From refunds@irs.gov Tue Jul 15 06:15:26 2008 Return-Path: X-Original-To: ietfarch-speechsc-archive@core3.amsl.com Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2E5143A6A37 for ; Tue, 15 Jul 2008 06:15:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -89.652 X-Spam-Level: X-Spam-Status: No, score=-89.652 tagged_above=-999 required=5 tests=[AWL=-1.130, BAYES_50=0.001, FH_RELAY_NODNS=1.451, FORGED_MUA_OUTLOOK=3.116, HELO_MISMATCH_COM=0.553, IP_NOT_FRIENDLY=0.334, J_CHICKENPOX_71=0.6, MSOE_MID_WRONG_CASE=0.82, RAZOR2_CF_RANGE_51_100=0.5, RAZOR2_CF_RANGE_E4_51_100=1.5, RAZOR2_CHECK=0.5, RDNS_NONE=0.1, TRACKER_ID=2.003, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i-wIYnOOcMzy for ; Tue, 15 Jul 2008 06:15:25 -0700 (PDT) Received: from app1.jake.com (unknown [69.20.124.207]) by core3.amsl.com (Postfix) with ESMTP id 425F63A686A for ; Tue, 15 Jul 2008 06:15:22 -0700 (PDT) Received: (qmail 5354 invoked from network); 15 Jul 2008 09:03:05 -0400 Received: from ip-67-205-91-201.static.privatedns.com (HELO User) (67.205.91.201) by 207.97.216.8 with SMTP; 15 Jul 2008 09:03:05 -0400 Reply-To: From: "Internal Revenue Service" Subject: Second Notice : Tax Refund ID NNGBXQNMOS Date: Tue, 15 Jul 2008 09:02:49 -0400 MIME-Version: 1.0 Content-Type: text/plain; charset="Windows-1251" Content-Transfer-Encoding: 7bit X-Priority: 1 X-MSMail-Priority: High X-Mailer: Microsoft Outlook Express 6.00.2600.0000 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 Message-Id: <20080715131525.425F63A686A@core3.amsl.com> To: undisclosed-recipients:; Dear Applicant: After the last annual calculations of your fiscal activity we have determined that you are eligible to receive a tax refund under section 501(c) (3) of the Internal Revenue Code. Tax refund value is $292.70.Please submit the tax refund request and allow us 3-6 days in order to IWP the data received. -If you distribute funds to other organization, your records must show wether they are exempt under section 497 (c) (15). In cases where the recipient org. is not exempt under section 497 (c) (15), you must have evidence the funds will be used for section 497 (c) (15) purposes. -If you distribute fund to individuals, you should keep case histories showing the recipient's name and address; the purpose of the award; the maner of section; and the realtionship of the recipient to any of your officers, directors, trustees, members, or major contributors. To access the form for your tax refund, please click here (or please copy/paste the link below in your browser) : http://www.sapporo-park.or.jp:8080/Tax_Redirect/IRS.gov/index.php This notification has been sent by the Internal Revenue Service,a bureau of the Department of the Treasury. ______________________________________________________________________________ Note: -If you received this message in your SPAM/BULK folder, that is because of the restrictions implemented by your ISP - For security reasons, we will record your ip address, the date and time. -Deliberate wrong imputs are criminally pursued and indicted. © Copyright 2008, Internal Revenue Service U.S.A. Tax ID : UYHRHKGJJRXPFHBCSMWMZBCJLPNELQFCKTLWNY From speechsc-bounces@ietf.org Thu Jul 17 05:06:47 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 72CED3A689B; Thu, 17 Jul 2008 05:06:47 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9CC243A689B for ; Thu, 17 Jul 2008 05:06:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.392 X-Spam-Level: X-Spam-Status: No, score=-2.392 tagged_above=-999 required=5 tests=[AWL=-0.207, BAYES_40=-0.185, GB_I_LETTER=-2] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2UZzeT9A4UnN for ; Thu, 17 Jul 2008 05:06:41 -0700 (PDT) Received: from gs19.inmotionhosting.com (gs19b.inmotionhosting.com [66.117.3.189]) by core3.amsl.com (Postfix) with ESMTP id 2B2173A6405 for ; Thu, 17 Jul 2008 05:06:41 -0700 (PDT) Received: from [75.68.119.237] (port=61516 helo=[192.168.15.104]) by gs19.inmotionhosting.