28 ms·

Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

402 points by artsandsci 9y ago

garblegarble 9y ago
If it can't be fooled by a picture found online (but not uploaded to facebook) then that must mean facebook is indexing images across the internet and analysing all the faces they find... and if it can, what's the point (edit: from a user point of view)?
- 1337biz 9y ago
  To have the world's best biometric registry that is constantly updated and optimized by it's users.
  - garblegarble 9y ago
    Yes, I should have been more accurate in my original post - what's the point for the user :-)
    - jlgaddis 9y ago
      This doesn't exist to benefit the user. This exists solely to benefit Facebook.
  - vixen99 9y ago
    its users
- timthelion 9y ago
  You really ought to read the book https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel) https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel) I hear the movies crap, but the book is perfect.
  - mkbkn 9y ago
    Yes, the movie is really crap. Didn't know it was based on a book. Will look forward to read it. Thanks.
spayu61 9y ago
That’s not a captcha, that’s used when you’re locked out of your account and they need to verify if it’s you. Like when they ask for your ID card. I assume this only happens if you’ve uploaded pictures of yourself in the past, so they can compare them.
- sliken 9y ago
  Sounds pretty weird. So if I want to steal someones account I just either A) take a picture of them or B) download a picture of their face from facebook? What's the point exactly? Seems as silly as uploading your nekid pics so facebook can prevent them from being distributed. If they really wanted to protect you they would just let you download an app that could analyze the files and upload just enough to detect similar video/pictures. What has facebook done in the past to earn such trust? Seems just the opposite. Isn't it crazy to assume facebook will keep anything you upload secure?
- _jal 9y ago
  Uh, the article disagrees. > In a statement to WIRED, a Facebook spokesperson said the photo test is intended to “help us catch suspicious activity at various points of interaction on the site, including creating an account, sending Friend requests, setting up ads payments, and creating or editing ads.” They're basically training people to provide PII/biometrics on-demand as the price of using their service.
- deleted 9y ago
  [deleted]
nxsynonym 9y ago
Is anyone concerned enough with their facebook profile security to want to be verified on this level? why not a normal 2fa? it seems like there is a hidden agenda behind collecting and analyzing users facial characteristics.
- slig 9y ago
  Knowing fb, this is for their benefit, not the users i.e, they're trying to catch spammers and fake accounts, not see if you're the one accessing your own account or not.
  - mtgx 9y ago
    I fear it's much more insidious than that. Facebook has a tendency to start doing some invasive stuff and then announce it to the world only 5 years later. They probably plan to use your facial profile for a number of things, none of which have to do with authenticating you to the Facebook website. I even see them sharing the profiles with the DHS to build more accurate facial recognition at airports, and other stuff like that. But of course they wouldn't admit it now, because it would mean everyone refusing to use it from day one. No wonder Facebook's attempt at getting people to give them their credit cards to enable ecommerce on the platform has been such an utter failure. The most popular searches on Google on this issue are whether or not you can trust Facebook with your credit card data. That's happening for a reason - Facebook has consistently tried to build a reputation of "shady-as-fuck" company throughout the years, and it's going to pay the price for it, either through stuff like people rejecting its ecommerce platforms, which means fewer billion-dollar monetization opportunities for Facebook in the long-term, or simply stopping using it when they get tired of the company's practices.
    - Chaebixi 9y ago
      > I fear it's much more insidious than that. Facebook has a tendency to start doing some invasive stuff and then announce it to the world only 5 years later. > They probably plan to use your facial profile for a number of things, none of which have to do with authenticating you to the Facebook website. I even see them sharing the profiles with the DHS to build more accurate facial recognition at airports, and other stuff like that. But of course they wouldn't admit it now, because it would mean everyone refusing to use it from day one. This validates my little project of uploading a ton of stock photos to my Facebook account and tagging myself in them.
oblib 9y ago
I will never do this. I don't even post photos of myself on FB, or use "Messenger" or their mobile app, so it probably wouldn't work anyway, but I have no doubt they're looking to monetize the feature and that businesses and governments are their target markets.
- Harkins 9y ago
  They still have your face from scanning your friends' photos and contacts. Combine datestamp, location, messages, and posts over years and Facebook knows who was together for a photo whether or not you've uploaded any or been tagged. Facebook knows the face of everyone who is on Facebook or who knows a few people who are.
  - staplers 9y ago
    I can pull a fingerprint off the subway stair rails but that doesn't mean I can identify who it is. We anonymously reveal ourselves everyday but the danger comes from confirming which data is ours. The goal is to make it difficult not impossible.
    - sandworm101 9y ago
      They don't need you to confirm it. This isn't a criminal case. They just need to be reasonably confident. Your face is in a picture with four other people. They can see that phones belonging to four people, who regularly chat with each other, were all at the same location at the time the photo was taken. They are now reasonably confident that your face is one of those four. Do that five or six times and their robots will know your face. Whether you confirm it or not doesn't really matter.
      - staplers 9y ago
        They can see that phones belonging to four people, who regularly chat with each other, were all at the same location at the time the photo was taken. How would they "see" your phone without the facebook app installed?
bartkmq 9y ago
I'm sure the biometric data harvested from these pictures won't be abused by three letters agencies.
- GCU-Empiricist 9y ago
  You forgot your /s
cooervo 9y ago
big brother zuckerberg
- vinchuco 9y ago
  Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks. https://news.ycombinator.com/item?id=1349934 https://news.ycombinator.com/item?id=1349934
djohnston 9y ago
I mean you need to pick your poison here. You either give facebook more data to validate your authenticity or you allow botnets to influence the social networks. It seems impossible to have it both ways, although I'm willing to hear alternatives in the general case.
- hnarn 9y ago
  Authenticity validation could be completely external from Facebook, and if they gave a shit about your privacy they would not only be OK with it but even push for it. Many countries already have crypto-secure solutions for verifying their identity when submitting things like tax forms. Facebook just needs to start using them, but they won't, and it's obvious why.
  - likpok 9y ago
    > and it's obvious why. Because most countries don't have crypto-secure identity verification, which means Facebook would still need something like this? I suppose they could contract out to Experian (or other local providers) and ask you to answer some questions from your credit report, but I'm not sure that's really a good solution either.
    - hnarn 9y ago
      I thought it was clear enough that I mean't that it's obvious why [Facebook will never implement it even in countries where it already exists]. It's not in their interest to do so, because it's not in their interest to protect the privacy of their users.
      - kinkrtyavimoodh 9y ago
        Just because you could only think of a sarcastic reason why Facebook doesn't want to do it doesn't mean that other reasons for it don't exist. That's precisely what the GP is saying—FB needs to come up with systems that work for literally the whole world.
skytreader 9y ago
> The process is automated, including identifying suspicious activity and checking the photo. ... The Facebook spokesperson said the photo test is one of several methods, both automated and manual, used to detect suspicious activity. So I don't get if this "captcha" process is automated or manual (...or both)? Somewhere else in the article it says that users are apparently locked out of their accounts until the pic is verified. Seems odd that there should be a lock-out period if the process is automated (as the first sentence of the above quote implies). ALSO, for a captcha, isn't this dead easy for bots? Get a DeepDream/Generative Adversarial Network instance to generate faces for you. Bam. This is not a barrier.
- intopieces 9y ago
  Couple things. 1.) The face verification is automatic. It is among other processes that are automatic and some other processes that are manual. 2.) Lock out periods are to prevent repeated attempts. 3.) The face has to match the face of the account, so generating a new face won’t work.
