject: Re: [Speechsc] Just to see if anyone is still out there

-- Bill 

Bill Meisel

t=