Reliability vs. Cost

Methods of identifying people fall into three general categories of increasing reliability — and increasing equipment cost:

• What you have
• What you know
• Who you are

What you have -- Least reliable (can be shared or stolen)

What you have is something you wear or carry — a key, a card, or a small object (a token) that can be worn or attached to a key ring. It can be as “dumb” as an old fashioned metal key or as “smart” as a card having an onboard processor that exchanges information with a reader (a smart card). It can be a card with a magnetic strip of information about you (such as the familiar ATM card); it can be a card or token having a transmitter and/or receiver that communicates with the reader from a short distance (a proximity card or proximity token — Mobil Speedpass® is an example).

What you have is the least reliable form of identification, since there is no guarantee it is being used by the correct person — it can be shared, stolen, or lost and found.

What you know -- More reliable (can’t be stolen, but can be shared or written down)

What you know is a password, code, or procedure for something such as opening a coded lock, verification at a card reader, or keyboard access to a computer. A password/code presents a security dilemma: if it’s easy to remember, it will likely be easy to guess; if it’s hard to remember, it will likely be hard to guess — but it will also likely be written down, reducing its security.

What you know is more reliable than What you have, but passwords and codes can still be shared, and if written down they carry the risk of discovery.

Who you are -- Most reliable (based on something physically unique to you)

Who you are refers to identification by recognition of unique physical characteristics — this is the natural way people identify one another with nearly total certainty. When accomplished (or attempted) by technological means, it’s called biometrics. Biometric scanning techniques have been developed for a number of human features that lend themselves to quantitative scrutiny and analysis:

• Fingerprint Hand (shape of fingers and thickness of hand)
• Iris (pattern of colors) Face (relative position of eyes, nose, and mouth)
• Retina (pattern of blood vessels)
• Handwriting (dynamics of the pen as it moves)
• Voice

Biometric devices are generally very reliable, if recognition is achieved — that is, if the device thinks it recognizes you, then it almost certainly is you. The main source of unreliability for biometrics is not incorrect recognition or spoofing by an impostor, but the possibility that a legitimate user may fail to be recognized (“false rejection”).