  - dragonwriter 9y ago
    > The face has to match the face of the account, so generating a new face won’t work. It quite easily could work well if the account has, or is tagged in, any public images and those are used as input to the generation process. (Or if it's associated with a person of whom there are public images in other sources, off of Facebook.) I'm assuming the process is sophisticated enough that you can't just post an existing public Facebook image of the user without modification, but that may be too generous.
  - skytreader 9y ago
    Where was it specified that lock-outs are to prevent repeated attempts? It is a plausible reason but the premise of my question (and confusion as to whether this process is automatic or not) stems from: > ...users are locked out of their accounts _while the photo is being verified_. A message said, “You Can’t Log In Right Now. We’ll get in touch with you _after we’ve reviewed your photo_. You’ll now be logged out of Facebook as a security precaution.” Emphasis mine. "after we've reviewed your photo" --> FB can autotag people as pictures are uploaded. Surely they can verify face similarity instantly?
lousken 9y ago
Facebook already locked me out of my account asking for it and since I'll never send it I guess I can finally stop using it... thanks facebook
NiklasMort 9y ago
maybe this is how skynet starts
- thg 9y ago
  Skynet is entertainment. A real ASI will be much more proficient at removing threats. Both nanobots and a genetically engineered super virus, for example, would be very well suited to extinguish humanity in a timeframe that makes resistance / retaliation impossible. Now if I as a dumb human can come up with that, just imagine what a being incredibly smarter than anything we could imagine could come up with.
intopieces 9y ago
This doesn’t seem too weird considering the service is called “face” book, and the point is to upload photos of your face. They have been using facial recognition for years now, this is a natural extension of that. I am not a user, but I see the value. It’s creepy as hell, yes, but I see the value.
Waterluvian 9y ago
I should write a blog post about this, but to those thinking about deleting Facebook, My experience deleting it 5 years ago is summarized as: my friend count went way down, my friend quality went way up. Your results may vary, but the purpose of my comment is not to immediately be worried that Facebook is a mandatory lifeline for your social life.
- Sir_Substance 9y ago
  To add to this, you can always /try/ deleting your facebook account and see if it's for you. It's not like facebook is a nightclub that will refuse re-entry once you leave or anything.
  - glitcher 9y ago
    My account went inactive and eventually was disabled. To get back into the "nightclub" now, I must submit a copy of my photo ID to verify my identity. No thanks to the Facebook bouncer thugs guarding the entrance...
    - Sir_Substance 9y ago
      One has to assume anyone on facebook is ok with that though, it is the nature of the service these days, even if you joined before it was like that.
    - ImSkeptical 9y ago
      I had a similar experience, but submitted a picture of my congressman (who was standing in front of a billowing American flag) which was accepted without comment by Facebook.
- reaperducer 9y ago
  A few years ago I walked away from Facebook. Three months later, I got a phone call from my mother (who's not online) because she heard through the grapevine that I was dead. My stupid Facebook "friends" took my silence for something sinister and jumped to conclusions. I ended up returning to Facebook and purging my "friend" list down to just a dozen actual friends.
reaperducer 9y ago
Straw, meet camel's back. I'll give up Facebook before I give up that level of privacy.
gruez 9y ago
feels like this could be easily bypassed with something like this https://www.theverge.com/2017/10/30/16569402/ai-generate-fake-faces-celebs-nvidia-gan https://www.theverge.com/2017/10/30/16569402/ai-generate-fak...
wruza 9y ago
Apart from possible biometrics collection, it is Facebook that now decides how do you behave and what to grant you for your behavior. Like Santa for adults. Maybe it’s time to open your eyes and see that there is no Santa since 1984?
tobyhinloopen 9y ago
I want to create a library for generating photos of computer-generated faces
tobyhinloopen 9y ago
https://petapixel.com/2017/11/07/ai-creates-photo-realistic-faces-people-dont-exist/ https://petapixel.com/2017/11/07/ai-creates-photo-realistic-... Tadaa. Another pointless privacy invasion that only affects the fair and honest.
- pierrec 9y ago
  Hmm, this wouldn't help you defeat the system at all, unless I'm missing something. What you need is a model to generate photos of your face.
  - Balgair 9y ago
    FB is most likely trying to ward off spammers with this idea. Generating unique faces per spam-bot is easy now, for sophisticated spammers, then for every spammer in a few months. The poster is trying to say that this FB effort won't work well and is already only adversely affecting the most stupid and trusting.
    - pierrec 9y ago
      Good point, I was only considering the case where FB uses this technique to verify an existing user's identity using facial recognition (which seems like a "logical" use case). I missed the part where they said they might use it for account creation as well (which makes less sense and seems like a pretty baroque, intrusive and ineffective captcha).
rayshan 9y ago
Facial verification, together with cell phone number, which requires an ID to purchase, has been the standard practice for internet companies in China for a while now, e.g. for WeChat, Alipay, etc.
clamprecht 9y ago
Last paragraph of the article: "The new authentication scheme is the second in recent weeks that relies on photos. Earlier this month, Facebook asked users to upload nude photos to Facebook Messenger, as part of an effort to prevent revenge porn. Facebook said it would use the nude photos to create a digital fingerprint against which to compare future posts." Wait what? I had to check whether today was April 1st.
- jsonne 9y ago
  I couldn't believe it. This is the most absurd thing I have ever heard.
  - colordrops 9y ago
    It really does seem like something an elite private club would do to get a laugh out of fooling the proles while smoking a cigar and browsing the pictures.
    - Crespyl 9y ago
      > they "trust me" ... dumb f*cks
    - dwaltrip 9y ago
      It's more like oblivious high-paid product managers and devs who can't fathom why people wouldn't trust Facebook or that Facebook might not be a purely beneficial organization.
      - threeseed 9y ago
        I think you've completely missed the point here. Teenagers who have naked photos in the possession of their peers need a solution for preventing dissemination. And so if you're in this situation trusting Facebook is by far the lesser of two evils.
        9y ago
ameister14 9y ago
They say they will permanently delete it off of their servers, but the numerous cases where they lied about deleting account information doesn't exactly engender a feeling of trust.
- Balgair 9y ago
  A friend does HW for Seagate servers and has talked a bit about the 'math' of servers. The reality is the FB may or may not delete the pics, no matter what they think they really did. With the amount of servers they utilize, one is failing about every second, permanently erasing all the data on it. Yes, back-up servers, and copies of the data. Still, a lot of data is getting trashed every second. So, they may be trying to weasel these pics, but do not trust that they are smart enough to get around the hard facts of server decay. If they are being honest, then there is still no way to determine if some back-up somewhere actually is storing the data, despite their best efforts. The code stack for something like FB is so huge, there really is no way of knowing where a piece of data is or isn't. Kafka would be beaming at it's absurdity. In addition, they also have a lot of 'fresh' servers out there, spinning about for months, not being written to, as some algorithm works it's way around using the fresh servers. These also fail, having never been used. Seagate does not mind when companies like FB do this nonsense.
deleted 9y ago
[deleted]
znpy 9y ago
S C A R Y C A R Y
deadmetheny 9y ago
Oh boy, what's bound to be another thread full of "delete your Facebook", the new and improved "I don't own a television" statement. Good for you, some of us actually appreciate the utility value from having a place to plan events and ensure people actually see that sort of thing. That said, this is a completely nonsense "solution" when there's plenty of other ways to perform verification that don't do double duty of implementing facial recognition tech to ensure we get to the dystopian tech hellscape sooner than later. Wow, didn't take long for the downvote brigade to show up for having a contrary opinion to the herd on this one.
- wu-ikkyu 9y ago
  >Oh boy, what's bound to be another thread full of "delete your Facebook", the new and improved "I don't own a television" statement. Maybe you're being downvoted because this statement is just as cliché, if not moreso (given the amount of FB users vs non FB users) than the "delete your FB" cliché