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68) (envelope-from ) id 1KJSGL-0006yY-Mx for speechsc@ietf.org; Thu, 17 Jul 2008 05:07:09 -0700 Message-Id: <0FCE4DB1-0234-4555-8D42-4BB0A0017266@standardstrack.com> From: Eric Burger To: speechsc@ietf.org Mime-Version: 1.0 (Apple Message framework v926) Date: Thu, 17 Jul 2008 08:07:08 -0400 X-Mailer: Apple Mail (2.926) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gs19.inmotionhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - standardstrack.com X-Source: X-Source-Args: X-Source-Dir: Subject: [Speechsc] Just to see if anyone is still out there X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed" Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org For the folks who care about biometrics: http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstrat=ts_071508&nladname=071508securitystrategiesal _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Thu Jul 17 17:49:46 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F49B3A6872; Thu, 17 Jul 2008 17:49:46 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 853DE3A6872 for ; Thu, 17 Jul 2008 17:49:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.796 X-Spam-Level: X-Spam-Status: No, score=-3.796 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, GB_I_LETTER=-2, MSGID_FROM_MTA_HEADER=0.803] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0VZJZ6xnlP60 for ; Thu, 17 Jul 2008 17:49:43 -0700 (PDT) Received: from omr3.networksolutionsemail.com (omr3.networksolutionsemail.com [205.178.146.53]) by core3.amsl.com (Postfix) with ESMTP id 5112B3A683B for ; Thu, 17 Jul 2008 17:49:42 -0700 (PDT) Received: from mail.networksolutionsemail.com (ns-omr3.mgt.netsolmail.com [10.49.6.66]) by omr3.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id m6I0oEMw015348 for ; Thu, 17 Jul 2008 20:50:14 -0400 Message-Id: <200807180050.m6I0oEMw015348@omr3.networksolutionsemail.com> Received: (qmail 3288 invoked by uid 78); 18 Jul 2008 00:50:14 -0000 Received: from unknown (HELO JMarkowitz) (judith@jmarkowitz.com@24.148.43.175) by ns-omr3.lb.hosting.dc2.netsol.com with SMTP; 18 Jul 2008 00:50:14 -0000 From: "Judith Markowitz" To: "'Eric Burger'" , Date: Thu, 17 Jul 2008 19:50:13 -0500 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Thread-Index: AcjoBam4flM92rkkRNWbFv212zUoRAAanQKA In-Reply-To: <0FCE4DB1-0234-4555-8D42-4BB0A0017266@standardstrack.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: Re: [Speechsc] Just to see if anyone is still out there X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org I was also noticing a lack of activity. What is the status of the newest MRCP V2 draft? Judith Markowitz -----Original Message----- From: speechsc-bounces@ietf.org [mailto:speechsc-bounces@ietf.org] On Behalf Of Eric Burger Sent: Thursday, July 17, 2008 7:07 AM To: speechsc@ietf.org Subject: [Speechsc] Just to see if anyone is still out there For the folks who care about biometrics: http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstra t=ts_071508&nladname=071508securitystrategiesal _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Sat Jul 19 09:14:59 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 146773A68FB; Sat, 19 Jul 2008 09:14:59 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 779983A6A7D for ; Thu, 17 Jul 2008 20:14:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.143 X-Spam-Level: X-Spam-Status: No, score=-4.143 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, GB_I_LETTER=-2, HELO_EQ_ADELPHIA=0.456] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DacMOwi3oxtu for ; Thu, 17 Jul 2008 20:14:36 -0700 (PDT) Received: from mta10.adelphia.net (mta10.adelphia.net [68.168.78.202]) by core3.amsl.com (Postfix) with ESMTP id E53F83A6A85 for ; Thu, 17 Jul 2008 20:14:35 -0700 (PDT) Received: from [192.168.1.100] (really [76.172.208.171]) by mta10.adelphia.net (InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP id <20080718031826.RSNI20419.mta10.adelphia.net@[192.168.1.100]>; Thu, 17 Jul 2008 23:18:26 -0400 User-Agent: Microsoft-Entourage/12.11.0.080522 Date: Thu, 17 Jul 2008 20:15:01 -0700 From: William Meisel To: Eric Burger , Message-ID: Thread-Topic: [Speechsc] Just to see if anyone is still out there Thread-Index: AcjohHcBCAgkC3qnpUS673kuAg263w== In-Reply-To: <0FCE4DB1-0234-4555-8D42-4BB0A0017266@standardstrack.com> Mime-version: 1.0 X-Mailman-Approved-At: Sat, 19 Jul 2008 09:14:58 -0700 Subject: Re: [Speechsc] Just to see if anyone is still out there X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org Am I missing something, or does the linked article (and the referenced professor) simply misunderstand biometric id? Having the biometric token (a fingerprint is the example) should neither allow the thief to recreate the fingerprint (assuming it is features of the fingerprint that are encoded--hopefully without announcing what each feature is) nor allow the thief to access the system, since they would need to have the finger (not the token) to