4 ms·

What if all the super-advanced technology for consumer behavior tracking could be somehow judo-flipped into a new form of anonymous resource ownership? So inste

What if all the super-advanced technology for consumer behavior tracking could be somehow judo-flipped into a new form of anonymous resource ownership? So instead of legitimate websites being forced to ask a tech giant for an identity token just to establish a session, while shady advertisers silently assemble vast shadow profiles of consumers' behavior using browser fingerprinting, legitimate companies could use browser fingerprinting to automatically create a persistent session, which the user can then voluntarily link to an identity, or leave anonymous if they so choose? A person could potentially have a number of identities that are anonymous or pseudonymous, that are automatically created and detected whenever they use the internet. They could maybe view a dashboard of their identities on a secure device, link them by function and scope, expose personally identifiable information through them at will, and create policies to automate all this. Eg. if I visit a site like HN more than twice, it could just create an anonymous account for me automatically through fingerprinting and log me in automatically. Then, if I want to link this account to other services or other devices, I could do that through some general purpose API on a secure device. This could potentially lead to a general purpose "consumer identity" system where a person's offline behaviors are brought in as well. My point is there's no reason why the most advanced forms of tracking and identity management can't be brought under users' full control for our own benefit. Fingerprinting is treated like the internet's dirty secret, but it's a technology that could be used in different ways. I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless."

wolfgke 9y ago
> Fingerprinting is treated like the internet's dirty secret, but it's a technology that could be used in different ways. I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless." Fingerprints (and other biometric data) is the analogue of a (public) username and not the analogue to passwords: > http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... HN discussion: > https://news.ycombinator.com/item?id=8496797 https://news.ycombinator.com/item?id=8496797 So if you replace entering your username by a fingerprint, retinal scan, ... this is perfectly fine from a security perspective (though IMHO a really bad idea from a privacy perspective). On the other hand using biometric data as replacement for passwords is from a security perspective an anti-pattern.
- ssivark 9y ago
  tboyd47 is talking about browser/device fingerprinting, not physical fingerprints. Such fingerprints are usually attached to device rather than the specific account, but if we assume that a user needs a secure password/login to access the device, it might be a workable proxy. [1]: https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint [2]: https://panopticlick.eff.org/ https://panopticlick.eff.org/
- deleted 9y ago
  [deleted]
- lovemenot 9y ago
  This reply seems to have missed the point of its parent and just picked up on the word fingerprint in a different context. I like the parent's overall point, but I suspect its business model is not viable. Any service that helps the user against the publisher's interests will need to be funded through charging the consumer. Not easy these days.
  - wolfgke 9y ago
    > This reply seems to have missed the point of its parent and just picked up on the word fingerprint in a different context. I am aware that "fingerprint" has different meanings, but the grandparent explicitly talked of biometric authentication (e.g. physical fingerprints) in his last sentence: > I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless." This is what I was referring to.
    - deleted 9y ago
      [deleted]
  - tboyd47 9y ago
    Why assume it is against publishers' interests for people to control how they expose their own identity? Advertisers, sure, but publishers? I see privacy as being more orthogonal to their interests than directly against them. Nevertheless, you're probably right about the business model. I was piggybacking on the idealism of the article we're commenting on. It's fun to just discuss possible futures without worrying about viability once in a while.

wolfgke 9y ago

> Fingerprinting is treated like the internet's dirty secret, but it's a technology that could be used in different ways. I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless." Fingerprints (and other biometric data) is the analogue of a (public) username and not the analogue to passwords: > http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html http://blog.dustinkirkland.com/2013/10/fingerprints-are-user... HN discussion: > https://news.ycombinator.com/item?id=8496797 https://news.ycombinator.com/item?id=8496797 So if you replace entering your username by a fingerprint, retinal scan, ... this is perfectly fine from a security perspective (though IMHO a really bad idea from a privacy perspective). On the other hand using biometric data as replacement for passwords is from a security perspective an anti-pattern.

ssivark 9y ago
tboyd47 is talking about browser/device fingerprinting, not physical fingerprints. Such fingerprints are usually attached to device rather than the specific account, but if we assume that a user needs a secure password/login to access the device, it might be a workable proxy. [1]: https://en.wikipedia.org/wiki/Device_fingerprint https://en.wikipedia.org/wiki/Device_fingerprint [2]: https://panopticlick.eff.org/ https://panopticlick.eff.org/
deleted 9y ago
[deleted]
lovemenot 9y ago
This reply seems to have missed the point of its parent and just picked up on the word fingerprint in a different context. I like the parent's overall point, but I suspect its business model is not viable. Any service that helps the user against the publisher's interests will need to be funded through charging the consumer. Not easy these days.
- wolfgke 9y ago
  > This reply seems to have missed the point of its parent and just picked up on the word fingerprint in a different context. I am aware that "fingerprint" has different meanings, but the grandparent explicitly talked of biometric authentication (e.g. physical fingerprints) in his last sentence: > I would prefer this to any of biometric authentication schemes that have been peddled as "passwordless." This is what I was referring to.
  - deleted 9y ago
    [deleted]
- tboyd47 9y ago
  Why assume it is against publishers' interests for people to control how they expose their own identity? Advertisers, sure, but publishers? I see privacy as being more orthogonal to their interests than directly against them. Nevertheless, you're probably right about the business model. I was piggybacking on the idealism of the article we're commenting on. It's fun to just discuss possible futures without worrying about viability once in a while.