 Well, welcome to the not DannyQuist talk. If you check your schedule, you'll see that on the paper schedule, and on the iPhone DefCon app, it says DannyQuist. Unfortunately, he couldn't make it today for whatever reason. I wish him the best. I hope he's OK. If you check the Confu app, you'll see that I'm actually listed. And my name is Josh Marpet, and I'm here to talk about facial recognition. And we're going to discuss all sorts of different things about it. But before I get started, I should let you know a couple of things. One, this is an audience interactive demo. It's right over there. If you want to play with a commercial grade face detection system, I have paper, markers, balloons. Please go to town. This is encouraged. OK? Please don't snag my markers. I need them for the next talk. I'm actually talking again at 11 o'clock. So this is my little bit of administration trivia. There will be no Q&A for this talk. The Q&A will be held by you following my butt, running down the hall to the Skytalk. That's Skybox 206, I believe. I'm going to be giving a similar talk. This one is about the technology of facial recognition and facial detection, face detection, and face tracking. The next talk is going to be about the legalities of facial recognition, video surveillance, and all that kind of fun stuff. Photographers' rights, things like that. So if either of those topics interests you, sit through this one, enjoy the heck out of it. And then follow me to Skytalk 206, and I will have an extended Q&A session after that one. As long as you want to ask me questions and buy me alcohol, I'll be happy to answer any of your questions. So again, there's an interactive demo. Please feel free to do it starting now. So anybody that wants to wander over and play with it, you'll see the results on that screen over there. So this screen is going to be doing my slides, and occasionally perhaps my ugly mug. And on this screen, you're going to have the demo. If anybody wants to play with the laptop, it's a sterile Windows 7 install. There's not much you're going to get off of it. Please don't test that. I need it for the next demo as well. So that's all I ask. All right, let's get to work. So first question is, who the hell is this guy in front of you? All right, as I said, my name is Josh Marpet. There's my Twitter handle and my email. And I've done everything. And if you doubt me, ask my friends. There's several of them right here in the front row. I've literally done just about everything. Everything on that is true. Yes, I am a horse dentist. Yes, I'm an ex cop, ex firefighter, and a blacksmith. All right? It's life. I've done it all. I've seen it all. It's kind of interesting. Let's put it that way. As for security, convergence, zealot, I'm almost scared to see what's going to go on on that demo. Dear God. OK, anyway, feel free to blow up balloons and have fun. And yes, you will look silly and know we won't. Oh, yeah, we're going to laugh at you. But anyway, as for security, convergence, zealot, that's because I believe that physical and logical security or information security are converging at a rapid rate. And anybody that wants to debate me on it, I will happily do so over rum and coke, or in my case, rum and sprite. Anyway, so I have a disclaimer. I work for White Hat Security. This is my talk, however. This is not White Hat. Anybody that knows Jeremiah Grossman knows he tells a hell of a lot better jokes than me. So this is not my company's talk. I have to put this in, guys. I apologize. But it's the rules. My company goes, you're giving a talk of your own? Yes, disclaimer. OK, OK. I like my job. So this is my stuff. This is not part of White Hat. It's not a product of, representative of. It's not their opinions, blah, blah, blah. You get the idea. OK. So the whole topic of my talk is facts, fictions, and fuckups. Let's talk about the facts. Everybody says facial recognition. That's not true. There's actually three steps. Three steps to actually matching someone to a database. First, we have to find their face. And that's what this demo is. This is a face detection demo. In a picture or a video stream, can you find a face? Then there's face tracking. Can I follow the face? And then there's facial recognition, which is when can I match the face to my database? Let's go over those steps. So face detection, again, is there a face there? How do I identify it? How do I not give false positives or negatives? As I said, there's the demo. The demo, I'm going to give full credit. This is a commercial. That's awesome. You're not going to see this on the video, but he actually drew eyebrows on the freaking thing. That's freaking awesome. Tell me if it works, please. I want to know. This is a commercial demo. This is from a company called Pitpat, P-I-T-T, P-A-T-T. Pitpat actually is Pittsburgh pattern recognition, which is kind of a cool name. They're based out of Pittsburgh, surprise, surprise. And they do real, real good face recognition, face detection, face tracking stuff. This, by the way, is what Facebook and Picasso use, I believe. So they have demos for facial recognition, and I'll be showing you that in a second. How does face detection work? Remember, face detection, face tracking, facial recognition. So how does face detection work? Now, there's a genius guy. Hopefully this is going to work. Good. OK. Called Adam Harvey, who