- nindalf 9y ago
  > there's plenty of other ways to perform verification I'd love to hear more about this.
- pvdebbe 9y ago
  I have long thought if I'm missing anything by not perusing Facebook event pages or anything. Fortunately within my interests (hifi audio, local jazz, photography and computer special interest group meetings) they all still operate within self-hosted forums or blogs and not in facebook.
tinus_hn 9y ago
Just upload a picture of one of the millions of people that haven’t cleared this hurdle yet and the problem is on somebody else’s plate.
eveningcoffee 9y ago
This is outrageous invasion of privacy. Facebook must die.
bogomipz 9y ago
>"The company declined to share details to prevent the system from being manipulated. Suspicious activity might include someone who consistently posts from New York and then starts posting from Russia." So in others words people who travel or go on vacation?
- ihsw2 9y ago
  Numerous systems that scrutinize IP-based geolocation information already throw up additional security checks when detecting changes. Personally I welcome it, especially when banks do it. It's low-hanging fruit TBH. It massively fucks with those using VPN or Tor but I'm fine with that.
  - bogomipz 9y ago
    Except that FB isn't a bank and doesn't store one's financial data. Also this argument falls flat as we are an increasingly mobile population whether that be travel for pleasure or business. I remember watching in amusement/horror as a friend I was traveling with in Thailand wasn't able to access her Facebook account unless she verified via her phone that she was actually attempting to log into her account from Thailand. It's like you're supposed to check in with Facebook and let them know where you are. So creepy.
    - kinkrtyavimoodh 9y ago
      What sort of ridiculous nitpicking is this? First, FB does have a Payments feature, so if you are being pedantic, it does deal with one's financial world. Second, for a lot of people, their FB profile has a lot of confidential information, and is tied to their personal identity so they can't have the risk of it being compromised based on leaked passwords or whatever. It may not matter for you, but I am happy that they are safeguarding my account just the way a bank would.
      - bogomipz 9y ago
        There's nothing nitpicky in anything I wrote. FB is not a bank. And it can not be used as someone's financial institution. >"Second, for a lot of people, their FB profile has a lot of confidential information, and is tied to their personal identity so they can't have the risk of it being compromised based on leaked passwords or whatever." Who puts "confidential information" on FB? FB is based on the premise of voluntarily sharing" information. If people are willing to share information on a social networking site it can't really be considered "confidential" or even "sensitive" to you can it? Also FB is not one's identity, despite what FB would like you to believe that it is.
quotha 9y ago
This is literally the name of the company
- Kenji 9y ago
  Clever. You deserve an upvote.
PadThai89 9y ago
What do you think Facebook could do here, that wouldn't violate privacy, to verify that you are who you claimed to be?
nsaaass 9y ago
You really want to put your plain face to cia nsa database ? I hope people leave this platform asap
cbhl 9y ago
Sure, Facebook might delete your photo when they're done, but they probably won't delete any machine learning models that they trained using it.
- josephpmay 9y ago
  I'm pretty sure Facebook already has plenty of training data of faces
  - eternalban 9y ago
    Excuse me. The issue is biometrics. "We'll delete the picture" =/= "we'll delete the control points and features extracted from your pics".
    - obmelvin 9y ago
      Is there any precedent for recovering individual training items from a model trained on 100m+ examples?
      - eternalban 9y ago
        What recovery? You're uploading your pic via your account. It is already associated with you.
        obmelvin 9y ago
        As I understood it you are making the argument that they will have information about you from uploading this picture even if they delete the actual picture. I'm genuinely asking if it is possible to recover an individual training example from a model which is shown vast amounts of data. I'm only aware of being able to recover stuff like this - https://ars.els-cdn.com/content/image/1-s2.0-S0893608017302095-gr9.jpg https://ars.els-cdn.com/content/image/1-s2.0-S08936080173020... which is hardly PII
        9y ago
alde 9y ago
>"Please upload a photo of yourself that clearly shows your face. We’ll check it and then permanently delete it from our servers." >"To determine if the account is authentic, Facebook looks at whether the photo is unique." The two statements are a bit contradictory. They might delete the photo but they won't delete its signature/fingerprint, because they need the later to check for uniqueness of other accounts.
- eternalban 9y ago
  Count your blessings. They could have additionally asked for a picture that "clearly shows your genitals". Anywho, once the 'revenge porn' crowd starts hacking around this by chopping the said head from the said images, the central servers of FB are sure to ask for pics of genitals.
  - thomastjeffery 9y ago
    > Count your blessings. No. Facebook is not the Almighty God.
mvdwoord 9y ago
I uploaded a cropped/mirrored picture of Jack Nicholson in the Shining. After 48 hours the account was working again, no idea what happens in that process.
- mirimir 9y ago
  Well, it's rather disappointing that they didn't catch something as simple as that ;) It's already nontrivial to create fake Facebook accounts. For those serious about it, who already deal with IPs and mobile numbers, I can't imagine that creating novel photorealistic faces would be all that problematic.
  - thomas_howland 9y ago
    Not that surprising; can you recognize random Bollywood stars?
- kinkrtyavimoodh 9y ago
  I'd advise against playing such games if your FB account matters to you. They have often blocked / disabled accounts based on these things. If not, then go ahead, by all means.
  - mvdwoord 9y ago
    I have deleted my fb years ago. Had to reinstate because apparently you need(ed) it for Tinder signup. I was horny.
jrochkind1 9y ago
Like it's hard to get a bunch of photos of real faces?
Tharkun 9y ago
I was recently locked out of my FB account. The only way to unlock it was to identify my friends' pictures. Apparently sending me an e-mail was too much trouble ... Haven't been able to log in since, as I refuse to partake in that sort of bullshit. Can't say I miss it.
- pishpash 9y ago
  What do you have against identifying friends' profile images, of all things? Facebook already has them.
  - cowpig 9y ago
    If one of my friends identified me in a photo to facebook, I would not be happy about it. I generally ask everyone who knows me not to upload photos I'm in to facebook at all beyond what's already there.
    - jsemrau 9y ago
      Exactly, the point it validates and updates the current status of friendship you have. Further it informs facebook who are the people you really know opposite to your "facebook friends" .
  - shostack 9y ago
    FB doesn't necessarily have the names of everyone in all those photos. I wonder if they would ever do something like show you three photos of friends as the captcha, but they only know the answers for two of them and are using the third to get you to give them info they didn't already have without you knowing.
- JoshMnem 9y ago
  You could upload a fake photo to login, delete your content, and then delete your Facebook account.
  - AlphaWeaver 9y ago
tanilama 9y ago
Face Book
YeGoblynQueenne 9y ago
>> “Please upload a photo of yourself that clearly shows your face. We’ll check it and then permanently delete it from our servers.” >> To determine if the account is authentic, Facebook looks at whether the photo is unique. I assume this means that the photo itself is deleted but a one-way hash of it created to test against later. However, if I change one pixel of a picture of my face, A, to produce a new picture of my face, A', the hash of A' will not be the same as the hash of A, correct? And I can repeat this process n x m times, where n, m the dimension of the image, ja? Additionally- when they say "unique", do they mean "known as unique" to Facebook, or "unique in the entire world"? If I take a picture of myself and put it on, dunno, my blog on Blogger, what's stopping someone copying it and uploading it to Facebook to pretend it's me? Will Facebook search the entire web for images potentially matching an uploaded image? For the record, I don't use Facebook. And there are no pictures of myself anywhere on the internets. As if.
- czardoz 9y ago
  It doesn't have to be a hash really. They probably use some image processing techniques to process facial features and store the signature. I'm not sure how it identifies a human from a bot though.
- oh_sigh 9y ago
  Hashes don't necessarily work on the raw bit representation of something. You can have a hash which works on higher level constructs, which for images one solution would be called a perceptual hash.
  - thisacctforreal 9y ago
    I thought the accepted term for this was "fingerprint" not "hash".
    - oh_sigh 9y ago
