The brain is an infinite source of secure passwords, but you might not have to remember anything. Passwords and PINs with letters and numbers can easily be hacked, hard to recognise and generally insecure. Biometrics has now begun to take their place, with fingerprints, facial recognition and retina scanning as a part of logging in feature in computers, smart phones and other devices.

They are more secure because they are more laborious to fake, but biometrics have a crucial vulnerability. A person only has one face, two retinas and ten fingerprints. They represent passwords that can’t be reset if they’re compromised.

Like usernames and passwords, biometric credentials are vulnerable to data breaches. In 2015, for instance, the database containing the fingerprints of 5.6 million US federal employees was breached. Those people shouldn’t use their fingerprints to secure any devices, whether for personal use or at work. The next breach might steal photographs or retina scan data, rendering biometrics useless for security.

Phys.org has done a research based on scientist Wenyao Xu, with brainwaves being the answer to this. A headset devised by the scientist can detect unique patters of a brain while the person looks at images. And this unlocks the device as the person's identity gets recognised.

The team has been working with collaborators at other institutions for years and has invented a new type of biometric that is both uniquely tied to a single human being and can be reset if needed.

Inside the mind

When a person looks at a photograph or listens to a piece of music, her brain responds in ways that researchers or medical professionals can measure with electrical sensors placed on her scalp. It has been discovered that every person’s brain responds differently to an external stimulus, so even if two people look at the same photograph, readings of their brain activity will be different.

This process is automatic and unconscious, so a person can’t control how brain response happens. And every time a person sees a photo of a particular celebrity, their brain reacts the same way – though differently from everyone else’s.

So, this presents an opportunity for a unique combination that can serve as what we call a “brain password.” It’s not just a physical attribute of their body, like a fingerprint or the pattern of blood vessels in their retina. Instead, it’s a mix of the person’s unique biological brain structure and their involuntary memory that determines how it responds to a particular stimulus.

Making a brain password

A person’s brain password is a digital reading of their brain activity while looking at a series of images. Just as passwords are more secure if they include different kinds of characters (letters, numbers and punctuation), a brain password is more secure if it includes brainwave readings of a person looking at a collection of different kinds of pictures.

To set the password, the person would be authenticated some other way, such as coming to work with a passport or other identifying paperwork, or having their fingerprints or face checked against existing records. Then the person would put on a soft, comfortable hat or padded helmet with electrical sensors inside. A monitor would display, for example, a picture of a pig, Denzel Washington’s face and the text “Call me Ishmael,” the opening sentence of Herman Meville’s classic Moby-Dick.

The sensors would record the person’s brain waves. Just as when registering a fingerprint for an iPhone’s Touch ID, multiple readings would be needed to collect a complete initial record. Our research has confirmed that a combination of pictures like this would evoke brain wave readings that are unique to a particular person, and consistent from one login attempt to another.

Later, to login or gain access to a building or secure room, the person would put on the hat and watch the sequence of images. A computer system would compare their brain waves at that moment to what had been stored initially, and either grant access or deny it, depending on the results.

It would take about five seconds, not much longer than entering a password or typing a PIN into a number keypad.

After a hack

Brain passwords’ real advantage comes into play after the almost inevitable hack of a login database. If a hacker breaks into the system storing the biometric templates or uses electronics to counterfeit a person’s brain signals, that information is no longer useful for security. A person can’t change their face or their fingerprints. But, they can change their brain password.

It’s easy enough to authenticate a person’s identity another way, and have them set a new password by looking at three new images maybe this time with a photo of a dog, a drawing of George Washington and a Gandhi quote. Because they’re different images from the initial password, the brainwave patterns would be different too. Our research has found that the new brain password would be tough for attackers to figure out, even if they tried to use the old brainwave readings as an aid.

Brain passwords are endlessly resettable because there are so many possible photos and a vast array of combinations that can be made from those images. There’s no way to run out of these biometric-enhanced security measures.

Secure and safe

As researchers, we are aware that it could be worrying or even creepy for an employer or internet service to use authentication that reads people’s brain activity. Part of our research involved figuring out how to take only the minimum amount of readings to ensure reliable results and proper security without needing so many measurements that a person might feel violated or concerned that a computer was trying to read their mind.

The team initially tried using 32 sensors all over a person’s head and found the results were reliable. Then they progressively reduced the number of sensors to see how many were needed and found that they could get clear and secure results with just three properly located sensors.

This means the sensor device is so small that it can fit invisibly inside a hat or a virtual-reality headset. That opens the door for many potential uses. A person wearing smart headwear, for example, could easily unlock doors or computers with brain passwords. The method could also make cars harder to steal, before starting up, the driver would have to put on a hat and look at a few images displayed on a dashboard screen.

Other avenues are opening as new technologies emerge. The Chinese e-commerce giant Alibaba recently unveiled a system for using virtual reality to shop for items, including making purchases online right in the VR environment. If the payment information is stored in the VR headset, anyone who uses it, or steals it, will be able to buy anything that’s available. A headset that reads its user’s brainwaves would make purchases, logins or physical access to sensitive areas are much more secure.