<http://www.nytimes.com/2003/03/13/technology/circuits/13next.html?tntemail0=&pagewanted=print&position=top>
March 13, 2003 Recognizing the Dance on the Dotted Line By IAN AUSTEN IN the movies, biometrics can give a high-tech sheen to an ordinary task like establishing that someone is who he says he is. Lasers scan retinas or glass plates read fingerprints before hidden machinery will open doors, which invariably slide rather than swing. But a system to verify the identity of credit-card shoppers could soon be based on an old-fashioned, even ancient, piece of biometric information: the handwritten signature. "Signatures are a biometric," said Thomas G. Zimmerman, a computer scientist at the I.B.M. Almaden Research Center in San Jose, Calif. "The dance of your hand on the paper is unique to you." Biometric handwriting recognition could eventually free shoppers from carrying credit or debit cards. At the very least, proponents say, a signature system could make stolen cards useless and could reduce fraud in several other ways. Biometric handwriting systems have little in common with current methods, in which the signature a shopper scribbles on a paper receipt or a digital tablet is compared with the signature on the back of the card. It doesn't take a master forger to produce a signature that can pass muster with a harried cashier. Criminals who forge cards simply put their own signatures on the back. By contrast, in biometric systems the appearance of the signature matters little. Instead, it is the act of signing that counts. Decades of research at I.B.M. Almaden, Mr. Zimmerman said, have shown that signing is done almost unconsciously. "When you sign your name, you are moving your hand two times faster than you can control it," Mr. Zimmerman said. "But a forger is signing in a very controlled motion. They can't reproduce the cadence of the dance that your hand does." Shai Waisel, chief executive officer of WonderNet, a company in Israel, said development of its handwriting authentication system, now known as Penflow, began in part from a simple observation. "You can sign your name without looking," Mr. Waisel said. "People are signing their names without knowing what they're doing." The idea of using handwriting dynamics to authenticate signatures is not new. For several years, I.B.M. has sold a system based on the principle to banks and other financial institutions to authorize computer transfers of large amounts of money. But such systems use costly, specially made pens and require the transfer of relatively large amounts of data, making them impractical for retailers with thousands of cash registers. Two related factors, however, have prompted recent interest in developing dynamic signature systems for stores. Legislation passed in the fall of 2000 that gave electronic signatures the same legal validity as ones made with pen and paper prompted many retailers to install digital signature pads. Currently the electronic pads' main function is to provide a substitute for paper records of credit card sales. But I.B.M., WonderNet and the Communication Intelligence Corporation (the company behind Jot handwriting software for digital assistants) all say the pads can also be used to provide signature verification. While the three companies' systems vary in some details, they all take the same basic approach. Before using any of them, customers will have to create three to six sample autographs using a digital pad. Software will carefully time every movement and change of direction of the pen. When a customer signs a digital pad while making a purchase, the timing and pen direction will be matched against the stored record. (More sophisticated pads can add pen pressure and other factors into the comparison.) If such systems were widely adopted, Mr. Zimmerman said, it would be possible for people to abandon plastic credit cards. When making a purchase, a shopper would identify himself by typing a number (a telephone number, say) on a keypad at the cash register, then sign a digital pad. At the very least, Mr. Waisel of WonderNet said, credit card companies could eliminate the signatures and other personal details from cards, making them less attractive to thieves. Guido DiGregorio, chief executive of Communication Intelligence, said that online sales would be one of the first areas to realize security improvements from signature verification systems. A shopper could place a hand-held computer in a cradle connected to a PC and verify purchases by autographing its handwriting recognition area. Those with wireless Internet connections could bypass desk-bound computers altogether. Right now, the technology companies seem to be well ahead of retailers, at least in the United States. Richard Mader, executive director of the National Retail Federation's technical standards branch, said he had not heard the idea discussed within his industry. But at least in theory, he said, dynamic handwriting analysis might appeal more to merchants than systems that use iris scans or fingerprints because it requires no additional hardware at cash registers in stores that already digitally capture signatures. Mr. Mader said retailers would have to be convinced that the systems would not mistakenly reject legitimate cardholders. Whether related to credit or identity, such mistakes could mean lost sales and damaged customer relations. Unlike fingerprints, signatures and how they are written can vary. A shopper holding a cranky child will not sign the same way he or she might while at a desk. Similarly, people's signature patterns gradually change over time. Communication Intelligence tries to limit a customer's ability to vary his signature as much as possible, Mr. DiGregorio said. False rejections, he suggested, could be avoided simply by having clerks ask for another piece of identification. At WonderNet, variations are welcomed as a way to increase security by building a more nuanced profile of a customer's handwriting dynamics, Mr. Waisel said. Revelers, however, might be advised to carry plenty of cash if handwriting verification becomes the norm. All three companies agree that there is a situation that no system will be able to handle. "If you're really drunk and having trouble signing," Mr. Zimmerman said, "I've got to reject that." -- ----------------- R. A. Hettinga <mailto: [EMAIL PROTECTED]> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