      Hashes produce fingerprints(including perceptual hashes). Most people are talking about cryptographic hash functions when talking about 'hashing' but that is just one type. There is a wikipedia page for 'perceptual hashing' as well as a number of libraries available which claim to do perceptual hashing, so it may just come down to what kind of crowd you roll with :)
bsaul 9y ago
I used to think richard stallman was just a paranoid lunatic... Well, the more time goes by, the more i think he was just 100% right. It's time to be much much more careful and radical with the path technology is taking us. It's time we all invest a bit of our time to provide real open and benevolent alternatives to facebook, google, amazon, and all the rest, because they're steering internet toward an orwelian nightmare.
- DesiLurker 9y ago
  try ello
- mxuribe 9y ago
  There are existing social media alternatives to facebook, such as: gnu social; postActiv; mastodon; diaspora; hubzilla; etc.
  - bsaul 9y ago
    it's a great start but it's not mainstream yet. We need something as polished as wikipedia.
- Santosh83 9y ago
  Network effects. You and me care. Sadly the vast majority around us bow unquestioningly to demands made by powerful groups like their govt or huge mega-corps. People seem to think these power-centres will always be benevolent and flawless... which history shows is a big mistake to assume.
  - wallace_f 9y ago
    Fake News! Can't we have some trusted institution like ycombinator put these kind of comments through their truth filter before allowing them to be posted? They could even partner with Facebook to do this. /s
  - bsaul 9y ago
    I wouldn’t put a democratic government on the same level of danger than profit driven mega corps. I’m pro free market, but some corps have reach state-level impact on people lives, and they remain without any kind of overview. I also don’t want state-run web sites to try to provide alternatives to Google ( like europe tried to do 10 years ago), so i think the foundation model is the perfect structure for that. Economically responsible, but not profit driven.
dv_dt 9y ago
So right around we when start exploring the dumpster fire of of SSNs and personal data collection with Equifax and the entire credit reporting / financial industry, a new form of personal data collection as well as mixing up identification and authorization arises ... (I blame Apple too...)
elchief 9y ago
Ah biometrics, the password you can't change
pleasecalllater 9y ago
The next level would probably be: provide your SSN.
- 659087 9y ago
  Experian probably already shared that with them.
banderman 9y ago
Uber does this for their drivers to confirm it's the registered person driving the vehicle.
tudorconstantin 9y ago
All that spammers have to do now is to upload other people's photos first. Imagine the surprise we'll have when we'll find out our accounts were cloned.
jacobush 9y ago
I read at first “China’s New Captcha Test”.
hota_mazi 9y ago
I find their claim that the picture will be deleted from their servers at odds with their claim that they will make sure that photo is unique. I suspect that what they're not saying is that they will keep some signature/hash/data about the photo, which I'm sure they will use for much more than just verifying uniqueness.
- rdiddly 9y ago
  Yep, that's in the article. They say they'll hash it and delete it (the photo). They don't claim they'll delete the hash. Having the hash is enough to check for uniqueness. Although it's sort of an over-strict definition of uniqueness. Example: I change one pixel → That produces a drastically different hash → That makes the almost-identical photo seem unique. I'd be surprised if they weren't extracting other info from the photo or training ML models on it as others suggest here.
  - jstanley 9y ago
    > I change one pixel → That produces a drastically different hash If they're hashing the raw bytes, sure. If they're hashing a representation of the face that encodes meaning (like the relative locations of facial features), then changing one pixel is unlikely to affect that.
    - rdiddly 9y ago
      Indeed - lots of things could be concealed in that phrase "the photos are hashed!"
hackbinary 9y ago
No. Like Nancy Reagan said, "just say no." Your likeness is your data.
dba7dba 9y ago
Eject eject eject Abandon ship. Or abandon Facebook. .
caf 9y ago
You would think that for captcha purposes (ie. a unique, quickly produced, creative item) it would suffice to say "draw a picture of a dog" (or "upload a clear photo of your hand").
abiox 9y ago
i signed up with facebook (with a unique email), and encountered this. i used a picture (a painting, rather) of george washington. it seemed to work at first, but when i tried logging in a month or two later my account was disabled. perhaps i wasn't the only person using that image and they were displeased.
will_hughes 9y ago
Instagram did this same bullshit to me when I signed up for an account to to follow some photographers. 'Please provide a clear photo of yourself holding your government issued ID, and a piece of paper with the following code handwritten on it'. No, fuck that for a joke. There's this growing trend of everyone wanting your photo and some ID, and then you have no way to verify that information is being kept securely or used for appropriate reasons.
- Santosh83 9y ago
  Scarily similar to this: https://imgur.com/a/uQrKn https://imgur.com/a/uQrKn
- goialoq 9y ago
  Instagram is Facebook
- Tarq0n 9y ago
  I wonder if some three letter agency is paying facebook to build them the biggest face recognition database in the world.
  - JoBrad 9y ago
    No need to get all conspiratorial. Picasa did it before Google, AWS does it now. It’s what people (writ large) want.
    - owebmaster 9y ago
      > No need to get all conspiratorial How I wish large scale surveillance was conspiratorial. Do you really believe in what you say or is it only habit?
    - mitchellberry 9y ago
      Considering nearly every adult provides a photo of higher quality to their respective governments it does seem a tad conspiratorial and like a lot of unecessary effort. Also being a part of the 14 eyes means if the United States wanted my biometrics all they need to do is ask. My country is already moving towards real time cctv identification in airports etc. using biometrics from any issued license / passport.
WhoBeI 9y ago
Are they allowed to sell the "fingerprint" packaged with your name to advertising agencies? If so it should only be a matter of time before those Minority Report inspired advertising screens start popping up everywhere.. The advertisers can always protect that system with some DRM to get the mighty DMCA on their side. That way they don't need to build a robust solution and can still wipe their hands clean if they loose it all to a 12 year old script kiddie.
ArlenBales 9y ago
This isn't very future-proof. Computer graphics today can produce human faces that are extremely realistic. Someone will make a random-face generator, and a bot will pipe random faces to Facebook.
vonuebelgarten 9y ago
Question: is Wired actively blocking archive.is? I tried to archive this article just to get a repeated "Network error" [1] which may be a sign of a Layer 3 block. A trivial search [2] shows no page is successfully archived since the end of September. [1] https://archive.is/eU7Yn https://archive.is/eU7Yn [2] https://archive.is/www.wired.com https://archive.is/www.wired.com
mikgan 9y ago
AirBnB does this today, had to go through the process a few weeks ago to create an account to book a room! And of course the process failed,.. and of course we thought we were going to miss out on our room booking,.. and of course I now really dislike airBnB
quadrangle 9y ago
I have to say: as much as I probably agree with every critic of this… The damn thing is called FACEbook, so it would almost be wrong for them not to do this! (I don't know a mark for whatever this is, it's not sarcasm or irony, something about tragic comedy fate…)
vsc 9y ago
Sorry, I don't understand, but wouldn't someone ( suspicious ) also have a photo of yours if they have the access to your account. They could easily upload that photo and pass the captcha test .. Or am I missing something?
- cJ0th 9y ago
  If I understand it correctly they would have to provide a photo with your face that FB hasn't seen before. Still rather easy to obtain for the determined.
bprasanna 9y ago
Applies to most of the biggies: Since i am a behemoth of tech, give me all your personal info and surrender yourself. I will tell you what you should see, eat, buy, think & whom you should be-friend! In return your everyday personal data is my asset, my asset only! Its up to me how i use your personal data. NO QUESTION SHOULD BE ASKED! Remember you have signed the agreement (Privacy Policy)!
Partyone 9y ago
Its good to have better security features.
jamiethompson 9y ago
Because if you were accessing someone else's Facebook account you wouldn't have access to a whole bunch of photos of their face would you.
Shinchy 9y ago
This is a classic example of technical staff not thinking about what a user would do.
y04nn 9y ago
Ok, but would it work against generative network generated faces? cf. https://towardsdatascience.com/implementing-a-generative-adversarial-network-gan-dcgan-to-draw-human-faces-8291616904a https://towardsdatascience.com/implementing-a-generative-adv...

