Posted on 12. September 201616. July 2021 by Ann-Kathrin Freiberg

Challenge-response available to guard against video attacks

One of the challenges in biometrics is to protect against so-called replay attacks, where a person’s biometrics are copied or recorded and presented by an impostor to mimic the real thing. From the start, we included our unique patented liveness detection to protect against such attacks using photos of a legitimate user. Now you can have even stronger protection from impostors attempting to access another person’s account using videos of that person. With challenge-response as anti-spoofing mechanism, during verification users are guided to turn their head in specified random directions. Motion analysis verifies that the instructions were followed. In this way, we ensure that the verification images captured are from a live person and not a photo or video.

This option can be enabled in your BioID account profile settings, and is available for verification through BioID websites as well as in the latest version of the BioID Face Recognition Authenticator App for iOS and Android.

Strong protection that’s easy to use

Once you’ve enabled challenge-response, to be verified simply turn your head slightly in the directions indicated, keeping your eyes on the screen. That’s all there is to it! Other face recognition solutions rely on techniques such as eye blink detection to ensure liveness, but these methods can easily be fooled by photos with the eyes cut out or by videos. BioID’s sophisticated liveness detection provides a unique and much more reliable way to make sure that the face being verified is really from a live person.

Developers using the BioID Web Service can integrate challenge-response into their applications through both the SOAP and REST APIs. A hosted user interface for challenge-response is also available through our Unified User Interface. Users of any applications that use BioID Connect for authentication can also enable challenge-response in their BioID account settings for reliable anti-spoofing.