Why hasn't passthoughts taken off (yet)?
Why hasn't passthoughts taken off (yet)?
On a technology that still isn't
I’ve spent a lot of time talking about power on the Internet. I’m going to take a quick detour from this train of thought—which will turn out not to be a detour at all—to talk about something I worked on quite a lot during my Ph.D.: passthoughts.
Passthoughts let you log into things with your brain. You think a secret thought, a brain-scanning device takes the resulting signals and uses them as a brain-based password, or “passthought.”
Sci-fi, right? My Ph.D. adviser, John Chuang, showed this system could work, and I spent a lot of my Ph.D. (along with John’s other students) refining it.
Why would anyone want passthoughts?
So, why would anyone want to log into things with their brain? Well, here’s the competition:
Passwords, which are famously terrible.
Generally speaking, they’re either easy to guess or hard to remember—or both.Fingerprints and faces, which are easy to steal (we leave them everywhere) and hard to change (what are you going to do if an attacker steals your fingerprint?).
Multifactor
authentication is an improvement to security but tedious when it involves multiple steps (like entering your password, then doing something on your phone).
In contrast:
Passthoughts are hard to guess,
and hard for attackers to spoof.Passthoughts are hard to steal (you can watch someone enter their PIN code, but you won’t learn much from watching someone think a thought).
Passthoughts combine two authentication factors into a single step: a knowledge factor (your secret thought) and an inherence factor (the unique way you think it). With a custom device, you can even provide a possession factor—all three authentication factors in a single step.
In our studies, passthoughts have over 99% authentication accuracy. And we can collect them discreetly from the ear (think AirPods).
Why isn’t passthoughts everywhere?
If passthoughts are so great, why isn’t everyone using them?
In my mind, passthoughts can’t develop further without three key “dependencies:”
There needs to be a commonly worn device that can collect brain signals (think: something you wear around your head, like smart glasses).
There needs to be a good reason to collect brain signals from it (think: “stress detection” or “cognitive load detection”).
People will have to agree to get their brains scanned.
Only with these dependencies met could researchers collect enough data to make passthoughts robust and reliable.
A company like Apple could achieve (1) by introducing EEG into their next generation of AirPods. But they’d still need (2)—an ostensible reason to do so.And the most significant barrier of all is (3): people think it’s creepy to get their brains scanned.
In reality, GPS can reveal much more than a pair of brain-scanning earbuds. But people—even highly-educated people—believe that brain-scanning devices can quite literally read their minds. So even if Apple manages (1) and (2), rolling out brain-scanning AirPods may be the look amid a historic backlash against tech companies.Our passthoughts, our selves
Will passthoughts ever work reliably with today’s brain-scanning technologies? Maybe, maybe not. Perhaps it’ll work with some future sensing technology or with some combination of EEG and other sensors.
But will we someday use our minds
to authenticate? I think so. Our minds are, in some sense, the “ground truth” for our actual identity: that’s the position passthoughts takes. That position is not politically neutral, let alone “correct” in any objective or normative sense. It’s a claim that’s “pre-inscribed” into passthoughts.What does it mean that this is the notion pre-inscribed? What does it mean when our brain changes—does our self change? If so, how does this concept of the self relate to legal notions of personhood? I noodled over some of those questions in an NSPW paper a few years ago,
but I’m curious what others think (you, and society and large). If passthoughts do take off, we’ll have to answer these questions eventually.And what does all of this have to do with this blog’s usual topic of late—state power online? I’ll tie these threads together over the next few weeks. I promise.
In other news…
Jeffrey Ding covered my Internet Fragmentation work in his latest ChinAI newsletter. The newsletter does a great job of distilling our main findings (and our work’s limitations). There’s nothing like having your work covered well. Cheers, Jeffrey!
Julie Thorpe first proposed the concept at NSPW in 2005.
Fingerprints and faces are also easier to spoof than you might expect. Here’s an Instructable on fooling fingerprint scanners and some fun work on breaking FaceID.
There are three factors of authentication: (1) something you know (like a password), (2) something you have (like the key to your house), and (3) something you are (like your fingerprint or your face). These are called knowledge, possession, and inherence factors, respectively.
Some past work confirmed that passthoughts rely on both inherence and knowledge.
Tanya Piplani and I used a GAN to make deepfakes of passthoughts—then used those deepfakes to make passthoughts more robust.
In my opinion, this paper is the pinnacle of our work so far: it combines a convenient and realistic way of collecting EEG signals (earbuds) with a world-first: three-factor, one-step authentication.
If you've ever played the game civilization, you may remember the directed acyclic graph of technology development. Every technology you wanted to develop had some “dependencies” you needed to discover first.
It’s unclear to me whether you can detect stress or cognitive load from EEG. It’s actually unclear to me what stress or cognitive load are from a neurological perspective. Are these states primarily neurochemical? Are they predominantly expressed in the brain? Still, I expect an application like stress tracking will form the initial use case for a widely worn brain-scanning device. Something that purports to detect a “negative” way of being, promising a fitter, happier, more productive life.
“Didn’t you say your passthoughts system got over 99% accuracy?” Yes, and to make passthoughts suitable, you’d need an accuracy rate of 99.9999% (or “five nines”). We’d need Google-scale data even to compute an accuracy rate to that level of precision!
Perhaps a company like Apple could leapfrog (2) as they did with fingerprint authentication on phones, though I have some reason to suspect passthought authentication will be trickier than fingerprint authentication. Unlike brains, fingerprints are relatively stationary—they don’t change much over time. Also, before apple implemented fingerprint scanning, fingerprints were already widely used for identification, which is an even more challenging problem than authentication (1-of-n selection vs. binary selection).
Electroencephalography, commonly known as “brainwaves.” The neurons in your brain emit electromagnetic radiation when they activate. Across your billions of neurons, patterns of constructive and destructive interference create “waves,” which we can detect using electrodes (on the scalp or inside the ear). We’ve used EEG to implement passthoughts in all of our prior studies. It’s non-invasive (no drilling into the brain) and cheap.
Some prior work predicted clinical depression from mobile phone GPS data. You bet Google can do this, too.
The idea that people are creeped out by brain scans—but extremely casual about revealing signals, like GPS—is a key finding from my dissertation work.
From a study by Sabrina S. Ali, Michael Lifshitz, and Amir Raz: “Using a classic magic trick, we crafted an illusion whereby the imaging technology seemed to decipher the internal thoughts of participants. We found that most students—even undergraduates with advanced standing in neuroscience and psychology, who have been taught the shortcomings of neuroimaging—deemed such unlikely technology highly plausible.”
Apple may have some more privacy goodwill than, say, Google, but that’s a low bar, and it’s unclear to me that they’d spend that goodwill on something creepy-seeming like brain-scanning. That said, social shifts around brain-scanning are possible. Who knows—maybe Elon Musk’s company will make brain-scanning hot. Or maybe it’ll make the next generation of “glasshole.” “Neurodouche?” I’m just spitballing here.
The mind is not the same thing as the brain; the mind is more expansive than the brain, extending to the whole body, and possibly beyond it.
Madeleine Akrich discusses the notion that technical artifacts are “pre-inscribed” by designers who “define actors with specific tastes, competencies, motives, aspirations, political prejudices, and the rest” (p. 208).
Merrill, Nick, Max T. Curran, and John Chuang. “Is the Future of Authenticity All In Our Heads? Moving passthoughts from the lab to the world.” Proceedings of the 2017 New Security Paradigms Workshop. 2017.