designed something called CV Dazzle. Awesome dude. Really had a good time with him, I hope, a couple of weeks ago. He did this to visualize how it works. Now look. OK. Can everybody see this? All right. This is a picture of a face. He's in fashion photography, can you tell? And what it's doing is it's doing pattern recognition in a subset of the picture. It's looking for patterns of darks and lights. If you look at your face, you have a dark spot under a lighter spot because your eye when open is lighter colored than your skin or the shadows on your skin. And it's looking for a lighter stripe and then another darker spot or line and then a lighter blob. That's called the unders of your eyes, your eyes and your nose in between. You can see it doing that. And you can actually, as it gets down to her face, you'll see it slow down. This is known as a hard cascade. It's cascading little tiny bits at a time. And what it's going to do, I don't believe it does it and this is just a visualization. This isn't actually running actual facial detection. This is so you can see it. It runs so fast you can't see it. But what it does is it runs the entire still. And if it sees a face, it goes, OK, I think there's a face there. And it runs it three more times. And if it gets the same or similar results within about a few millimeters of each other, it goes, there's a face there. OK, does this make sense to everybody? Good. I'm glad. Hey, come on. Somebody do a demo. Come on. Check it out, man. Seriously. I lugged this laptop all the way here. Nobody's playing with it. I'm really annoyed. So anyway. So Adam Harvey did this little video, which is awesome. And I believe it's actually picking out her face now. You can see how much it slows down when it hits her face. And that's because it's actually starting to pick out her features. It's starting to pick out the patterns and checking them in smaller and smaller cascades to make sure that the patterns match what it believes should be a face. So that's how face detection works. It's not hard. They tried all sorts of different things before. This is what they finally came up with. They tried polygon matching. But you know what? Take a look around you right now. How many of you have different polygons from the next guy, girl, in between, whatever? All of you. People have long faces. People have wide faces. People have round faces. People have piggy eyes. People have whatever different features. It's very difficult. But what they figured out was that if you take a small cascade or a small subset of features, you can determine a pattern, a light and dark pattern. These light and dark patterns when put together and then get done in bigger pieces and bigger pieces and bigger pieces create a cascade of recognition that actually work and work really well. Sometimes it doesn't work as well. Let's just say that this, it should start running in a second, is kind of an interesting face. This actually gets detected as depending on when in the sequence it is. Did it run yet? Let's see. Hang on. We're going to run that manually. We'll get this. Hang on, everybody. Displays, mirror. So that is actually detected as two to four different faces depending on when you see it, when in the sequence the camera sees it. It's kind of unnerving, actually, watch it work. But basically that is a guy, he paints his face every day. I did it for a year. I'll show you more of him in a second. OK, go away. OK, so that's facial detection. That's how you find a face in a picture. How are we doing over there, by the way? Is anybody able to recognize a balloon? I did it? Awesome. We're going to bring that one up, please. I want to see it. But face tracking is basically, OK, sorry. We did facial detection. Now we're talking about face tracking. Face tracking is actually not that interesting. All it is is continuous facial detection. Awesome. Cute. So basically they actually drew eyebrows. They drew a hairline. They went pretty significantly far to get it to see a face. So it did lock on for a second with a full border. Awesome. OK, so this is the kind of detail you have to go to to make it recognize a face. Now you'll notice, even though there's no under eye shadows, there's enough of a pattern here that it can recognize the patterns. Anyway, stay. So face tracking, as I said, not that interesting. It's just continuous face detection. Now let's get into facial recognition. It's not easy. Facial recognition is taking the faces you find and checking them against your database. And sometimes if people have made changes in their lives, it's not easy to do. OK, these are actually the same people in each set of photographs. They're massively unpleasant by the end photograph. This is actually faces of meth. If anybody's ever seen that before, and I really pity these people, please, I'm not denigrating them in any way, shape, or form, this stuff destroys their lives. I'm an ex-cop, like I said, I used to have to deal with them, and believe me, it destroys their lives. But it also destroys their bodies and their faces. If you take a look at them, you'll notice that they're barely recognizable, especially the one on the lower left from that first picture to that last picture, and the first one, she looks like a normal housewife type of person. In the last one, she is like evil incarnate. OK, it's ugly people. So these people I feel pity