402 points by artsandsci 9y ago

If it can't be fooled by a picture found online (but not uploaded to facebook) then that must mean facebook is indexing images across the internet and analysing all the faces they find... and if it can, what's the point (edit: from a user point of view)?

1337biz 9y ago
To have the world's best biometric registry that is constantly updated and optimized by it's users.
- garblegarble 9y ago
  Yes, I should have been more accurate in my original post - what's the point for the user :-)
  - jlgaddis 9y ago
    This doesn't exist to benefit the user. This exists solely to benefit Facebook.
- vixen99 9y ago
  its users
timthelion 9y ago
You really ought to read the book https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel) https://en.wikipedia.org/wiki/The_Circle_(Eggers_novel) I hear the movies crap, but the book is perfect.
- mkbkn 9y ago
  Yes, the movie is really crap. Didn't know it was based on a book. Will look forward to read it. Thanks.

spayu61 9y ago

That’s not a captcha, that’s used when you’re locked out of your account and they need to verify if it’s you. Like when they ask for your ID card. I assume this only happens if you’ve uploaded pictures of yourself in the past, so they can compare them.

sliken 9y ago
Sounds pretty weird. So if I want to steal someones account I just either A) take a picture of them or B) download a picture of their face from facebook? What's the point exactly? Seems as silly as uploading your nekid pics so facebook can prevent them from being distributed. If they really wanted to protect you they would just let you download an app that could analyze the files and upload just enough to detect similar video/pictures. What has facebook done in the past to earn such trust? Seems just the opposite. Isn't it crazy to assume facebook will keep anything you upload secure?
_jal 9y ago
Uh, the article disagrees. > In a statement to WIRED, a Facebook spokesperson said the photo test is intended to “help us catch suspicious activity at various points of interaction on the site, including creating an account, sending Friend requests, setting up ads payments, and creating or editing ads.” They're basically training people to provide PII/biometrics on-demand as the price of using their service.
deleted 9y ago
[deleted]

nxsynonym 9y ago

Is anyone concerned enough with their facebook profile security to want to be verified on this level? why not a normal 2fa? it seems like there is a hidden agenda behind collecting and analyzing users facial characteristics.

slig 9y ago
Knowing fb, this is for their benefit, not the users i.e, they're trying to catch spammers and fake accounts, not see if you're the one accessing your own account or not.
- mtgx 9y ago
  I fear it's much more insidious than that. Facebook has a tendency to start doing some invasive stuff and then announce it to the world only 5 years later. They probably plan to use your facial profile for a number of things, none of which have to do with authenticating you to the Facebook website. I even see them sharing the profiles with the DHS to build more accurate facial recognition at airports, and other stuff like that. But of course they wouldn't admit it now, because it would mean everyone refusing to use it from day one. No wonder Facebook's attempt at getting people to give them their credit cards to enable ecommerce on the platform has been such an utter failure. The most popular searches on Google on this issue are whether or not you can trust Facebook with your credit card data. That's happening for a reason - Facebook has consistently tried to build a reputation of "shady-as-fuck" company throughout the years, and it's going to pay the price for it, either through stuff like people rejecting its ecommerce platforms, which means fewer billion-dollar monetization opportunities for Facebook in the long-term, or simply stopping using it when they get tired of the company's practices.
  - Chaebixi 9y ago
    > I fear it's much more insidious than that. Facebook has a tendency to start doing some invasive stuff and then announce it to the world only 5 years later. > They probably plan to use your facial profile for a number of things, none of which have to do with authenticating you to the Facebook website. I even see them sharing the profiles with the DHS to build more accurate facial recognition at airports, and other stuff like that. But of course they wouldn't admit it now, because it would mean everyone refusing to use it from day one. This validates my little project of uploading a ton of stock photos to my Facebook account and tagging myself in them.

oblib 9y ago

I will never do this. I don't even post photos of myself on FB, or use "Messenger" or their mobile app, so it probably wouldn't work anyway, but I have no doubt they're looking to monetize the feature and that businesses and governments are their target markets.

Harkins 9y ago
They still have your face from scanning your friends' photos and contacts. Combine datestamp, location, messages, and posts over years and Facebook knows who was together for a photo whether or not you've uploaded any or been tagged. Facebook knows the face of everyone who is on Facebook or who knows a few people who are.
- staplers 9y ago
  I can pull a fingerprint off the subway stair rails but that doesn't mean I can identify who it is. We anonymously reveal ourselves everyday but the danger comes from confirming which data is ours. The goal is to make it difficult not impossible.
  - sandworm101 9y ago
    They don't need you to confirm it. This isn't a criminal case. They just need to be reasonably confident. Your face is in a picture with four other people. They can see that phones belonging to four people, who regularly chat with each other, were all at the same location at the time the photo was taken. They are now reasonably confident that your face is one of those four. Do that five or six times and their robots will know your face. Whether you confirm it or not doesn't really matter.
    - staplers 9y ago
      They can see that phones belonging to four people, who regularly chat with each other, were all at the same location at the time the photo was taken. How would they "see" your phone without the facebook app installed?

bartkmq 9y ago

I'm sure the biometric data harvested from these pictures won't be abused by three letters agencies.

GCU-Empiricist 9y ago
You forgot your /s

cooervo 9y ago

big brother zuckerberg

vinchuco 9y ago
Zuck: People just submitted it. Zuck: I don't know why. Zuck: They "trust me" Zuck: Dumb fucks. https://news.ycombinator.com/item?id=1349934 https://news.ycombinator.com/item?id=1349934

djohnston 9y ago

I mean you need to pick your poison here. You either give facebook more data to validate your authenticity or you allow botnets to influence the social networks. It seems impossible to have it both ways, although I'm willing to hear alternatives in the general case.

hnarn 9y ago
Authenticity validation could be completely external from Facebook, and if they gave a shit about your privacy they would not only be OK with it but even push for it. Many countries already have crypto-secure solutions for verifying their identity when submitting things like tax forms. Facebook just needs to start using them, but they won't, and it's obvious why.
- likpok 9y ago
  > and it's obvious why. Because most countries don't have crypto-secure identity verification, which means Facebook would still need something like this? I suppose they could contract out to Experian (or other local providers) and ask you to answer some questions from your credit report, but I'm not sure that's really a good solution either.
  - hnarn 9y ago
    I thought it was clear enough that I mean't that it's obvious why [Facebook will never implement it even in countries where it already exists]. It's not in their interest to do so, because it's not in their interest to protect the privacy of their users.
    - kinkrtyavimoodh 9y ago
      Just because you could only think of a sarcastic reason why Facebook doesn't want to do it doesn't mean that other reasons for it don't exist. That's precisely what the GP is saying—FB needs to come up with systems that work for literally the whole world.

skytreader 9y ago

> The process is automated, including identifying suspicious activity and checking the photo. ... The Facebook spokesperson said the photo test is one of several methods, both automated and manual, used to detect suspicious activity. So I don't get if this "captcha" process is automated or manual (...or both)? Somewhere else in the article it says that users are apparently locked out of their accounts until the pic is verified. Seems odd that there should be a lock-out period if the process is automated (as the first sentence of the above quote implies). ALSO, for a captcha, isn't this dead easy for bots? Get a DeepDream/Generative Adversarial Network instance to generate faces for you. Bam. This is not a barrier.

