Adding an extra layer of security for Aadhaar holders by introducing face recognition in fusion with fingerprints and Iris is a move too late and dicey one, technology experts say.
According to Ankush Johar, Director of security solutions firm Infosec Ventures, face is a bad factor for authentication compared to iris.
Mr Johar said facial recognition might not do much good; as not only it isn’t too difficult to replicate as compared to other biometrics but also the major problem lies in the source of the images used as the authentication mechanism.
Elaborating the issue he said, the photographs captured nearly five years back, with an extremely low resolution camera, stands hardly any chance given that hackers were able to bypass even the 3D face model recognition developed by one of the biggest tech pioneers in the world.
It is pertinent to note that last year; a group of cyber security researcher was able to crack iPhone’s facial recognition technology just by using a $150 mask.
The cyber security firm posted a video on their official blog which showed that they had found a way to hack Face ID by using a composite mask of 3-D-printed plastic, silicone, makeup, and simple paper cutouts, which in combination tricked an iPhone X into unlocking.
Now given that Apple invested a big sum to develop the infrared based specialised hardware to capture a 3D image of a person’s face, it’s dicey how it would compare to the 3-5MP cameras used at the time of enrolment, said another IT professional .
The second problem is not only the security of facial recognition but the Accessibility of the technology. Do you look like yourself on your passport? Nobody does. Why? Because the image is old and you have changed since the time it was captured.
The biggest benefit of facial recognition is that you can change it while your physical attributes change and this sole feature isn’t available with UADAI’s mechanism. The base authentication token is pretty old and mainly one cannot update it.
This move by UIDAI, as great as it may be, might have just arrived too little too late. If originally, the faces of the consumers had been captured with at least a high definition camera if not an infrared based 3D facial recognition system, deploying it as an authentication of Aadhaar had been much easier, secure and reliable, said Pravin Prashant, a cyber security consultant.