for, and I feel bad for, these not a slight bit, OK? The plastic surgery that they have in these things, I mean, look at Lara from Flynn Boyle. That first picture, she's fresh-faced, girl next door. In the last picture, she's like Cruella de Vil. I'm really sorry, but it's the truth, OK? She's like, no. But you can see the differences it makes. Take a look at the lower right. You'll see that that was Restylane, which is a common face filler. They use it to plump up lips and all sorts of different things. And so you can see that actually the patterns of her face, remember, in face detection, we're talking about patterns of shadow and light, right? So in that Restylane photograph, which, by the way, is from Restylane, they're actually advertising this as an appropriate and positive thing for you. Frankly, I'm not sure about that. It really is going to change the pattern of light and dark on her face, because her lips literally protrude like a fricking duckbill, OK? So that's my personal, but that is going to change the face. And could it actually screw up a facial recognition algorithm? Absolutely. So the moral of the story is go get lots of Restylane. No, no, no. Don't do that. All right. But I do, by the way, in my next talk, in the legalities talk, I'll tell you how to stay out of the databases if you want to learn that. Irrespectively, there's other kinds of problems with facial recognition. You might have seen this guy. These are just a quick Google image search of Michael Jackson. And they do not look at all alike. I think it's probably because he actually had a Mr. Potato Headface and could actually take features on and off at will. Actually, remember I said that Pitpat, the company that does this face detection demo, does facial recognition as well? I ran one. I ran one with the least characterization. So in other words, it'll find matches from like pigs to dogs. And it couldn't figure out that this was the same person. There is no match there. And you'll notice that the slider is all the way in the left, which is the more false matches, mis-fewer matches. It could not figure out that was the same person. It's not even close. So what's the moral here? A lifetime of plastic surgery? Never mind. He still went to jail. So basically, facial recognition can be beaten. And face detection can be beaten, even with a balloon. Irrespectively, what do we care about this? What does it matter? Why are these things interesting to people? Why did I apparently fill a ballroom with people looking about facial recognition? Because this is all part of video analytics. And video analytics is a sequence, excuse me, a series of technologies that track vehicles. They re-license plates. They check your face against a database. They do all sorts of things. So where is this video analytics and facial recognition and everything else? By the way, in this slide, you'll see that they're actually tracking people, the blue lines in the middle at the top, that's their tracking vehicles where they go their path. These are all real photos, by the way. This is not a demo. This is actually in systems and use. All sorts of stuff. So where is it going to go? Why do we care? What do I give a crap about facial recognition? Oh, wow, nice job. You got another one. So what do I care about this? Well, I thought of a few different things. And is anybody here going to tell me I'm wrong? OK. You literally can figure out, I've got 75% Hispanics in the stadium, let's change the ads. So it's all about personalization. Now as infosec people, do we talk about personalization and how dangerous that is? I wonder if it's going to be dangerous in the future if people can change their face or change what they're looking at or looking for or whatever. And so this is just a couple of crazy things I thought of. I mean, it's not like anybody would ever do anything like that. OK. I mean, it's not like personalized Google ads or anything like that would ever happen, right? What if they could check if you're angry? What if they could check if you're sad? What if they could check if you're doing something inappropriate in front of the camera? What if Clippy could pop up and say, I see you're trying to watch porn? Would you like an ad for Vaseline Intensive Hand Cream? Not appropriate. I don't want them seeing this stuff. Not that I ever do that. But actually, what's guaranteed, this is actually already in place. There's companies that do time tracking by face. So remember how you used to be able to have your friend clock you in, and you'd actually sleep an hour late? Because the whatever system from ADP or whatever system would just do your time code, your number. And so your buddy would clock you in, and you'd clock him in next week. Each of you would get an hour extra sleep each week, right? Or every other week. Not anymore. First they went to fingerprints, now they're going to go to your face. Actually, you can see if you're there. But could you hold up your trusty balloon? You probably could. So I talked about fact, fiction, and fuck ups. I deal with the CSI effect all the time. I hate this fricking thing. The magical formula, magnify, enhance, enhance, get them. Doesn't work. Please, everybody try the demo. It's awesome stuff. It's here all week. No, just kidding. In every freaking TV show I watch, they're like, hey, video IQ him on Las Vegas. Everybody thinks it's 