intopieces 9y ago
Couple things. 1.) The face verification is automatic. It is among other processes that are automatic and some other processes that are manual. 2.) Lock out periods are to prevent repeated attempts. 3.) The face has to match the face of the account, so generating a new face won’t work.
- dragonwriter 9y ago
  > The face has to match the face of the account, so generating a new face won’t work. It quite easily could work well if the account has, or is tagged in, any public images and those are used as input to the generation process. (Or if it's associated with a person of whom there are public images in other sources, off of Facebook.) I'm assuming the process is sophisticated enough that you can't just post an existing public Facebook image of the user without modification, but that may be too generous.
- skytreader 9y ago
  Where was it specified that lock-outs are to prevent repeated attempts? It is a plausible reason but the premise of my question (and confusion as to whether this process is automatic or not) stems from: > ...users are locked out of their accounts _while the photo is being verified_. A message said, “You Can’t Log In Right Now. We’ll get in touch with you _after we’ve reviewed your photo_. You’ll now be logged out of Facebook as a security precaution.” Emphasis mine. "after we've reviewed your photo" --> FB can autotag people as pictures are uploaded. Surely they can verify face similarity instantly?

lousken 9y ago

Facebook already locked me out of my account asking for it and since I'll never send it I guess I can finally stop using it... thanks facebook

NiklasMort 9y ago

maybe this is how skynet starts

thg 9y ago
Skynet is entertainment. A real ASI will be much more proficient at removing threats. Both nanobots and a genetically engineered super virus, for example, would be very well suited to extinguish humanity in a timeframe that makes resistance / retaliation impossible. Now if I as a dumb human can come up with that, just imagine what a being incredibly smarter than anything we could imagine could come up with.

intopieces 9y ago

This doesn’t seem too weird considering the service is called “face” book, and the point is to upload photos of your face. They have been using facial recognition for years now, this is a natural extension of that. I am not a user, but I see the value. It’s creepy as hell, yes, but I see the value.

Waterluvian 9y ago

I should write a blog post about this, but to those thinking about deleting Facebook, My experience deleting it 5 years ago is summarized as: my friend count went way down, my friend quality went way up. Your results may vary, but the purpose of my comment is not to immediately be worried that Facebook is a mandatory lifeline for your social life.

Sir_Substance 9y ago
To add to this, you can always /try/ deleting your facebook account and see if it's for you. It's not like facebook is a nightclub that will refuse re-entry once you leave or anything.
- glitcher 9y ago
  My account went inactive and eventually was disabled. To get back into the "nightclub" now, I must submit a copy of my photo ID to verify my identity. No thanks to the Facebook bouncer thugs guarding the entrance...
  - Sir_Substance 9y ago
    One has to assume anyone on facebook is ok with that though, it is the nature of the service these days, even if you joined before it was like that.
  - ImSkeptical 9y ago
    I had a similar experience, but submitted a picture of my congressman (who was standing in front of a billowing American flag) which was accepted without comment by Facebook.
reaperducer 9y ago
A few years ago I walked away from Facebook. Three months later, I got a phone call from my mother (who's not online) because she heard through the grapevine that I was dead. My stupid Facebook "friends" took my silence for something sinister and jumped to conclusions. I ended up returning to Facebook and purging my "friend" list down to just a dozen actual friends.

reaperducer 9y ago

Straw, meet camel's back. I'll give up Facebook before I give up that level of privacy.

gruez 9y ago

feels like this could be easily bypassed with something like this https://www.theverge.com/2017/10/30/16569402/ai-generate-fake-faces-celebs-nvidia-gan https://www.theverge.com/2017/10/30/16569402/ai-generate-fak...

wruza 9y ago

Apart from possible biometrics collection, it is Facebook that now decides how do you behave and what to grant you for your behavior. Like Santa for adults. Maybe it’s time to open your eyes and see that there is no Santa since 1984?

tobyhinloopen 9y ago

I want to create a library for generating photos of computer-generated faces

tobyhinloopen 9y ago

https://petapixel.com/2017/11/07/ai-creates-photo-realistic-faces-people-dont-exist/ https://petapixel.com/2017/11/07/ai-creates-photo-realistic-... Tadaa. Another pointless privacy invasion that only affects the fair and honest.

pierrec 9y ago
Hmm, this wouldn't help you defeat the system at all, unless I'm missing something. What you need is a model to generate photos of your face.
- Balgair 9y ago
  FB is most likely trying to ward off spammers with this idea. Generating unique faces per spam-bot is easy now, for sophisticated spammers, then for every spammer in a few months. The poster is trying to say that this FB effort won't work well and is already only adversely affecting the most stupid and trusting.
  - pierrec 9y ago
    Good point, I was only considering the case where FB uses this technique to verify an existing user's identity using facial recognition (which seems like a "logical" use case). I missed the part where they said they might use it for account creation as well (which makes less sense and seems like a pretty baroque, intrusive and ineffective captcha).

rayshan 9y ago

Facial verification, together with cell phone number, which requires an ID to purchase, has been the standard practice for internet companies in China for a while now, e.g. for WeChat, Alipay, etc.

clamprecht 9y ago

Last paragraph of the article: "The new authentication scheme is the second in recent weeks that relies on photos. Earlier this month, Facebook asked users to upload nude photos to Facebook Messenger, as part of an effort to prevent revenge porn. Facebook said it would use the nude photos to create a digital fingerprint against which to compare future posts." Wait what? I had to check whether today was April 1st.

jsonne 9y ago
I couldn't believe it. This is the most absurd thing I have ever heard.
- colordrops 9y ago
  It really does seem like something an elite private club would do to get a laugh out of fooling the proles while smoking a cigar and browsing the pictures.
  - Crespyl 9y ago
    > they "trust me" ... dumb f*cks
  - dwaltrip 9y ago
    It's more like oblivious high-paid product managers and devs who can't fathom why people wouldn't trust Facebook or that Facebook might not be a purely beneficial organization.
    - threeseed 9y ago
      I think you've completely missed the point here. Teenagers who have naked photos in the possession of their peers need a solution for preventing dissemination. And so if you're in this situation trusting Facebook is by far the lesser of two evils.
      - 9y ago

ameister14 9y ago

They say they will permanently delete it off of their servers, but the numerous cases where they lied about deleting account information doesn't exactly engender a feeling of trust.

Balgair 9y ago
A friend does HW for Seagate servers and has talked a bit about the 'math' of servers. The reality is the FB may or may not delete the pics, no matter what they think they really did. With the amount of servers they utilize, one is failing about every second, permanently erasing all the data on it. Yes, back-up servers, and copies of the data. Still, a lot of data is getting trashed every second. So, they may be trying to weasel these pics, but do not trust that they are smart enough to get around the hard facts of server decay. If they are being honest, then there is still no way to determine if some back-up somewhere actually is storing the data, despite their best efforts. The code stack for something like FB is so huge, there really is no way of knowing where a piece of data is or isn't. Kafka would be beaming at it's absurdity. In addition, they also have a lot of 'fresh' servers out there, spinning about for months, not being written to, as some algorithm works it's way around using the fresh servers. These also fail, having never been used. Seagate does not mind when companies like FB do this nonsense.

deleted 9y ago

[deleted]

znpy 9y ago

S C A R Y C A R Y

deadmetheny 9y ago

Oh boy, what's bound to be another thread full of "delete your Facebook", the new and improved "I don't own a television" statement. Good for you, some of us actually appreciate the utility value from having a place to plan events and ensure people actually see that sort of thing. That said, this is a completely nonsense "solution" when there's plenty of other ways to perform verification that don't do double duty of implementing facial recognition tech to ensure we get to the dystopian tech hellscape sooner than later. Wow, didn't take long for the downvote brigade to show up for having a contrary opinion to the herd on this one.

wu-ikkyu 9y ago
>Oh boy, what's bound to be another thread full of "delete your Facebook", the new and improved "I don't own a television" statement. Maybe you're being downvoted because this statement is just as cliché, if not moreso (given the amount of FB users vs non FB users) than the "delete your FB" cliché
nindalf 9y ago
> there's plenty of other ways to perform verification I'd love to hear more about this.
pvdebbe 9y ago
I have long thought if I'm missing anything by not perusing Facebook event pages or anything. Fortunately within my interests (hifi audio, local jazz, photography and computer special interest group meetings) they all still operate within self-hosted forums or blogs and not in facebook.

