Defeating Facial Recognition Technology

I came across a copy of FxGaurd Windows Login software and was immediately intrigued by it's claims of "Computer Access Control with Face Recognition Technology". I purchased the software and eventually managed to get a licenced copy of FxGaurd Windows Logon 4.0 installed on my Laptop. The software offers the ability to replace the GNIA screen to Windows desktops with a WebCam capture that performs facial recognition for Authentication. It also supports encrypting files with faces. I immediately thought this sounded like a bad idea as my face, unlike my password, is usually given away freely everytime I pass a CCTV or other video capture system. After configuring the software and testing that I could authenticate to my Windows Desktop environment without the use of a password I tested wether the software could be defeated with a photograph or other copy of my facial features. I went to the nearest digital photo printing store and took photographs of my face and printed various sizes and resolutions of the images. I was then able to authenticate with a photo of my face under different lightening conditions and backgrounds (see screen shot below for amusing authentication requests).

The vendor claims the following "Embedded with state-of-the-art facial recognition technology, FxGuard Windows Logon 4.0 provides higher security than conventional password-based verification security systems for personal computers. FxGuard Windows Logon 4.0 ... allows users to log in their PC or notebook computers with a quick facial verification within one second. The problem of leakage of password or the difficult remembering of password is easily wiped out by your unique facial features and the advanced biometrics authentication technology." These claims do not appear to hold true after only rudimentary testing of the product solution.

The concept of adding an additional factor to an authentication process (facial image, hardware token or fingerprint) is not a new security concept and something that Facial Recognition could make affordable and cheaper to the desktop market, however the replacement of a single-factor authentication system which has stood the test of time (passwords) despite being flawed in their own right should never be done without thoroughly assessing any risk that maybe introduced by the replacement. Ideally the Facial Recognition Technology would work as an additional factor to authenticate to an environment and still require existing parts for authentication, adding an additional layer to the authentication process instead of replacing one. If passwords can be easily copied then how easy is it to obtain a photo of a targets face? The Web Camera used in this example was the built-in Lenovo Thinkpad E125. Discussions with friends have unearthed that software of this nature is now being supplied with Dell, Acer and Apple products amongst others. A nice piece of research pointed to me has been the CVDazzle project which is more aimed at protecting privacy by defeating facial recognition algorithims using make-up, the project homepage can be found here http://cvdazzle.com/. For now though, I think I will just stick to using a password!