Organizations relying on staff to inspect identity documents and compare photographs with faces are leaving themselves exposed to forgery and impersonation, FaceTec’s Geoff Slagle argues. A convincing document and a plausible resemblance do not establish that a credential is genuine or belongs to its presenter.
Slagle, FaceTec’s Executive Vice President of Digital Identity, discussed those weaknesses with hosts Tony Bitzionis and Alex Perala in the latest ID Talk podcast episode, ‘Why Looking at an ID Isn’t Enough with FaceTec’s Geoff Slagle.’
Drawing on nearly three decades in identity security and driver’s license standards, Slagle described two separate questions a verifier must answer: whether identity information comes from a trusted issuing authority, and whether the person using it is its rightful holder. Staff cannot be expected to recognize every document format, he said, while a legitimate card can still be presented by someone resembling its owner.
He also questioned verification processes that collect and retain images of identity documents. Slagle called that practice a “honeypot risk,” warning that accumulated personal information gives attackers valuable material if they gain access to the system storing it.
Data minimization, which limits the information a person must disclose, was one of the benefits Slagle identified in mobile driver’s licenses. “I should only have to serve up or provide the minimum amount of information to somebody, and not necessarily hand everything over,” he said.
FaceTec’s UR Codes, cryptographically signed biometric credentials carried in QR-format barcodes, are the company’s approach to checking both the issuer and the holder. Slagle explained that the codes contain compact biometric information and a digital signature. Verification software checks the signature, while a biometric comparison checks the person presenting the credential against the face data it contains.
He described retaining matching accuracy while shrinking biometric information to fit in a barcode as the central technical challenge. “Putting something in a barcode that doesn’t sacrifice the matching accuracy is a huge deal,” he said. The codes can be printed on paper, displayed on screens or incorporated into physical identity documents.
Existing applications include law-enforcement credentials and Project Lifesaver’s locator bracelets and identification labels. The nonprofit uses the codes to help community members and first responders identify people who have become lost or disoriented and access designated responder contact information.
Listen to the full ID Talk conversation, or find the episode wherever you get your podcasts.
–
By the ID Tech Editorial Team