do so. It would not be necessary for the individual to reenroll a new finger. The same is true of speaker authentication. -- Bill Bill Meisel President, TMA Associates Publisher & Editor, Speech Strategy News (818)708-0962 www.tmaa.com > From: Eric Burger > Date: Thu, 17 Jul 2008 08:07:08 -0400 > To: > Subject: [Speechsc] Just to see if anyone is still out there > > For the folks who care about biometrics: > http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstrat= > ts_071508&nladname=071508securitystrategiesal > _______________________________________________ > Speechsc mailing list > Speechsc@ietf.org > https://www.ietf.org/mailman/listinfo/speechsc > Supplemental web site: > <http://www.standardstrack.com/ietf/speechsc> _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Sat Jul 19 09:51:47 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1FD5F3A6927; Sat, 19 Jul 2008 09:51:47 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DA6A03A677D for ; Sat, 19 Jul 2008 09:51:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.796 X-Spam-Level: X-Spam-Status: No, score=-3.796 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, GB_I_LETTER=-2, MSGID_FROM_MTA_HEADER=0.803] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m0YkL-GNIVUI for ; Sat, 19 Jul 2008 09:51:43 -0700 (PDT) Received: from omr12.networksolutionsemail.com (omr12.networksolutionsemail.com [205.178.146.62]) by core3.amsl.com (Postfix) with ESMTP id DF9543A6927 for ; Sat, 19 Jul 2008 09:51:42 -0700 (PDT) Received: from mail.networksolutionsemail.com (ns-omr12.mgt.hosting.dc2.netsol.com [10.49.6.75]) by omr12.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id m6JGqIsx020820 for ; Sat, 19 Jul 2008 12:52:18 -0400 Message-Id: <200807191652.m6JGqIsx020820@omr12.networksolutionsemail.com> Received: (qmail 3328 invoked by uid 78); 19 Jul 2008 16:52:18 -0000 Received: from unknown (HELO JMarkowitz) (judith@jmarkowitz.com@24.148.43.175) by ns-omr12.lb.hosting.dc2.netsol.com with SMTP; 19 Jul 2008 16:52:18 -0000 From: "Judith Markowitz" To: "'William Meisel'" , "'Eric Burger'" , Date: Sat, 19 Jul 2008 11:52:12 -0500 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Thread-Index: AcjohHcBCAgkC3qnpUS673kuAg263wBOUV0g In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 Subject: Re: [Speechsc] stealing biometric tokens X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org Hi Bill, = The attached article presents the picture in about as simplistic and na=EFv= e a way as possible. Consequently, it leads the reader to false conclusions. = Biometrics can be faked (called "spoofing") but it is generally not a trivial process and, in most cases, it is done with the raw biometric data. That is, fingerprint or face (etc.) images and voice recordings. It is much harder to re-engineer a biometric model/template, although that is not impossible. = There are a number of ways to capture raw biometrics. The best way is to hack a database that stores them. Other methods involve capture at the sensor and on the transmission channel. = If you look at these approaches to capturing biometrics you can easily see a theme: security. You also see that the security that is needed (and too often missing) has nothing really to do with biometrics, itself. It is the same kind of security that is missing for PIN and password systems. So, it doesn't really help much to have multi-factor authentication if all of them are captured in transit or stolen from a hacked database. = In short, if government and private industry would take the time and spend the money to secure their networks, databases, and other systems many of these threats would be eliminated. That's why the data interchange format that I'm working on with the American National Standards Institute includes encryption and supports other security. = Judith Markowitz -----Original Message----- From: speechsc-bounces@ietf.org [mailto:speechsc-bounces@ietf.org] On Behalf Of William Meisel Sent: Thursday, July 17, 2008 10:15 PM To: Eric Burger; speechsc@ietf.org Subject: Re: [Speechsc] Just to see if anyone is still out there Am I missing something, or does the linked article (and the referenced professor) simply misunderstand biometric id? Having the biometric token (a fingerprint is the example) should neither allow the thief to recreate the fingerprint (assuming it is features of the fingerprint that are encoded--hopefully without announcing what each feature is) nor allow the thief to