100% accurate, 100% reliable. It's as scientific as everything. Ballistics, fingerprints, forensic odentology. That's bite marks, if you didn't know. It is. It's just as accurate as them, because they're not accurate at all. Hint, if you're ever in a court case where you have a ballistics issue, pick up this book. OK? Yes, it is, Al. So, tainting evidence. And basically, this is about how the FBI labs suck. And I'm not dissing the FBI labs. I think they're awesome places. But facial recognition as a science is being taken way too seriously. And I'll explain that in a second. But just as a lot of sciences out there are absolutely perfect, because the FBI says they are, because this agency says they are. They're not, all right? We found that in a lot of the nation's crime labs, they do not have a scientific underpinning. Nicely done. If you can kill that demo and it's the pit-patch, oh, there we go, never mind. OK. In a lot of the nation's crime labs, actually in all the nation's crime labs, the scientific underpinnings of a lot of forensic sciences found wanting. And it just, it sucks. There's actually a book from the National Academy of Sciences. They did a full scientific examination of all these different forensic sciences. And there's no scientific underpinning for ballistics. Forensic odontology, by Mark Evidence. There's actually very little for fingerprints. There's a lot of problems with these things. But everybody thinks it's pretty. It's blinking lights. Therefore, it's science. Therefore, it's infallible. This is fiction, OK? Keep that in mind. It is fiction. It's not true, OK? This is the fiction behind facial recognition, behind a lot of the forensic sciences out there. They're not there. There's no scientific underpinnings. Something you have to be careful of. This one is a guy named Brandon Mayfield, a lawyer from Portland, who was wrongly arrested about a terrorist bombing because the FBI said, these are his fingerprints. This was done in Spain. The Spanish authorities went, no, it's not. The Spanish authorities had to convince the FBI it was different fingerprints. Come on, guys. Give me a break. There's all kinds of forensic issues. I'm not going to get into it. Sometimes, admittedly, you don't need forensics. This guy was this dumb. He saw a video surveillance video on TV. Excuse me, a surveillance video on TV. And Cole's up and goes, dude, why am I in that? No forensics needed. We're done. Slam bam, OK? But most of the time, the police are just not that lucky. Now, again, in my sky talking about 20 minutes or so, I'm going to be going over the legalities of using your face in a police investigation. We can talk about that in a bit. But I'm going to give it up for the minute. Let's talk about fucking it up. How can you screw it up? Well, there's several ways. So for face detection, there's something called CVDazzle. This is, again, that gentleman named Adam Harvey I talked about a little while ago, AH Projects, awesome dude. He actually went in and did all kinds of different makeup to see if he could get the patterns, the pattern recognition of face detection, all screwed up. You'll see all the different patterns he's got on there. And at the top are the ones that seem to work. And at the bottoms with the red boxes are the ones that absolutely didn't work. My guess is that the ones that didn't work, and I'm still working on this, it's kind of interesting. I'm trying different pixel masks. But the ones that didn't work are too regular. It's a pattern recognition algorithm. If you give it a pattern, it likes patterns. But sometimes even the regular ones work. This is actually what worked. You'll notice at the top, this is his actual CVDazzle. I talked to him, he's cool with it. At the top, the CVDazzle makeup is, you see the hair coming down to cover the bridge of the nose? That's important. It breaks that line. The facial protection program is expecting a light band to your forehead in between your hair, or in my case, what used to be hair, and your nose, the bridge of your nose. He broke that line with a hair coming straight down to the bridge of the nose. And then the makeup breaks up the light and the dark contours of the cheekbones. Now he said to himself, he goes, look, this is only useful if you're going clubbing. But if you're going clubbing, it's a great way not to get in trouble if something happens. So I'm not advocating you commit crimes, dear God. But what I'm saying is this is an interesting feature, or set of features, that can be used to obscure your face. And actually, it won't even realize there's a face there. That's the point. So there are other things you can do, but they're a little extreme. This is that guy again who painted his face every day for a year. Kind of funny stuff, but irrespectively, I'm not going to walk around the streets with makeup like that on unless you feed me a lot of alcohol and pay me lots of money. Or it's DEF CON. Anyway, but I'm sure that we've all seen people wearing interesting makeup. This is a little outre, but it's OK. But let's talk about how to fuck up facial recognition. This is face detection we've just fucked up, OK? Remember, CV Dazzle, all right? And this will actually not let your face be seen. And if you drew this on a piece of paper or drew this on your face with the markers, hint, hint, I was asking you to. If you haven't done the demo, by