Security and Risk Analysis at Yahoo

Leveraging Smartphone Hardware Capabilities for Authentication

Anna Roesler, Chirag Mahapatra, Isaac Long

Introduction
Password: most ubiquitous form of authentication Highly vulnerable security provided by the average password in 2012 has never been weaker. Three factors to consider in authentication schemes

2) Accelerometer Gesture Authentication

Hardware: Accelerometer Train your phone to recognize your signature or specific gestures

i) MoviSign App
Trained with Support Vector Machine Sign multiple times to get app to recognize 1.Advantages: May be hard to mimic a complex signature Signatures relatively unique 2. Disadvantages: May be easy to mimic a simple signature, if seen Need significantly large number of training examples Relatively high average false positive rate (8%)

Goals
Explore novel authentication scheme outside of the password Explore existing hardware on Android Phone Leverage existing research or apps in the market

ii) UWave App

Trained with Dynamic Time Warping App can detect who you are based on your gesture vs. library of stored gestures 1.Advantages: Only needs ONE training example per user 2. Disadvantages: Gestures may be easy to mimic, if seen Low error rate (6.5%), but very susceptible to malicious false positive attacks

End product: Android Authentication App

1) Voice Recognition
Hardware: Microphone Voice Biometrics: Physiological biometric component = voice, tone, pitch Behavioral biometric component = accent Apple has a patent application for voice authentication (for iPhone 6) speech input will access a restricted feature speech input will be compared to voiceprint 1. Advantages: not easily forgotten or lost unique to each person presence not required (can be done remotely) controlling phone without touching is important for safety 2. Disadvantages: Physical conditions of the voice (sickness) affects verification environment noise reduces accuracy storage requirement for voiceprint database can be very large a persons voice changes over time Googles Voice Recognition: What you say is sent to Googles data centers, which use statistical modeling and millions of voice recordings now the leading minds in tech like Apple co-founder Steve Wozniak and Microsofts Bill Gates all agree that this is the one thing that has immense potential to actually change the way we interact with our devices.
RESEARCH POSTER PRESENTATION DESIGN 2012

3) Fingerprint Recognition
Hardware: Touch Sensor

Apple iPhone 5S Touch ID

finger is placed on home button to unlock phone and make purchases 1. Advantages: quicker cant be forgotten or lost can program multiple fingerprints more secure dont need to worry about someone looking over your shoulder 2. Disadvantages dirty sensor surface sweaty fingers fingerprint information is sensitive; disastrous if stolen

4) Facial Recognition
Hardware: Camera

Visidon Applock
- User can unlock the phone based on identification of face 1. Advantages: - Highly conveneint method for authentication - Face is (relatively) unique - Eliminates problems such as password theft etc. 2. Disadvantages: - Invasion of privacy - Lot of bugs in the current implementation. Works poorly in bad lighting conditions.

www.PosterPresentations.com