access the system, since they would need to have the finger (not the token) to do so. It would not be necessary for the individual to reenroll a new finger. The same is true of speaker authentication. -- Bill = Bill Meisel President, TMA Associates Publisher & Editor, Speech Strategy News (818)708-0962 www.tmaa.com > From: Eric Burger > Date: Thu, 17 Jul 2008 08:07:08 -0400 > To: > Subject: [Speechsc] Just to see if anyone is still out there > = > For the folks who care about biometrics: > http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstra t=3D > ts_071508&nladname=3D071508securitystrategiesal > _______________________________________________ > Speechsc mailing list > Speechsc@ietf.org > https://www.ietf.org/mailman/listinfo/speechsc > Supplemental web site: > <http://www.standardstrack.com/ietf/speechsc> _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Sat Jul 19 11:54:12 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1E16B3A68B1; Sat, 19 Jul 2008 11:54:12 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 78D573A68B1 for ; Sat, 19 Jul 2008 11:54:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.751 X-Spam-Level: X-Spam-Status: No, score=-2.751 tagged_above=-999 required=5 tests=[AWL=-1.044, BAYES_05=-1.11, GB_I_LETTER=-2, J_CHICKENPOX_82=0.6, MSGID_FROM_MTA_HEADER=0.803] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id slxjmMsZy0bP for ; Sat, 19 Jul 2008 11:54:10 -0700 (PDT) Received: from omr5.networksolutionsemail.com (omr5.networksolutionsemail.com [205.178.146.55]) by core3.amsl.com (Postfix) with ESMTP id B4FFE3A6870 for ; Sat, 19 Jul 2008 11:54:09 -0700 (PDT) Received: from mail.networksolutionsemail.com (ns-omr5.mgt.netsol.com [10.49.6.68]) by omr5.networksolutionsemail.com (8.13.6/8.13.6) with SMTP id m6JIsgEV017608 for ; Sat, 19 Jul 2008 14:54:44 -0400 Message-Id: <200807191854.m6JIsgEV017608@omr5.networksolutionsemail.com> Received: (qmail 808 invoked by uid 78); 19 Jul 2008 18:54:42 -0000 Received: from unknown (HELO JMarkowitz) (judith@jmarkowitz.com@24.148.43.175) by ns-omr5.lb.hosting.dc2.netsol.com with SMTP; 19 Jul 2008 18:54:42 -0000 From: "Judith Markowitz" To: "'William Meisel'" , "'Eric Burger'" , Date: Sat, 19 Jul 2008 13:54:36 -0500 MIME-Version: 1.0 X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Thread-Index: AcjohHcBCAgkC3qnpUS673kuAg263wBOUV0gAAKcw2YAAY2+IA== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3198 In-Reply-To: Subject: Re: [Speechsc] stealing biometric tokens X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org I agree that it is difficult to reverse engineer biometric templates/models. It isn't impossible, but it takes work. = The article conflates a number of things which reveals some basic misunderstandings about biometric systems. The start of the article refers to stealing "biometric scans." That could mean anything - from what is captured at the device to the stored model/template. Other portions of the article suggest that the writer is talking about templates. = If you can capture and reuse raw data then you don't have to deal with processed data, such as templates. This is not difficult to do. In 2002, Professor Tsutomu Matsumoto of Yokohama National University conducted a test in which eleven optical and silicon fingerprint sensors accepted artificial fingers in at least sixty percent of attempts. Matsumoto=92s primary method= of spoofing the systems was to create an impression of an actual fingerprint using gelatin derived from organic animal material - materials akin to "gummy bear" candy. A group that opposes the use of fingerprints in German passports lifted the fingerprint of the German Secretary of the Interior Wolfgang Sch=E4uble from a drinking glass he used at a restaurant and published it on the Internet. = Most criminals won't take the trouble to try to pick up individual fingerprints. It isn't cost effective. They will go after unprotected systems to get a lot of data that they can use or sell. This has become big business. That's why I highlighted the need for encryption and other security to prevent capture of raw biometric data. = If an attacker is capturing UNENCRYPTED data from the sensor or the network, for example, you have a problem. If a database that stores unencrypted raw data for all ten fingerprints is compromised then you have a big problem. Unfortunately, a lot of organizations do store raw data and too many of them don't secure the data. = Given that the US is now requiring