Facial Profiling

Forget your password again? This system turns the problem about-face.

• By Marc Barrera
• Sep 01, 2006

THE Internet can make many aspects of life easier, such as managing inventory, safety compliance, and worker's compensation claims; but the prospect of remembering more passwords isn't one of them.

Tom Hagan, executive vice president and CIO of ParadigmHealth Inc., a New Jersey-based health care management company that provides online information access to both patients and physicians, said his company has been forced to deal with the task of increasing security of online data while easing access to its users. "Millions of people are accessing personal health records and you need to put very strong authentication in front of those applications." But with anything involving e-commerce and consumers, the challenge is having very high security requirements, he added.

The large number of online users increases the probability that alpha/numeric passwords will be forgotten or misplaced when needed. This possibility requires ParadigmHealth to invest countless time and money in a support hotline and other backup options that provide customer support. These added costs are ultimately passed on to customers. "It becomes very difficult to support. When people forget their passwords, they need a place to call," Hagan said.

Left-Brain Thinking
The answer for ParadigmHealth came in the form of the Maryland-based Passfaces Corp. Using the brain's unique ability to recognize faces, a trait it is believed humans evolved in order to separate friend from foe, the passfaces™ software replaces traditional alpha/numeric passwords with a set of three to seven faces, each separately placed within a grid of nine faces, similar to the arrangement that began every episode of "The Brady Bunch" television show. Users identify the correct face in each series of screens in order to gain access. But how can one be certain that a person will recognize up to seven faces easier than remembering one password?

Research conducted by Professor Hadyn Ellis at the University of Wales Cardiff's School of Psychology has indicated that the left side of the brain has a special component whose sole function is to recognize faces. This innate ability allows infants to recognize their mother after only two days and adults to know within twenty-thousandths of a second when they have seen a familiar face.

Patricia Lareau, Passfaces vice president of product development, compares remembering alpha/numeric passwords versus passfaces to early school days when students hoped their test was multiple choice rather than fill-in-the-blank. "You remember when you were back in school, someone would ask you a question and you had to fill in the blank; that's a kind of a cued recall, and we hated those kinds of tests," she said. "And then there's recognition, where you would be given choices, and you'd recognize one of them. Recognition is by far the strongest form of memory and, because there's a part of the brain that focuses on faces, the recognition of faces is even more special."

Increased Security, Increased Ease
Hagan noted that other than easing the memorization process, the technology heightens security access by eliminating the ability to write down a password, give it to another person, or guess it. "If you make a password highly memorable, it becomes less secure. Passfaces works in the exact opposite way; it drives up security but makes it a lot easier to remember," he said, emphasizing that he particularly liked how the system prevents clients from passing access information to others. "You can't say, 'Oh, it's the person that looks like this and the person that looks like that.'"

Other steps have been taken to help the users make permanent associations with their selected passfaces. All faces are smiling because people are more likely to recognize a definite expression rather than a neutral look, and people prefer happy faces to sad or menacing ones. Another important factor is context. Adults tend to more easily recognize people whom they perceive as important to them. The importances of a user's passfaces are implied because they will always be used in the context of gaining access to a secure Web site or system. Also, the eight other decoys grouped with each passface will never change. This reinforces Semantic Priming, which occurs when the user's brain forms relationships with the correct passface and its decoys. If a user insists on a traditional alpha/numeric password, passfaces can be combined with one as part of a dual form of authentication.

Lareau said Passfaces' greatest strength is in its universal fit for Web-access applications. For example, if a company wants to restrict online access of employee information or access to online MSDSs for a particular plant thousands of miles away, rather than carrying a long list of passwords for each application, users would only need to remember one set of passfaces. As an example, Lareau mentioned one client company that allowed an employee to use passfaces instead of its traditional access items. Now, three years later, 95 percent of the client's employees use passfaces instead, and none have forgotten them.

Passfaces also has possibilities for applications beyond Web-access. Lareau cited the example of one client company that considered using passfaces with its fleet of forklifts. "It was more so they could have access right on the forklift," she said. "Workers would use passfaces to access their databases for the location of stuff in their warehouse."

Prosopagnosia
One drawback to passfaces technology involves the affected few that can't use it. Researchers differ greatly on the subject of prosopagnosia, or face-blindness, with the most extreme group believing that to some degree it affects as much two percent of the population. Yet, even this large estimate pales in comparison to the five percent of the population that suffer from dyscalculia, a sort of "number blindness." Some research suggests prosopagnosia is genetically inherited, while other research shows that it can occur as the result of suffering severe head trauma. Regardless of the cause or the extent of its proliferation, those affected are unable to recognize faces, even those of family members or their own. To work around this disorder, victims learn to identify acquaintances through other means, such as the sound of a person's voice or laugh, or a person's gait. In this instance, those affected would be forced to use traditional password methods or rely on a trusted colleague or family member when securing important information.

As industry continues to integrate with an increasingly wireless Internet, the need for a method to access these applications that is secure, easy to remember, and easy to use will grow. Passfaces is positioned, quite literally, to face these requirements head-on. "Internet access to Web applications has been the number one place for passfaces," said Lareau. "Regardless of what particular application it is, whether it's financial services or a health care portal like ParadigmHealth is doing, anyplace where you have multiple people coming from multiple places to access data, passfaces is a perfect authenticator."

This column appeared in the September 2006 issue of Occupational Health & Safety.

This article originally appeared in the September 2006 issue of Occupational Health & Safety.