All of the Above
An approach called behavior analytics assesses multiple biometric features and measurable aspects of a person's behavior.
According to Goode, Stockholm-based BehavioSec offers the most mature ID system that uses behavior analytics.
"It's not just what you know but how you type it in," explains BehavioSec CEO Neil Costigan. "It's the speed across the keys, the rhythm, the pressure, the X-Y position of your finger, the number of apps open. After we see someone seven or eight times we have shown we can verify with confidence it is them again. We can spot imposters better than 97% of the time."
Several Scandinavian banks use a version of the technology that's hosted on their servers. The results of behavioral analytics assessments provide an extra factor for risk analysis, along with location, time of day and the size of the transaction, Costigan explains. And it's important to use such tools to improve security, because the banks say the average number of user log-ons rose from 1.5 to 10 monthly as mobile access became easier.
BehavioSec is developing a version of its technology for the U.S. Department of Defense. That system will reside on the device, as an extension of its operating system, Costigan says.
If a user's behavior changes, the Pentagon version would go into lockdown and require a reset in person. The consumer version asks for a password and an answer to a security question.
Like the original, the Pentagon version "captures everything about you -- how you press buttons, play Angry Birds, use Facebook -- all that becomes part of the biometric," Costigan says.
Looking over the new technologies, RSA's Alikhani says it's likely that users will want devices that offer multiple options.
Someone with dirty hands may forgo the fingerprint reader and switch to voice verification, while someone who normally favors voice verification may use the fingerprint sensor in a noisy airport, he notes, adding, "May the best provider win."
Lamont Wood is a freelance writer in San Antonio.