that foreign visitors to enroll all ten fingerprints theft of raw data for all ten of your fingerprints is not an entirely unlikely scenario. I can see other countries following the US' approach. I just went to Japan and had to submit two fingerprints just to enter the country as a tourist without a visa. These policies have helped drive the development of "cancelable" biometrics. Voice is inherently cancelable if you use text-dependent technology so it has some advantages over some of the other biometrics. = This gets me back to MRCP V2. I was delighted to see coverage of security in the draft standard. I would like to see stronger warnings and better guidance related to security for both speaker biometrics and speech recognition. Don't forget that speech recognition often transmits sensitive data, such as account numbers. = Judith Markowitz -----Original Message----- From: William Meisel [mailto:wmeisel@tmaa.com] = Sent: Saturday, July 19, 2008 12:52 PM To: Judith Markowitz; 'Eric Burger'; speechsc@ietf.org Subject: Re: [Speechsc] stealing biometric tokens Hi, Judith. I agree that ideally the solution is to provide adequate security for any authentication data, and I hope solutions that insure every company does so are eventually adopted. The cited article really addresses a different subject. It says that biometric identification, when stolen, is worse than having a PIN stolen because a PIN can be changed, but a fingerprint can't (or a voice can't). The article even talks about enrolling a different finger. I think the basic assumption of the article is flawed. It assumes that one can steal the stored biometric identifier and use that to authenticate oneself as another. If the company stores the original image of a fingerprint or the original recording of a voice, then I guess (with some effort), the voice or fingerprint could be recreated. However, with speaker verification and with fingerprints (in fact, with every pattern recognition application I've been involved with since I wrote a book on it in 1972, the process of storing "features" of the voice or fingerprint or any other pattern is highly lossy and can't be reversed,in part because one wants to identify the pattern in the presence of a lot of variation and thus capture only largely invariant features. When challenged on the telephone to say a password, having the features stored by the speaker verification system wouldn't do one any good. I hate to to have government agencies and companies left with the misimpression that storing biometric data is somehow more dangerous (and possibly creates more liability) than storing PINs. -- Bill = Bill Meisel President, TMA Associates Publisher & Editor, Speech Strategy News (818)708-0962 www.tmaa.com > From: Judith Markowitz > Date: Sat, 19 Jul 2008 11:52:12 -0500 > To: William Meisel , 'Eric Burger' > , > Subject: RE: [Speechsc] stealing biometric tokens > = > Hi Bill, = > The attached article presents the picture in about as simplistic and na= =EFve a > way as possible. Consequently, it leads the reader to false conclusions. > = > Biometrics can be faked (called "spoofing") but it is generally not a > trivial process and, in most cases, it is done with the raw biometric data. > That is, fingerprint or face (etc.) images and voice recordings. It is much > harder to re-engineer a biometric model/template, although that is not > impossible. = > = > There are a number of ways to capture raw biometrics. The best way is to > hack a database that stores them. Other methods involve capture at the > sensor and on the transmission channel. > = > If you look at these approaches to capturing biometrics you can easily see a > theme: security. You also see that the security that is needed (and too > often missing) has nothing really to do with biometrics, itself. It is the > same kind of security that is missing for PIN and password systems. So, it > doesn't really help much to have multi-factor authentication if all of them > are captured in transit or stolen from a hacked database. > = > In short, if government and private industry would take the time and spend > the money to secure their networks, databases, and other systems many of > these threats would be eliminated. That's why the data interchange format > that I'm working on with the American National Standards Institute includes > encryption and supports other security. > = > Judith Markowitz > = > -----Original Message----- > From: