Passfaces, formerly known as Real User Corporation, offers authentication technology based on the human brain's specific ability to recognize facial images.

In brief, when a user authenticates themselves to a Passfaces protected system, they are first presented with a 3x3 grid of facial images. They must accurately select the correct facial image from among this set, and then they are presented with another set of 9 different facial images. They continue selecting the correct face from each 3x3 grid presented until they have correctly identified all of the faces in their defined passcode (administrators can set the number of faces a user must recognize to from 1 to 7 faces).

Or, to put it another way, instead of memorizing a PIN or password (a series of letters or digits), the user recognizes and correctly selects a series of from 1 to 7 facial images that they were assigned when they enrolled in the system. According to the vendor, the technology bolsters system security by providing users with an authentication mechanism that does not require separate tokens or decoders while simultaneously leveraging the brain's natural ability to recognize faces (a capability that is scientifically separate from the brain's ability to recognize other types of images). Additionally, these passcodes cannot easily be written down or described to others; as each grid of 9 faces is always the same, with the faces specifically selected to be similar enough to each other such that the target face is not easily described via physical differences (each of the "decoy" faces in the 3x3 grid, for example, is the same gender as the target face).

Since each of the target faces is always surrounded by the same 8 decoy faces, a typical 5-face passcode would require up to 59,049 attempts (9 to the 5th power) to guess the correct sequence. If the administrator requires tighter security than this, they can increase the number of selected faces in the passcode (up to 7) or combine the facial recognition capabilities with passwords or other traditional security mechanisms.

When enrolling in the system, the user is walked through a brief (a few minutes) process designed to familiarize themselves with the faces selected for their passcode (the system itself randomly selects both the target and decoy faces for the user). According to the vendor, users who are assigned a passcode are typically able to correctly recognize the faces months after their initial login, even if they haven't used the system actively in that time.

Two flavors of the Passfaces technology are provided, depending on platform needs.

- Passfaces Financial is targeted to online financial services companies and includes a Web SDK, customizable user interfaces, and a Passfaces images library.

- Passfaces for Windows is the newest entry in the Passfaces arsenal and allows for Passface authentication to Windows Networks. Passfaces for Windows includes a server component (Windows 2000/XP/2003) and a client component (95/98/Me/NT4/2000/XP) and supports local machine, NT Domain controller, or Active Directory-based authentications. The latest version of Passfaces for Windows includes the vendor's Passfaces Web Access tool (formerly a separate product), which is designed for use with Web applications, and includes an SDK with a server-side Java Class Package (for use with Java Servlet capable application servers), the Passfaces Library, and a user interface client (JavaScript, ActiveX, or Java).

Passfaces is available now; Passfaces for Windows starts at $29 per seat with volume discounts available.

Visit the Passfaces Web site for further information.

product submission by ESecPlanet Staff

E-Mail this page to a colleague
send info about Passfaces

Suggest a link
for the Passfaces fact sheet