the way, it's still running. There's a full commercial grade face detection demo. Please feel free to come on up and play with it. I brought markers, paper, and balloons. See if you can screw with it. It's there for you to screw with. Please do so. But let's get back to fucking it up. I love that. This is from faceresearch.org, and I've got a couple others I'll drag up and have time to put them on slides. But look at these two faces. Are these the same face? Seriously, are these the same people? No. A facial recognition program couldn't tell that. Unless it has a lot of facial recognition programs bring you to black and white, OK? Unless it's doing shades, which obviously they're different shades of skin, it won't be able to tell. There's no vector between them. Do you see the dots in between? That's a vector diagram. What are the changes between these two faces? It couldn't be able to tell. It's that close. Are these two people I picked carefully out of a Google image search? After hundreds of hours, sweat, blood, and tears? No, they're the freaking sample images in faceresearch. They're two random freaking girls. And it couldn't tell the difference. It's really, really difficult in facial recognition to tell the difference between two faces, OK? Time check? Awesome. OK, so it's really difficult for it to tell the difference between two faces in a database. So it's really easy to screw with facial recognition. I have hair. It's really ugly hair. And it's a big God's ugly hat, but it'll screw with a facial recognition database. Could a person tell it apart? Yes, a person would look at me and go, oh my God, what are you doing? Because it's that ugly. But a machine can't. Remember, machines are the smartest, dumb things you'll ever know. They'll do exactly what we tell them to. All right, so here's the real fuck ups. In 2001, Tampa installed facial recognition. They didn't find a single person. They put their entire fugitive database in it. They put their entire warrant database in it. They put their entire prison database in it. As in, hey, let's see if Schmuck who committed a murder three years ago is out on the streets at a bar, getting drunk, waving a gun around. They didn't find a single effing person. They scrapped it. The public found out about it. They were wearing masks and doing this to the camera, well, read between the lines, to the cameras, so they couldn't get a clear enough shot to identify anyone. Now, that's almost 10 years ago. The cameras get a lot better since then, right? Yeah, they do. But if you want to talk about video systems, that's also my expertise. They don't do that much better, because nobody wants to buy 40 million terabytes of storage to store the freaking video. So realistically, we're still stuck with about five to 10-year-old surveillance technology, and it doesn't work. It just doesn't work. At Boston's Logan Airport, anybody ever here fly through Boston? Big flip in airport, right? OK. They ran two separate tests of facial recognition systems using volunteers. They enrolled the volunteers. They had full frontal shots. They had side shots. They had the other side shots. They had back-of-the-head shots. They had volunteers enroll in the system, and they only had a 60% effectiveness rate. Dear God, that's horrible. That means that that fleeting camera image you got of the terrorist running by the camera, and you got this effectively, or this, it can't find you. It can't see him. It can't actually tell if there's a face there, and it cannot determine whether that face is in the database. So with enrolled volunteers, they had a 61.4% accuracy rate, leading the airport officials to pursue other security options. What a surprise. So what's the reality? I said facts, fictions, and fuck-ups. What's the reality about face detection, face tracking, and facial recognition? Face detection? Pretty awesome. Who here played with the demo? Who here thinks it's pretty good, actually? All right, anybody think it sucks? It's a horrible program. It doesn't work at all? Did you play with it? Then you can't say that. Go up and play with it. Get up. Come on. So if you played with a demo, they're pretty good. Oh, that's good. You got to enlarge it, though, please. The demo is pretty good. So face detection? Pretty good. It'll find a face. You can mask it. You can do all sorts of weird makeup, the CV dazzle stuff. But face detection works pretty well. Give them credit. Face tracking, continuous face detection. It works pretty well. Just leave that one alone. Facial recognition sucks. It sucks. The FBI ran facial recognition on the entire North Carolina DMV database. They trumpeted that they found a fugitive. It was actually, as I understand it, an FBI agent who was watching it as it goes by and went, wait. Which is the best face recognition technology there is, but not exactly scalable. They found one guy that's pitiful. So realistically, even though everybody goes, oh my god, they're coming after me, they're not. It's not a problem. At this point, it's not something you have to worry about. The only thing you have to worry about is, am I getting put in the database? Am I getting put in for later processing? Am I getting put in some massive database, real ID? There's all sorts of different ones you know about and I know about and we can discuss for hours. But you get the idea. So if you're getting put in