Body Language Password glut got you down? Hackers scoff at password systems, anyway. Is biometrics the answer?

Back in the 1980s, I think I had one password-my ATM PIN number.OK, maybe I had a gate code number, too. Today, I must have 100passwords-who knows?

It seems as if a growing number of sites demand user names andpasswords-usually with special syntax that keeps me from using thesame pair everywhere. Then, I'm supposed to change them allperiodically for security's sake.

That's a joke. Research company Frost & Sullivan analystJason Wright reminds us that password systems are relatively lowhurdles for hackers breaking into our LANs, Web sites or e-mailsystems. The average hacker-more often than not, an employee-needonly run free password-cracking software like Lophtcrack against afairly obvious set of user names (such as Mike_Hogan, Mike Hogan,Mhogan and so on).

Consumers know this intuitively. In a recent survey byYankelovich Partners, 38 percent of respondents said privacy andsecurity concerns limit their online spending, and another 31percent said those concerns cause them to refrain from onlinepurchases altogether. In other words, real or perceivedshort-comings in Internet security hit entrepreneurs right in thebottom line.

But you may already have the solution to all your security needsright in the palm of your hand-or, more likely, at your fingertips.That's because biometrics offers an answer to all security andauthorization issues. These technologies rely on the uniqueness ofthe human body to identify individuals, literally measuring yourbiological features and behaviors. The technology can scan yourfingertips, hands, face, iris, retina, voice pattern or evenbehavioral characteristics. For example, there's a technologythat measures the way you hunt and peck on a keyboard.

Biometrics has long been used by government and corporate ITdepartments. Lately, it's gotten a lot cheaper and so reliablethat the chances of fooling a biometric scan are, like, one in abillion.

The technology is only now getting into the hands of consumersand businesses, although analysts believe the continued stronggrowth of biometrics in traditional venues will help jump-start itswidespread use on the Internet.

IDC predicts that biometrics sales to IT departments alone willgrow more than 60 percent annually to $1.8 billion by 2004. Butit's hard to be precise about a market that's just beingborn.

Mike Hogan, Entrepreneur's technology editor, canbe reached at mikehoganentrepreneur@juno.com.

Different Strokes

There are at least a half dozen different technologies andhundreds of vendors under the biometrics umbrella. Finger (orthumb) scanning accounts for the lion's share of sales-about 34percent in 1999, according to consulting firm InternationalBiometric Group (IBG)-and is expected to maintain its lead.However, none of the methods can be considered the optimalsolution.

"If you already have a telephone in your hand, the mostnatural thing in the world is to use voice scanning foridentification," says Samir Nanavati, partner with IBG."If you're already typing at a keyboard, the uniquepattern of how you type makes the most sense. And if you need anelectronic signature anyway, why not do a biometric match foridentification purposes?"

IBG showcases all the commercially available technologies at itsBiometric Store in New York City and on its Web site, which also includesvendor profiles, performance results and links to providers.

Finger scanners are easy to use and can fit easily intoperipheral devices, such as keyboards or Type II PC Cards. A goodexample of the latter is the Bio-Touch PC Card FingerprintReader/BioLogon software bundle sold on the Web site of marketleader Identix for $179 (allprices street). The optical fingerprint reader pops out from the PCCard slot when you press it-just like the phone jack on some modemcards. Identix also sells the technology to Compaq, Dell andToshiba, which offer it as an option for their portable PCs. Othertypes of readers made by Identix partners are found on its Website.

Relatively low (and falling) retail prices mirror precipitousdeclines in manufacturing costs and the retail prices of mostleading biometrics technologies. Retail prices have recently fallenbelow the important $100 threshold on a per-unit basis, saysWright. Identix used to sell the precursor to its currenttechnology to government and law enforcement for a minimum of$40,000 per installation. Now the per-unit original equipmentmanufacturer price is less than $20.

Prices are at the point that BioLink vice president of businessdevelopment Mike Thompson hopes to persuade major Web portals andfinancial institutions to buy his U-Match Biolink Mouse in bulk andgive it to their best customers as a premium. "It costs about$160 to get a customer and $200 a year to keep him," reasonsThompson, who maintains that biometric security is a good way fore-tailers to bind customers to their sites. U-Match and mostcompetitive finger scanners can already be configured to substitutefor your usual Web site passwords, says Thompson.

Of course, that only provides convenience, not added security.Truly secure browsing requires an appropriate authentication andauthorization server on the Web site, and those are only nowhitting the market. BioLink is putting the finishing touches on its$3,500 BioVault biometric Web server, and Identix is about to beginmarketing a Windows-compatible finger-scanning server.

According to Identix vice president Grant Evans, biometricservers could also benefit B2B e-commerce because, under therecently passed digital signature law, biometric authentication canbe substituted for your actual signature or used with card e-signtechnology to make a document legally binding.

Don't want to maintain a biometric server in-house? Vendorsplan to provide their services for a monthly licensing fee. Someare building partnerships with providers of related technologies inorder to offer a menu of services.

Privacy Concerns

With costs under control and accuracy unparalleled, the lastremaining issue to the adoption of biometrics seems to be alingering concern about its potential invasiveness, especially thetechnologies, like retina scanning of the back of the eyeball, thatrequire close proximity to a reading device. There's alsolingering concern that various hand scans could be used to collectfingerprints.

But that's not how it works. While biometrics may make youmore efficient at matching your Web site visitors to the customerprofiles you keep of them, it doesn't provide any moreinformation about the user at the point of access than the typicalpassword system. These concerns are usually ameliorated oncesomeone begins using the technology, says Nanavati, a process thatcan be accelerated if the consumer has control of the actual scantemplate on, say, a portable smart card.

Some templates can fit on a pen or even the magnetic stripe on acredit card. The complementary PKI, smart card and biometricmarkets got a boost this spring when Microsoft announced supportfor all of them in future Windows versions, making it easier tobuild servers using them all. Multifactor security or carrying a"hardware token" may be desirable for logging on to yourLAN or your online bank.

But carrying something around detracts from one of the bigselling points of biometrics-convenience. In most cases, the use ofrandom software keys in combination with biometrics should suffice,says Evans. After all, he points out, that's the beauty ofrelying on your body for security: "You can't leave homewithout it, you can never forget it and it doesn'tchange."

Contact Sources

• Frost & Sullivan, www.frost.com
• IDC, www.idc.com