Biometrics and "what you have" vs. "what you are"

Kim Kameron at Identityblog picked up on Jerry Fishenden's post on the problems of biometrics (by the way: Jerry will speak at our privacy workshop in Athens, see below). He again brings up the story from Malaysia, where some brutal car thieves cut off the index finger of a Mercedes owner in order to circumvent the biometric engine lock. First of all, the thieves could have had it much easier, also without having to carry around a rotting finger. With a bit more high-tech, in the future they could maybe just read the fingerprint out of the car owner's passport.

But more important, this case shows the problems with identity and how hard it is to proof to a machine who you are. It is often based on the classic trinity of authentication, which either can be done by something you have (a key, a USB dongle, a chipcard), something you know (a password, a PIN, your mother's maiden name), or something you are (your fingerprint, your retina). There are of course other possible authentication factors, but these are the most common.

This story makes clear that "what you have" is much clearer than "what you are". I would prefer saying "I have ten fingers" instead of "I am ten fingers". "What I am" relates more directly to my personality / identity than "what I have" or "what I know". It is a story, a flowing amorphous thing, changing from context to context and over time. Of course, you can break it down to some extent to single pieces of data (address, date of birth, employer, email, favourite mp3s, ...) - but this is all not good for authentication purposes, as most of it is not really secret. "What I know" can be secret, and as Jerry Fishenden points out in his post, could be linked to "what I have" in order to have multi-factor authentication. But it again is not the same as "what I am".

Biometrics therefore is more about what I have than what I am. The only difference is that it can't be stolen as easily as a car key or a passport. Fingers can be cut off, but faces? Ok, Hollywood was always ahead of us.

Last open question: Can "what you have" also be said about the way you walk? Probably not. But is that really what you are?