these databases, will you later get found? Will you later get charged? Will you later get put in federal, pound, or ass prison? I don't know. This is something you've got to worry about. I discuss how to keep your face out of the databases in my next talk in the Skybox. You're welcome to come along with me. I'm not going to have a Q and A today because I've got to run to the Skybox. I think I've got what, 10, 15 minutes left? 15 minutes left? I'm going to stop in case we have any questions. I have a couple of things I can talk about, but I'd like to stop and get some questions and see what questions you have about facial recognition, face tracking, face detection. So please, let's start. I know it's a little unusual, I apologize, but raise your hand or stand up and shout. Please, you're in the casino databases. That's where all the stuff started. Yes and no. Casino databases are a big thing. They have what they call the black book, the band book. You're a card counter, get the hell out. GTFO, what the hell are you doing here? Blah, blah, blah, right? Yes and no. The casinos run black books. The casinos, and you've all seen the show Las Vegas. Video IQM and 16 tenths of a second later they found. Every place he's been in the last like five months, he was here six months ago, boss. Bullshit, okay? Yes, they can do that. Facial recognition systems at the casinos are some of the best in the world. Again, 60 to 70% correct find rate or a correct positive rate. And remember casinos according to Nevada Gaming Commission Law, because I've put Las Vegas casino systems in, they only hold video for 30 days. They can hold your face forever, but they only hold video for 30 days. If you imagine how many cameras this room has, now imagine that each of them is streaming at let's say five or 10 megabits per second to a storage. Do you know the stack of chases you need for storage for 30 days? For just this room, it's not small and it's not cheap. Casinos are on budgets just like everybody else. Yes, you give them all your money, I know. But that money aggregated among everybody is not as much as you think. They're on budgets for their surveillance systems. So their surveillance systems and their facial recognition systems are not as expansive and all inclusive as you might think, but they also share. The casinos share their black books, certain portions of their black books, certain portions they don't share, they don't wanna be embarrassed. And the casinos do not share with the government unless forced to, okay? The only way they're gonna share with the government is if they get a subpoena. And even if they get a subpoena, oops, things might have to disappear. So I wouldn't worry about the casino and the government colluding. I'd worry about more when you went on that protest march and smacked a policeman with a stick. That might give you a problem, okay? More questions. I can't see everybody, go ahead. Well, it's not like the NSA owns Google or anything, right? But yeah, you're right. Okay, if I take my camera phone, and I take a picture of a buddy of mine and I mark him as a contact, then I've got this, this is an Android phone. Would this be hooked up to my Google account? Absolutely, Android, Google, you know, little detailer. And so that Gmail account then has all of my contacts. Can it facial recognize my contacts and actually perform sort of a network analysis of all of my contacts and all of their contacts and find out six degrees of separation? How far I am from Kevin Bacon? Yes, it's possible. Not that anybody would give a crap about how far I am from Kevin Bacon. But the point is, is the network analysis that you're talking about possible. And I use network analysis loosely, you know what I mean. Yeah, it's absolutely possible. Is it happening? I don't know. Considering who owns Google, and yeah, I believe that Google is owned, then yeah, I believe it probably is happening, which is why for my contact pictures I tend not to take pictures of people. I tend to use their icons in their G Talk accounts or things like that. So I mean, are you paranoid? Yes, am I paranoid? Yes, but which of us is on the meds? Okay, so just be careful on what you do. Realize that the data you collect now can and will be used against you in a court of law later. So just be careful with this stuff. Am I saying, you know, freak out tinfoil hats? No, I'm not. This was the joke page, okay, seriously. But again, just be careful. Realize that data you collect now might change or might be used. All right, other questions? If anybody's raising their hand, I can't see them, stand up. The question is, did I do any comparisons between facial recognition and other biometric systems, retina scans, iris scans, fingerprints, this, that and the other thing? The answer is I didn't do any formal control tests if you know what I'm saying, but I can tell you from personal experience and from research that there are some issues with every type of biometric system and some of them are kind of weird, like retina scanners, you can't do it anymore because the company that made them wanted a business. If you want to use it, you got to call Zach Franken, who I'm sure a lot of people here know, he helps out with DEF CON a lot. He has like three of the retina scanners installed around his house. It's kind of scary. The dude is out there and I'm out, he, whoa, anyway. But as