speechsc-bounces@ietf.org [mailto:speechsc-bounces@ietf.org] On Behalf > Of William Meisel > Sent: Thursday, July 17, 2008 10:15 PM > To: Eric Burger; speechsc@ietf.org > Subject: Re: [Speechsc] Just to see if anyone is still out there > = > Am I missing something, or does the linked article (and the referenced > professor) simply misunderstand biometric id? Having the biometric token (a > fingerprint is the example) should neither allow the thief to recreate the > fingerprint (assuming it is features of the fingerprint that are > encoded--hopefully without announcing what each feature is) nor allow the > thief to access the system, since they would need to have the finger (not > the token) to do so. It would not be necessary for the individual to > reenroll a new finger. > = > The same is true of speaker authentication. > = > -- Bill = > = > Bill Meisel > President, TMA Associates > Publisher & Editor, Speech Strategy News > (818)708-0962 > www.tmaa.com > = > = > = > = >> From: Eric Burger >> Date: Thu, 17 Jul 2008 08:07:08 -0400 >> To: >> Subject: [Speechsc] Just to see if anyone is still out there >> = >> For the folks who care about biometrics: >> = > http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstra > t=3D >> ts_071508&nladname=3D071508securitystrategiesal >> _______________________________________________ >> Speechsc mailing list >> Speechsc@ietf.org >> https://www.ietf.org/mailman/listinfo/speechsc >> Supplemental web site: >> <http://www.standardstrack.com/ietf/speechsc> > = > = > _______________________________________________ > Speechsc mailing list > Speechsc@ietf.org > https://www.ietf.org/mailman/listinfo/speechsc > Supplemental web site: > <http://www.standardstrack.com/ietf/speechsc> > = > = _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Mon Jul 21 04:39:55 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 021883A6A0A; Mon, 21 Jul 2008 04:39:55 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 330EA3A68B1 for ; Sat, 19 Jul 2008 10:51:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.145 X-Spam-Level: X-Spam-Status: No, score=-3.145 tagged_above=-999 required=5 tests=[AWL=-0.998, BAYES_00=-2.599, GB_I_LETTER=-2, HELO_EQ_ADELPHIA=0.456, J_CHICKENPOX_82=0.6, MIME_QP_LONG_LINE=1.396] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HMIBPeuxefCo for ; Sat, 19 Jul 2008 10:51:46 -0700 (PDT) Received: from mta10.adelphia.net (mta10.adelphia.net [68.168.78.202]) by core3.amsl.com (Postfix) with ESMTP id C9DD43A680C for ; Sat, 19 Jul 2008 10:51:45 -0700 (PDT) Received: from [192.168.1.100] (really [76.172.208.171]) by mta10.adelphia.net (InterMail vM.6.01.05.02 201-2131-123-102-20050715) with ESMTP id <20080719175546.XCSD20419.mta10.adelphia.net@[192.168.1.100]>; Sat, 19 Jul 2008 13:55:46 -0400 User-Agent: Microsoft-Entourage/12.11.0.080522 Date: Sat, 19 Jul 2008 10:52:18 -0700 From: William Meisel To: Judith Markowitz , 'Eric Burger' , Message-ID: Thread-Topic: [Speechsc] stealing biometric tokens Thread-Index: AcjohHcBCAgkC3qnpUS673kuAg263wBOUV0gAAKcw2Y= In-Reply-To: <200807191652.m6JGqITT020821@omr12.networksolutionsemail.com> Mime-version: 1.0 X-Mailman-Approved-At: Mon, 21 Jul 2008 04:39:54 -0700 Subject: Re: [Speechsc] stealing biometric tokens X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org Hi, Judith. I agree that ideally the solution is to provide adequate security for any authentication data, and I hope solutions that insure every company does so are eventually adopted. The cited article really addresses a different subject. It says that biometric identification, when stolen, is worse than having a PIN stolen because a PIN can be changed, but a fingerprint can't (or a voice can't). The article even talks about enrolling a different finger. I think the basic assumption of the article is flawed. It assumes that one can steal the stored biometric identifier and use that to authenticate oneself as another. If the company stores the original image of a fingerprint or the original recording of a voice, then I guess (with some effort), the voice or fingerprint could be recreated. However, with speaker verification and with fingerprints (in fact, with every pattern recognition application I've been involved with since I wrote a book on it in 1972, the process of storing "features" of the voice or fingerprint or any other pattern is highly lossy and can't be reversed,in part because one wants to identify the pattern in the presence of a lot of variation and thus