What are the advantages of selfies for security?

Question

A former client of us hired us again after 3 years. In that period, they had many changes, one of them the use of selfies for security reasons.

I have found this type of security from time to time, and I was always interested in how it would help a security or UX process, and I could never find any conclusive information, but I could find many weaknesses.

Unfortunately, this use of selfies with my client is not negotiable. Although they cannot articulate the reason why this process is good, they spent a lot of money on the system and are not willing to put it aside. Moreover, they are not willing to allocate resources to investigate what the experience of users is when using such a system.

However, I would like to know exactly what the real advantages of such a system would be, since as I said, I could not find any (the system has no facial recognition, which would be a valid reason). If there were real documented advantages, we could look for different ways of including such a system in a more complete flow, but honestly we could not find anything for which I turn to your help.

In case it helps, this system is for an investment company (fintech). And for some reason, it's becoming common both in fintech and in my country (Argentina) where most banks and financial apps use this technology in some way or another

Edit:

Some links with examples of what I mean:

• https://securityintelligence.com/the-rise-of-the-selfie-authentication-as-a-new-security-factor/
• https://www.idemia.com/selfie-check
• https://badoo.com/es/team/press/89/
• https://www.idtheftcenter.org/selfie-security-your-face-could-soon-become-your-pin/

An extremely technical paper on Selfie Security Technology

Answer 1

Potential disadvantages are numerous:

• Application should have the access to phone camera (or it cannot work)
• People are not always OK with sending their pictures
• Users need to have necessary conditions for making photo (good light, absence of other people or things not for photo)
• Some countries like Germany are very nervous about people's privacy (it includes not only the user, but also anything and anyone others)
• In some places using cameras is forbidden at all (for security reasons)
• Some cultures are not OK with making and sending photos
• ...

Here are some doubtful advantages:

• It may be easier for some users to make a selfie than to use a long password or other type of letters and numbers
• While it is not that hard to fake a single selfie check, it is a hassle to fake your selfie too often (every login, for example). So it is a reasonably good check.
• You can keep every selfie and then use them in investigations, if needed. So you will be able to cancel all suspicious transactions (but don't forget about GDPR and similar privacy laws)

Answer 2

There is a rationale (below) for having, and showing, an image that is personal to, or at least recognizable by, the user. However, while a "selfie" will fall into this category, I can't see a reason for only allowing a selfie to be used.

---

One technique to guard against fake (phishing) sites is for a website to show something (e.g. an image) during the authentication process that the user has previously chosen/uploaded. On the real site, the user will recognize the image and be (reasonably) sure they are safe. A phishing site would not (without a severe data-breach) know what image to show to which user, so if no image is shown (or it is not the one the user is expecting), then they will know something is wrong.

From Phishing: General Information on The Anti-Abuse Project website:

Augmenting password logins

Bank of America is one of several websites that ask users to select a personal image, and display this user-selected image with any forms that request a password. Users are instructed to only enter a password when they see the image they selected; if the correct image does not appear, they are expected to recognize that the site is not legitimate. However, a recent study suggests few users refrain from entering their password when images are absent. This feature (like other forms of two-factor user authentication) is also susceptible to other attacks, such as those suffered by Scandinavian bank Nordea in late 2005, and Citibank in 2006.

The paper The Battle Against Phishing: Dynamic Security Skins (PDF) by Rachna Dhamija and J.D.Tygar includes:

4.3 Trusted Path to the Password Window

How can a user trust the client display when every user interface element in that display can be spoofed? We propose a solution in which the user shares a secret with the display, one that can not be known or predicted by any third party. To create a trusted path between the user and the display, the display must first prove to the user that it knows this secret.

Our approach is based on window customization [16]. If user interface elements are customized in a way that is recognizable to the user but very difficult to predict by others, attackers can not mimic those aspects that are unknown to them.

Figure 1: The trusted password window uses a background image to prevent spoofing of the window and textboxes.

_{Source: SOUPS 2005: Proceedings of the 2005 ACM Symposium on Usable Security and Privacy, ACM International Conference Proceedings Series, ACM Press, July 2005, pp. 77-88}

And, from personal experience, the UK's National Savings and Investment (NS&I) website also uses this technique.