for iris scanners and fingerprints and the hand scanners as against facial recognition, most biometric systems, it depends on how carefully enrollment is. Now remember with the facial recognition system, most of your enrollments are done sort of fleetingly. You don't go, hey terrorist, would you stand there so I can get a good full frontal face shot of you? It's kind of tough, you know what I mean? So you can check them against the pictures that you've got in the database. You can check them against the pictures that you've got from surveillance video. But again, surveillance video, remember you need all that storage. So surveillance video is normally grainy or crappy. Most surveillance cameras, has anybody ever seen the CSI where they have a blurry ass picture of a car? Like enhance that, magnify. There's the absolute license plate of that car. I call bullshit. Okay, that is BS. I've worked in surveillance for a long time. You can't do that crap. You cannot magnify and enhance past the resolution limit of the camera, the lens and the storage that it's on. Period, end of story. So if you've got a grainy ass picture of somebody and you're like, look there's a nose I think, you're not gonna run facial recognition on it. So the problem with facial recognition is enrollment, all right? The 60% rate that you get for face recognition is probably pretty comparable to crappy enrollments in other biometric systems. With good enrollments, if you want a fingerprint, you tell somebody, give me your freaking hand. It's fingerprinted, okay? That's a good enrollment. Well, maybe not on that, but you get the idea. You get it for, like I said, that blurry face. It's crappy enrollment. So you're gonna get about the same level of accuracy. 60% was for proper enrollment. So I mean, actually it's a good point. So with proper enrollment in facial recognition and proper enrollment in fingerprints, your fingerprints are gonna be higher, closer to 97%, if I remember correctly. But with crappy enrollment and in fingerprints and good enrollment in facial recognition, you're about the same. Which says to me that facial recognition is a long way to go. Yes, you're absolutely correct. License plate, I'm sorry, the question was, she drove over to Hoover Dam. She knows her license plate got taken. And what do I know about Milestone Systems? They're a leading video analytics company. I actually have a demo system of theirs. They give you a free one-camera demo if you ask them really nicely, which is a form on the website. Which you have lots of email addresses. You can fill out lots of times. Not that I would ever do anything like that. But I've used Milestone Systems, their stuff is good. You gotta understand that license plate recognition is easy because license plates are in a specified font, in a specified place, roughly speaking, in a specified size, in a specified place, with a specified border that the camera can pick up. Remember we said patterns of light and dark? It's got a pattern in there. It knows the pattern. Every state's license plates are different. From the pattern, irrespective of the colors, it can tell you what state you're from. The little logo in the middle, the peach for Georgia, and what the hell is it, some, you know what I'm talking about, right? From those patterns, it can tell you what state you're from. From the specified, very nice clear sans serif font that's on those license plates, it can pull your plate. Actually, one of my projects that I'm trying to work on is to SQL inject a license plate recognition camera. So, to answer your question, I'm generalizing about facial recognition systems. Absolutely. There's multiple different models. There's multiple different manufacturers. There's multiple different types. The one thing if you'll notice that I wanted to see significant detail on was the face detection because every manufacturer uses the same thing. I did not specify about facial recognition exactly how they do it because it's like, I think if I remember quickly four or five different models of how to go from enrolled to exemplar, okay, from surveillance video to exemplar face, I should say. So I didn't go into detail on that. Probably do a talk on all the different models sometime and thank you, it's a very good point. I really appreciate that. So please come to that talk as well. But basically, it's science in its infancy, or I'm sorry, it's not really in its infancy, it's really toddling along, if that makes sense. Are they good? No, are they going to be good? Yes, should you be worried about it now? Not really, but it's something you should keep in mind. Does that make sense? And did I answer your question? If I didn't, please tell me. Thank you. We all know you. Jesus, I was joking, dude, but apparently you weren't. Okay, this guy got evicted from a casino out of a casino restaurant because he showed up at a casino. Is that because your car was there because they saw you in the restaurant? So let's talk about that. This gentleman had his car license plate picked up and then he had people following him with guns and badges and shit into the restaurant where they said you're on our property, now get the hell out of here, right? Something like that. Okay, so what they did was they caught your nice clear sans-serif font license plate in a nice little border in a specified place, in a specified location, in a