capture only largely invariant features. When challenged on the telephone to say a password, having the features stored by the speaker verification system wouldn't do one any good. I hate to to have government agencies and companies left with the misimpression that storing biometric data is somehow more dangerous (and possibly creates more liability) than storing PINs. -- Bill = Bill Meisel President, TMA Associates Publisher & Editor, Speech Strategy News (818)708-0962 www.tmaa.com > From: Judith Markowitz > Date: Sat, 19 Jul 2008 11:52:12 -0500 > To: William Meisel , 'Eric Burger' > , > Subject: RE: [Speechsc] stealing biometric tokens > = > Hi Bill, = > The attached article presents the picture in about as simplistic and na= =EFve a > way as possible. Consequently, it leads the reader to false conclusions. > = > Biometrics can be faked (called "spoofing") but it is generally not a > trivial process and, in most cases, it is done with the raw biometric dat= a. > That is, fingerprint or face (etc.) images and voice recordings. It is mu= ch > harder to re-engineer a biometric model/template, although that is not > impossible. = > = > There are a number of ways to capture raw biometrics. The best way is to > hack a database that stores them. Other methods involve capture at the > sensor and on the transmission channel. > = > If you look at these approaches to capturing biometrics you can easily se= e a > theme: security. You also see that the security that is needed (and too > often missing) has nothing really to do with biometrics, itself. It is the > same kind of security that is missing for PIN and password systems. So, it > doesn't really help much to have multi-factor authentication if all of th= em > are captured in transit or stolen from a hacked database. > = > In short, if government and private industry would take the time and spend > the money to secure their networks, databases, and other systems many of > these threats would be eliminated. That's why the data interchange format > that I'm working on with the American National Standards Institute includ= es > encryption and supports other security. > = > Judith Markowitz > = > -----Original Message----- > From: speechsc-bounces@ietf.org [mailto:speechsc-bounces@ietf.org] On Beh= alf > Of William Meisel > Sent: Thursday, July 17, 2008 10:15 PM > To: Eric Burger; speechsc@ietf.org > Subject: Re: [Speechsc] Just to see if anyone is still out there > = > Am I missing something, or does the linked article (and the referenced > professor) simply misunderstand biometric id? Having the biometric token = (a > fingerprint is the example) should neither allow the thief to recreate the > fingerprint (assuming it is features of the fingerprint that are > encoded--hopefully without announcing what each feature is) nor allow the > thief to access the system, since they would need to have the finger (not > the token) to do so. It would not be necessary for the individual to > reenroll a new finger. > = > The same is true of speaker authentication. > = > -- Bill = > = > Bill Meisel > President, TMA Associates > Publisher & Editor, Speech Strategy News > (818)708-0962 > www.tmaa.com > = > = > = > = >> From: Eric Burger >> Date: Thu, 17 Jul 2008 08:07:08 -0400 >> To: >> Subject: [Speechsc] Just to see if anyone is still out there >> = >> For the folks who care about biometrics: >> = > http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecs= tra > t=3D >> ts_071508&nladname=3D071508securitystrategiesal >> _______________________________________________ >> Speechsc mailing list >> Speechsc@ietf.org >> https://www.ietf.org/mailman/listinfo/speechsc >> Supplemental web site: >> <http://www.standardstrack.com/ietf/speechsc> > = > = > _______________________________________________ > Speechsc mailing list > Speechsc@ietf.org > https://www.ietf.org/mailman/listinfo/speechsc > Supplemental web site: > <http://www.standardstrack.com/ietf/speechsc> > = > = _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From speechsc-bounces@ietf.org Mon Jul 21 14:27:13 2008 Return-Path: X-Original-To: speechsc-archive@optimus.ietf.org Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from [127.0.0.1] (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5A59B28C10B; Mon, 21 Jul 2008 14:27:13 -0700 (PDT) X-Original-To: speechsc@core3.amsl.com Delivered-To: speechsc@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D42FB3A63D3 for ; Mon, 21 Jul 2008 