3 ms·

Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique a

by wtmt 9y ago

Can you expand on the systems that are "hard to obtain by someone claiming to be you" and biometrics? In my readings, I've found that biometrics is not unique across a large population, it changes over one's life span (which means you wouldn't know when it has changed enough to update the system that stores it), changes with one's profession (like physical labor) and health, and that the error rates across a huge population even for iris scans are quite high. For reference, India has a unique ID called Aadhaar that collects ten fingerprints and two iris scans to deduplicate across 1.3 billion people. It uses flawed technology (relying on a fingerprint for authentication or in very rare cases, an iris scan), insecure devices, and generally has a high failure rate due to poor infrastructure. Combined with poor technology, the privacy and security policies and measures are inadequate too. There have been plenty of personal information leaked in the last few years because of the government's obstinate stand that this ID be linked to everything - phone numbers, tax ID, bank accounts, and many more. I don't think there is any solution, including biometrics, that will work to uniquely and unambiguously identify individuals across large populations. I also see more dangers for the populace with such schemes because submitted biometrics, once compromised, cannot be revoked or reissued (this is how the Aadhaar system works - it stores the biometrics as-is).

PeterisP 9y ago
Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.

by wtmt 9y ago

PeterisP 9y ago

Biometrics alone aren't sufficient, but they're a reliable way to prevent identity theft if you have a secure record linking the identity to the biometrics - there will be people with similar faces and may be fingerprint matches, but fraudsters aren't going to easily find a thief that happens to look similar to you, match your fingerprints, and forge a document just to get a small loan or some electronics on your credit. The point is that biometrics can't be treated as "something you know", and the system should be designed in a way that these biometrics getting compromised isn't a big problem; I mean, my EU ID card has a chip with my fingerprints on it, but getting a copy of my fingerprints won't really risk "my identity", all they're good for is to prevent someone else using my documents if they steal it even if their face looks similar. Getting such a secure record, though, generally requires a decent level of gov't infrastructure throughout all areas, and can't be built up quickly. Size alone isn't an issue - if it works for half a billion people in EU, then it'd work for a billion people elsewhere, but the infrastructure needs to be there. I.e., you need a population where all or nearly all births have been properly tracked and reliably registered for a long time, so you can't build it faster than decades if it wasn't the case; you need a general low corruption environment where mass issuing of fake IDs by corrupt officials won't happen (a limited number of fakes by organized crime might be inevitable, but they won't disrupt the system); you need an effective policing system where everyone, including the most poor, would report stolen wallets and documents to be revoked; you need effective infrastructure where it's trivial for everyone giving credit or goods "on lease" to verify online the validity of some documents. I'm not sure how it's in India, and I assume that some of these might be a problem, but for USA (as the original article) all these things are in place and such an ID would work if it was implemented.