specific blah, blah, blah, blah. No, I said about facial recognition, don't worry about it. I said license plate works. This is true? No, no, it's okay, you look funny anyway. Sorry, I couldn't resist, I apologize. Stop, you're right. What he's saying everybody in for the video is that there's a few hundred people they actually care about, card counters, cheats, scammers, thieves, somebody who pissed on a security guard, whatever, okay? These are the people in the real, oh my God they're here, get them the hell out of here, database, right? Okay, so first match, second match, third match. Your face got flagged and it, along with the potential faces it matched, your face, like five or 10 of them came up on the screen and then a human looked. The humans are the final arbiters and at this point I agree with that, that's a good call because remember we showed, wait, there's no difference to a machine, okay? Not that you look like either of these girls, trust me, it's okay honest, you don't look that feminine. But not that would be a problem if you did. I do not discriminate, I just make fun of. But what happens is if the girl on the left for example was a card counter and the computer said I think this is one of those card counters in my database, it would bring up five or 10 faces including the one on the right and a human would go no, it's not any of them, it's cool and click and she's done, right? Yours was one of those faces on the right, they said oh my God, you know, clean up on IL-8, kick them in the nuts, whatever, I mean, you were caught. That's the way it goes. But again, so it's 60% accurate so it found five or 10 different faces that it thought were yours, then it's up to the humans as the final arbiter. Does that make sense? Then we definitely laugh at you. If you don't show up as a face, because remember CV Dazzle isn't against facial recognition, CV Dazzle is against face detection. So let's go back to that. Not then, but there. So if you put the makeup on the top on and go to the nightclub at the casino, they're not even gonna know you're there. If you're sitting, okay, here's what I would do if I were you, not that I'm advocating you do this, please God, go to the nightclub, wear this makeup after they stop laughing at you, dance a little, get off the dance floor, go to the blackjack table, wipe the sweat off your brow and go, yeah, I just been clubbing at the cool nightclub around the corner. They'll never see your face. You've got a reason to be there. Look, if you're gonna commit a crime, don't be stupid. Don't be stupid. And if you, you know what, you're right. The floorman will, the pit boss will call up and say that and the surveillance guys will go, dude, it's not recognized him as anybody. Seriously, I mean, do you wanna wear this? No, but I mean, are there any of the designs on the top there, the top row and a half? Possible to wear? Hey, you're going to a football convention. You got, you know, look at the second one from the left on the top. You got crap under your eyes. You got a helmet on. Take the helmet off, please, sir. Okay, you have crap under your eyes. You know, the stuff they put on for football, anti-glare or whatever. I also put it on top of my eyes because my eyebrows are crappy and I wanna look really manly. I don't know. Okay? That actually will break up the pattern as well, but you can't make it too regular because otherwise it'll interpret it as a regular pattern. It'll interpret it as a hat and it's designed to stop to look at just this if there's a hat there. I actually tried that, that was a good one. I used a wig a little better than this piece of crap, okay? All right, good questions, yes. It can be done against. Remember I said about a hat? It'll train itself against that and use just this piece. With sunglasses, it actually, it's still a regular pattern. It'll interpret it as still a face is there. For facial recognition, it'll screw it up, but then it goes off the, a lot of them will go off the ratio of the length of your nose to the size of your forehead or the length of your nose to the distance between your eyes, things like that. Sunglasses can screw that up, but they're common enough that they train it against that. Does that make sense? Good one. I'm about a minute left, I got a little time for one last question if anybody has it? Yes. Yeah, I expect that to happen, but I expect it to be much better technology when it happens. Look, how bad were fingerprint readers when they first came out for your computer? As biometrics and technology gets cheaper, as the silicon gets cheaper, it filters down. My camera has blink and wink detection. You don't need a self timer. You go set yourself up with your armor on your girlfriend or whatever and wink at it and it takes the picture. That's sick. Okay? And if you blink, it'll actually flash one more time and wait until your eyes open and then take the picture. Unbelievably cool shit. Okay, so yeah, it's gonna happen. Wait for it. And it's gonna be like, you know, you just got a haircut, you can't log into your computer. Crap, call IT. Wait, I am IT. Shit. All right, ladies and gentlemen. Oh, cool. Hey, anybody wanna catch? Thank hackers for charity. If hackers for charity can get their act together and walk them up here. Hackers for charity. Camera didn't catch that. Let me tell ya. Ladies and gentlemen, thank you very much.