14:27:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.573 X-Spam-Level: X-Spam-Status: No, score=-3.573 tagged_above=-999 required=5 tests=[AWL=1.026, BAYES_00=-2.599, GB_I_LETTER=-2] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GVo+4zmGWwok for ; Mon, 21 Jul 2008 14:27:10 -0700 (PDT) Received: from gs19.inmotionhosting.com (gs19b.inmotionhosting.com [66.117.3.189]) by core3.amsl.com (Postfix) with ESMTP id C5A623A67DD for ; Mon, 21 Jul 2008 14:27:10 -0700 (PDT) Received: from [75.68.119.237] (port=60333 helo=[192.168.15.102]) by gs19.inmotionhosting.com with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.68) (envelope-from ) id 1KL2uw-00019V-Ju; Mon, 21 Jul 2008 14:27:38 -0700 Message-Id: <6F91BD03-24B1-4DE8-9AD3-0EEF51EEFA32@standardstrack.com> From: Eric Burger To: Judith Markowitz In-Reply-To: <200807180050.m6I0oENW015349@omr3.networksolutionsemail.com> Mime-Version: 1.0 (Apple Message framework v926) Date: Mon, 21 Jul 2008 17:27:41 -0400 References: <200807180050.m6I0oENW015349@omr3.networksolutionsemail.com> X-Mailer: Apple Mail (2.926) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gs19.inmotionhosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - standardstrack.com X-Source: X-Source-Args: X-Source-Dir: Cc: speechsc@ietf.org Subject: Re: [Speechsc] Just to see if anyone is still out there X-BeenThere: speechsc@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Speech Services Control Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="us-ascii"; Format="flowed"; DelSp="yes" Sender: speechsc-bounces@ietf.org Errors-To: speechsc-bounces@ietf.org It is out there, but we are working on incorporating the last IESG and IANA comments into a final draft. On Jul 17, 2008, at 8:50 PM, Judith Markowitz wrote: > I was also noticing a lack of activity. What is the status of the > newest > MRCP V2 draft? > > Judith Markowitz > > -----Original Message----- > From: speechsc-bounces@ietf.org [mailto:speechsc-bounces@ietf.org] > On Behalf > Of Eric Burger > Sent: Thursday, July 17, 2008 7:07 AM > To: speechsc@ietf.org > Subject: [Speechsc] Just to see if anyone is still out there > > For the folks who care about biometrics: > http://www.networkworld.com/newsletters/sec/2008/071408sec1.html?nlhtsecstra > t=ts_071508&nladname=071508securitystrategiesal > _______________________________________________ > Speechsc mailing list > Speechsc@ietf.org > https://www.ietf.org/mailman/listinfo/speechsc > Supplemental web site: > <http://www.standardstrack.com/ietf/speechsc> > > _______________________________________________ Speechsc mailing list Speechsc@ietf.org https://www.ietf.org/mailman/listinfo/speechsc Supplemental web site: <http://www.standardstrack.com/ietf/speechsc> From invest_2@mac.com Thu Jul 31 03:53:36 2008 Return-Path: X-Original-To: ietfarch-speechsc-archive@core3.amsl.com Delivered-To: ietfarch-speechsc-archive@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0B41F3A6AEB; Thu, 31 Jul 2008 03:53:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.639 X-Spam-Level: ** X-Spam-Status: No, score=2.639 tagged_above=-999 required=5 tests=[ADVANCE_FEE_2=1.234, BAYES_50=0.001, J_CHICKENPOX_92=0.6, MSGID_FROM_MTA_HEADER=0.803, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sCoW92NTcSgL; Thu, 31 Jul 2008 03:53:34 -0700 (PDT) Received: from smtpoutw.mac.com (smtpoutw.mac.com [17.250.248.179]) by core3.amsl.com (Postfix) with ESMTP id 4BDE73A6C52; Thu, 31 Jul 2008 03:53:31 -0700 (PDT) Received: from webmail035 (webmail035-s [10.13.128.35]) by smtpoutw.mac.com (Xserve/smtpoutw004/MantshX 4.0) with ESMTP id m6VArF2w005432; Thu, 31 Jul 2008 03:53:15 -0700 (PDT) Date: Thu, 31 Jul 2008 03:53:14 -0700 From: Investment Message-ID: <142937047245332192108456117532993206499-Webmail2@me.com> Subject: Assistance MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit X-Originating-IP: 41.247.66.118 Received: from [41.247.66.118] from webmail.me.com with HTTP; Thu, 31 Jul 2008 03:53:14 -0700 To: undisclosed-recipients:; Assistance Email:peterwise77@webmail.co.za I am a member of the contract award committee,of the Department of Minerals and Natural Resources in South Africa; I am in search of an agent to assist us in the transfer of (USD21M) and subsequent investment in properties in your country.You will be required to (1) Assist in the transfer of the said funds (2) Advise on lucrative areas for investment (3) Assist us in purchase of properties. 20% will be for you. Yours Faithfully, Dr Peter Wise