tinus_hn 9y ago

Just upload a picture of one of the millions of people that haven’t cleared this hurdle yet and the problem is on somebody else’s plate.

eveningcoffee 9y ago

This is outrageous invasion of privacy. Facebook must die.

bogomipz 9y ago

>"The company declined to share details to prevent the system from being manipulated. Suspicious activity might include someone who consistently posts from New York and then starts posting from Russia." So in others words people who travel or go on vacation?

ihsw2 9y ago
Numerous systems that scrutinize IP-based geolocation information already throw up additional security checks when detecting changes. Personally I welcome it, especially when banks do it. It's low-hanging fruit TBH. It massively fucks with those using VPN or Tor but I'm fine with that.
- bogomipz 9y ago
  Except that FB isn't a bank and doesn't store one's financial data. Also this argument falls flat as we are an increasingly mobile population whether that be travel for pleasure or business. I remember watching in amusement/horror as a friend I was traveling with in Thailand wasn't able to access her Facebook account unless she verified via her phone that she was actually attempting to log into her account from Thailand. It's like you're supposed to check in with Facebook and let them know where you are. So creepy.
  - kinkrtyavimoodh 9y ago
    What sort of ridiculous nitpicking is this? First, FB does have a Payments feature, so if you are being pedantic, it does deal with one's financial world. Second, for a lot of people, their FB profile has a lot of confidential information, and is tied to their personal identity so they can't have the risk of it being compromised based on leaked passwords or whatever. It may not matter for you, but I am happy that they are safeguarding my account just the way a bank would.
    - bogomipz 9y ago
      There's nothing nitpicky in anything I wrote. FB is not a bank. And it can not be used as someone's financial institution. >"Second, for a lot of people, their FB profile has a lot of confidential information, and is tied to their personal identity so they can't have the risk of it being compromised based on leaked passwords or whatever." Who puts "confidential information" on FB? FB is based on the premise of voluntarily sharing" information. If people are willing to share information on a social networking site it can't really be considered "confidential" or even "sensitive" to you can it? Also FB is not one's identity, despite what FB would like you to believe that it is.

quotha 9y ago

This is literally the name of the company

Kenji 9y ago
Clever. You deserve an upvote.

PadThai89 9y ago

What do you think Facebook could do here, that wouldn't violate privacy, to verify that you are who you claimed to be?

nsaaass 9y ago

You really want to put your plain face to cia nsa database ? I hope people leave this platform asap

cbhl 9y ago

Sure, Facebook might delete your photo when they're done, but they probably won't delete any machine learning models that they trained using it.

josephpmay 9y ago
I'm pretty sure Facebook already has plenty of training data of faces
- eternalban 9y ago
  Excuse me. The issue is biometrics. "We'll delete the picture" =/= "we'll delete the control points and features extracted from your pics".
  - obmelvin 9y ago
    Is there any precedent for recovering individual training items from a model trained on 100m+ examples?
    - eternalban 9y ago
      What recovery? You're uploading your pic via your account. It is already associated with you.
      - obmelvin 9y ago
        As I understood it you are making the argument that they will have information about you from uploading this picture even if they delete the actual picture. I'm genuinely asking if it is possible to recover an individual training example from a model which is shown vast amounts of data. I'm only aware of being able to recover stuff like this - https://ars.els-cdn.com/content/image/1-s2.0-S0893608017302095-gr9.jpg https://ars.els-cdn.com/content/image/1-s2.0-S08936080173020... which is hardly PII
        9y ago

alde 9y ago

>"Please upload a photo of yourself that clearly shows your face. We’ll check it and then permanently delete it from our servers." >"To determine if the account is authentic, Facebook looks at whether the photo is unique." The two statements are a bit contradictory. They might delete the photo but they won't delete its signature/fingerprint, because they need the later to check for uniqueness of other accounts.

eternalban 9y ago
Count your blessings. They could have additionally asked for a picture that "clearly shows your genitals". Anywho, once the 'revenge porn' crowd starts hacking around this by chopping the said head from the said images, the central servers of FB are sure to ask for pics of genitals.
- thomastjeffery 9y ago
  > Count your blessings. No. Facebook is not the Almighty God.

mvdwoord 9y ago

I uploaded a cropped/mirrored picture of Jack Nicholson in the Shining. After 48 hours the account was working again, no idea what happens in that process.

mirimir 9y ago
Well, it's rather disappointing that they didn't catch something as simple as that ;) It's already nontrivial to create fake Facebook accounts. For those serious about it, who already deal with IPs and mobile numbers, I can't imagine that creating novel photorealistic faces would be all that problematic.
- thomas_howland 9y ago
  Not that surprising; can you recognize random Bollywood stars?
kinkrtyavimoodh 9y ago
I'd advise against playing such games if your FB account matters to you. They have often blocked / disabled accounts based on these things. If not, then go ahead, by all means.
- mvdwoord 9y ago
  I have deleted my fb years ago. Had to reinstate because apparently you need(ed) it for Tinder signup. I was horny.

jrochkind1 9y ago

Like it's hard to get a bunch of photos of real faces?

Tharkun 9y ago

I was recently locked out of my FB account. The only way to unlock it was to identify my friends' pictures. Apparently sending me an e-mail was too much trouble ... Haven't been able to log in since, as I refuse to partake in that sort of bullshit. Can't say I miss it.

pishpash 9y ago
What do you have against identifying friends' profile images, of all things? Facebook already has them.
- cowpig 9y ago
  If one of my friends identified me in a photo to facebook, I would not be happy about it. I generally ask everyone who knows me not to upload photos I'm in to facebook at all beyond what's already there.
  - jsemrau 9y ago
    Exactly, the point it validates and updates the current status of friendship you have. Further it informs facebook who are the people you really know opposite to your "facebook friends" .
- shostack 9y ago
  FB doesn't necessarily have the names of everyone in all those photos. I wonder if they would ever do something like show you three photos of friends as the captcha, but they only know the answers for two of them and are using the third to get you to give them info they didn't already have without you knowing.
JoshMnem 9y ago
You could upload a fake photo to login, delete your content, and then delete your Facebook account.
- AlphaWeaver 9y ago

tanilama 9y ago

Face Book

YeGoblynQueenne 9y ago

>> “Please upload a photo of yourself that clearly shows your face. We’ll check it and then permanently delete it from our servers.” >> To determine if the account is authentic, Facebook looks at whether the photo is unique. I assume this means that the photo itself is deleted but a one-way hash of it created to test against later. However, if I change one pixel of a picture of my face, A, to produce a new picture of my face, A', the hash of A' will not be the same as the hash of A, correct? And I can repeat this process n x m times, where n, m the dimension of the image, ja? Additionally- when they say "unique", do they mean "known as unique" to Facebook, or "unique in the entire world"? If I take a picture of myself and put it on, dunno, my blog on Blogger, what's stopping someone copying it and uploading it to Facebook to pretend it's me? Will Facebook search the entire web for images potentially matching an uploaded image? For the record, I don't use Facebook. And there are no pictures of myself anywhere on the internets. As if.

czardoz 9y ago
It doesn't have to be a hash really. They probably use some image processing techniques to process facial features and store the signature. I'm not sure how it identifies a human from a bot though.
oh_sigh 9y ago
Hashes don't necessarily work on the raw bit representation of something. You can have a hash which works on higher level constructs, which for images one solution would be called a perceptual hash.
- thisacctforreal 9y ago
  I thought the accepted term for this was "fingerprint" not "hash".
  - oh_sigh 9y ago
    Hashes produce fingerprints(including perceptual hashes). Most people are talking about cryptographic hash functions when talking about 'hashing' but that is just one type. There is a wikipedia page for 'perceptual hashing' as well as a number of libraries available which claim to do perceptual hashing, so it may just come down to what kind of crowd you roll with :)

bsaul 9y ago

I used to think richard stallman was just a paranoid lunatic... Well, the more time goes by, the more i think he was just 100% right. It's time to be much much more careful and radical with the path technology is taking us. It's time we all invest a bit of our time to provide real open and benevolent alternatives to facebook, google, amazon, and all the rest, because they're steering internet toward an orwelian nightmare.

DesiLurker 9y ago
try ello
mxuribe 9y ago
There are existing social media alternatives to facebook, such as: gnu social; postActiv; mastodon; diaspora; hubzilla; etc.
- bsaul 9y ago
  it's a great start but it's not mainstream yet. We need something as polished as wikipedia.
Santosh83 9y ago
Network effects. You and me care. Sadly the vast majority around us bow unquestioningly to demands made by powerful groups like their govt or huge mega-corps. People seem to think these power-centres will always be benevolent and flawless... which history shows is a big mistake to assume.
- wallace_f 9y ago
  Fake News! Can't we have some trusted institution like ycombinator put these kind of comments through their truth filter before allowing them to be posted? They could even partner with Facebook to do this. /s
- bsaul 9y ago
  I wouldn’t put a democratic government on the same level of danger than profit driven mega corps. I’m pro free market, but some corps have reach state-level impact on people lives, and they remain without any kind of overview. I also don’t want state-run web sites to try to provide alternatives to Google ( like europe tried to do 10 years ago), so i think the foundation model is the perfect structure for that. Economically responsible, but not profit driven.

dv_dt 9y ago

So right around we when start exploring the dumpster fire of of SSNs and personal data collection with Equifax and the entire credit reporting / financial industry, a new form of personal data collection as well as mixing up identification and authorization arises ... (I blame Apple too...)

elchief 9y ago

Ah biometrics, the password you can't change

pleasecalllater 9y ago

The next level would probably be: provide your SSN.

659087 9y ago
Experian probably already shared that with them.

banderman 9y ago

Uber does this for their drivers to confirm it's the registered person driving the vehicle.

tudorconstantin 9y ago

All that spammers have to do now is to upload other people's photos first. Imagine the surprise we'll have when we'll find out our accounts were cloned.

jacobush 9y ago

I read at first “China’s New Captcha Test”.

hota_mazi 9y ago

I find their claim that the picture will be deleted from their servers at odds with their claim that they will make sure that photo is unique. I suspect that what they're not saying is that they will keep some signature/hash/data about the photo, which I'm sure they will use for much more than just verifying uniqueness.

rdiddly 9y ago
Yep, that's in the article. They say they'll hash it and delete it (the photo). They don't claim they'll delete the hash. Having the hash is enough to check for uniqueness. Although it's sort of an over-strict definition of uniqueness. Example: I change one pixel → That produces a drastically different hash → That makes the almost-identical photo seem unique. I'd be surprised if they weren't extracting other info from the photo or training ML models on it as others suggest here.
- jstanley 9y ago
  > I change one pixel → That produces a drastically different hash If they're hashing the raw bytes, sure. If they're hashing a representation of the face that encodes meaning (like the relative locations of facial features), then changing one pixel is unlikely to affect that.
  - rdiddly 9y ago
    Indeed - lots of things could be concealed in that phrase "the photos are hashed!"

hackbinary 9y ago

No. Like Nancy Reagan said, "just say no." Your likeness is your data.

dba7dba 9y ago

Eject eject eject Abandon ship. Or abandon Facebook. .

caf 9y ago

You would think that for captcha purposes (ie. a unique, quickly produced, creative item) it would suffice to say "draw a picture of a dog" (or "upload a clear photo of your hand").

abiox 9y ago

i signed up with facebook (with a unique email), and encountered this. i used a picture (a painting, rather) of george washington. it seemed to work at first, but when i tried logging in a month or two later my account was disabled. perhaps i wasn't the only person using that image and they were displeased.

will_hughes 9y ago

Instagram did this same bullshit to me when I signed up for an account to to follow some photographers. 'Please provide a clear photo of yourself holding your government issued ID, and a piece of paper with the following code handwritten on it'. No, fuck that for a joke. There's this growing trend of everyone wanting your photo and some ID, and then you have no way to verify that information is being kept securely or used for appropriate reasons.

Santosh83 9y ago
Scarily similar to this: https://imgur.com/a/uQrKn https://imgur.com/a/uQrKn
goialoq 9y ago
Instagram is Facebook
Tarq0n 9y ago
I wonder if some three letter agency is paying facebook to build them the biggest face recognition database in the world.
- JoBrad 9y ago
  No need to get all conspiratorial. Picasa did it before Google, AWS does it now. It’s what people (writ large) want.
  - owebmaster 9y ago
    > No need to get all conspiratorial How I wish large scale surveillance was conspiratorial. Do you really believe in what you say or is it only habit?
  - mitchellberry 9y ago
    Considering nearly every adult provides a photo of higher quality to their respective governments it does seem a tad conspiratorial and like a lot of unecessary effort. Also being a part of the 14 eyes means if the United States wanted my biometrics all they need to do is ask. My country is already moving towards real time cctv identification in airports etc. using biometrics from any issued license / passport.

WhoBeI 9y ago

Are they allowed to sell the "fingerprint" packaged with your name to advertising agencies? If so it should only be a matter of time before those Minority Report inspired advertising screens start popping up everywhere.. The advertisers can always protect that system with some DRM to get the mighty DMCA on their side. That way they don't need to build a robust solution and can still wipe their hands clean if they loose it all to a 12 year old script kiddie.

ArlenBales 9y ago

This isn't very future-proof. Computer graphics today can produce human faces that are extremely realistic. Someone will make a random-face generator, and a bot will pipe random faces to Facebook.

vonuebelgarten 9y ago

Question: is Wired actively blocking archive.is? I tried to archive this article just to get a repeated "Network error" [1] which may be a sign of a Layer 3 block. A trivial search [2] shows no page is successfully archived since the end of September. [1] https://archive.is/eU7Yn https://archive.is/eU7Yn [2] https://archive.is/www.wired.com https://archive.is/www.wired.com

mikgan 9y ago

AirBnB does this today, had to go through the process a few weeks ago to create an account to book a room! And of course the process failed,.. and of course we thought we were going to miss out on our room booking,.. and of course I now really dislike airBnB

quadrangle 9y ago

I have to say: as much as I probably agree with every critic of this… The damn thing is called FACEbook, so it would almost be wrong for them not to do this! (I don't know a mark for whatever this is, it's not sarcasm or irony, something about tragic comedy fate…)

vsc 9y ago

Sorry, I don't understand, but wouldn't someone ( suspicious ) also have a photo of yours if they have the access to your account. They could easily upload that photo and pass the captcha test .. Or am I missing something?

cJ0th 9y ago
If I understand it correctly they would have to provide a photo with your face that FB hasn't seen before. Still rather easy to obtain for the determined.

bprasanna 9y ago

Applies to most of the biggies: Since i am a behemoth of tech, give me all your personal info and surrender yourself. I will tell you what you should see, eat, buy, think & whom you should be-friend! In return your everyday personal data is my asset, my asset only! Its up to me how i use your personal data. NO QUESTION SHOULD BE ASKED! Remember you have signed the agreement (Privacy Policy)!

Partyone 9y ago

Its good to have better security features.

jamiethompson 9y ago

Because if you were accessing someone else's Facebook account you wouldn't have access to a whole bunch of photos of their face would you.

Shinchy 9y ago

This is a classic example of technical staff not thinking about what a user would do.

y04nn 9y ago

Ok, but would it work against generative network generated faces? cf. https://towardsdatascience.com/implementing-a-generative-adversarial-network-gan-dcgan-to-draw-human-faces-8291616904a https://towardsdatascience.com/implementing-a-generative-adv...