22 ms·

Face-verify.js: Monitoring who is physically looking at a website

115 points by thetall0ne 9y ago

xori 9y ago
Am I the only one who doesn't quite understand the point? I would assume you wouldn't only use this tech to secure information. But I don't see really how this adds any security when software cams exist. Plus you have other issues, like people like me who work in low light, or picture frames in the shot, etc. Cool hobby project though.
- AbacusAvenger 9y ago
  Yeah, this whole thing seems a bit silly. You can't trust the webcam to be real or even functional. And even if you could trust the entire website-to-webcam path end-to-end, you can't trust the image the hardware is reading. There's a reason that other face recognition systems like Windows Hello require that you have an IR camera, so that it knows it's not just looking at a photograph of a person.
- _rpd 9y ago
  It's just a cheap/easy biometric. Retina pattern or finger print are better biometrics, but generally require special purpose hardware for ease of use.
jstanley 9y ago
Please, no. This has to be a parody. > Banks don’t want private account details (like the user’s current balance and credit limits etc) being seen by anybody other than the account holder. This is exactly the kind of justification they'd use. And surprise surprise there won't be a box that says "I'd rather risk somebody seeing my account details than have a biometric model of my face stored in your database and given to whoever you give it to".
- nabeards 9y ago
  Do people really consider the ethics of introducing tech like this? I guess it just comes down to a consequentialism vs deontology whether someone thinks this is a good idea. And, obviously, if they don't do it, I guess someone else will?
  - IntronExon 9y ago
    This is why software needs an association with some teeth, because professional ethical standards don’t grow on trees. Note how a doctor doesn’t just say, “Well if I don’t dose these people without their knowledge or consent, someone else will.”
    - notgoingaway 9y ago
      Fuck no
  - Rotdhizon 9y ago
    There was an article about just that the other week, on here I believe. It was detailing how a lot of the controversial tech ideas coming out of places like silicon valley are from these tech/startup moguls who are so disconnected from reality that they don't understand the concept of ethics or technological consequence. To them it doesn't matter how intrusive a design is, if it solves a problem, then that justifies all negatives.
    - rhizome 9y ago
      I'm willing to consider that they're all confused Futurama fans. They heard "technically correct...the best kind of correct!" and transmogrified it to "technically a good idea, the best kind of idea!"
  - gricardo99 9y ago
    The great irony is that often technological innovations are believed to be liberating and done with the motivation of improving the common lot of humanity. Two examples: Social networking - Enabling more meaningful and greater connection between people, leading to greater happiness and fulfillment? Or, fostering more divisions, balkanization into "like" echo chambers, promulgating fear and prejudice, leading to greater depression and mass manipulation? Cryptocurrencies - Disintermediation! need I say more ;) All kinds of utopian views of how this is supposed to promote freedom, security and efficiency. But top of the wish-list for the most paranoid and repressive authoritarian tyrant would have to be a magical way to fully control and monitor all economic activity: A cash-less society where every single transaction is done with the government controlled digital currency, recorded on the government controlled blockchain.
- chrisvalleybay 9y ago
  For most people, the biometric model of their face is available to nearly anyone. Most people have multiple profile photos available on Facebook, Instagram, LinkedIn etc.
  - IntronExon 9y ago
    As someone who has been careful about not doing that for a couple of decades, just fuck me, hm?
    - cryptoz 9y ago
      How careful have you been about that? Do you just mean not uploading your own profile photo to sites? What about any birthday parties or group pictures you might be in? Photos for a work event or with friends? Unless you've been very careful not to appear in any public photos of any kind, especially ones taken by your family and friends (as it is easily traced to you), then I would expect you have just as much of an online photo-profile identity as anyone else.
      - IntronExon 9y ago
        I’ve been that weirdly careful, yes. I’ve searched for a picture of me, and have only ever found a grainy one from two decades ago. That is it.
        cryptoz 9y ago
        If you've been that careful, then props to you. Good job. > I’ve searched for a picture of me, and have only ever found a grainy one from two decades ago. That is it. But that's not what I mean. Facebook knows who you are. Maybe you can't find it yourself using search terms, but that's not the point. You have a Facebook profile with an email and a set of pictures and a social web connected, I'm sure, even if you've never signed up. There's just a db flag set that says 'waiting for this person to sign up'. Facebook knows.
        9y ago
- ReverseCold 9y ago
  Now that this is possible, what stops bad people/companies/governments from (ab)using this? There's really nothing else you can do apart from wearing a mask and sunglasses, which will also be bypassed soon enough. (Not to mention that no one wants to do that.) Unlike weapons, a lot of these ai tools have some force of good behind them as well - so good governments won't pass laws against this either.
  - gruez 9y ago
    disable your webcam? webcams aren't exactly standard on desktops.
    - ReverseCold 9y ago
      Where "this" = face recognition technology :) It's here, and I can't think of anything you can do about it (especially in public).
      - ceejayoz 9y ago
        Plenty of fashionable options for messing with facial recognition. https://cvdazzle.com/ https://cvdazzle.com/
- DeepYogurt 9y ago
  Not all computers have cameras. Pray that it remains that way.
- mirimir 9y ago
  My reaction too. But then, I use no devices with cameras or microphones.
wgerard 9y ago
There's something about software like this that really creeps me out, even though I realize it's not ridiculously advanced (i.e. it's way more common than I think) anymore. That might just be a personal aversion, though. I can imagine useful scenarios for this even if I get a bit of an icky feeling from it. My co-founder and I have talked about things like this as an "anti-cheating" measure (we developed a take-home assessment platform), but it always feels way too overboard and invasive for an exaggerated problem (and I'm just against it in pretty much every way imaginable). Interestingly this somehow feels better than overt measures like ProctorU, but that's an emotional reaction and not a logical one. In some ways it's probably much worse.
- danso 9y ago
  Some more info about ProctorU (for others who haven't heard about it): https://www.chronicle.com/article/Behind-the-Webcams-Watchful/138505 https://www.chronicle.com/article/Behind-the-Webcams-Watchfu... > Rather than one proctor sitting at the head of a physical classroom and roaming the aisles every once in a while, remote proctors peer into a student's home, seize control of her computer, and stare at her face for the duration of a test, reading her body language for signs of impropriety. That article is from 2013, I wonder how much of this is now partially automated (i.e. relying on human remote proctors)?
  - tekromancr 9y ago
    Online proctoring is actually a really busy space in edtech. There are numerous companies with products deployed that are fully automated. They record videos of students taking the tests through a webcam, then send the analysis back to the instructors highlighting which videos are worth watching.
    - username223 9y ago
      This system seems designed to encourage abuse by all parties involved.
    - gruez 9y ago
deleted 9y ago
[deleted]
no1youknowz 9y ago
I can see from a privacy standpoint, this may cause some concern. However, from a credit card processor point of view and combating "friendly fraud". This could be an excellent tool to prevent that. For example. The scenario where a transaction has been processed and 6 weeks later, it is disputed because the card holder doesn't recognise the transaction. Perhaps the wife used the husbands card whilst he was in the shower, for [insert candy crush clone]. A capture of the users face would definitely help the merchant win the representment against Visa/Mastercard. In a scenario where goods are being shipped cross-border. Lets say from China to the US and it's for a large amount. Then this could be an extra step, where the data hasn't passed a certain threshold and thus further information is required. Having a real-time snapshot and validation to prove the card holder is legitimate. Ensures the transaction goes through. Ultimately, I do understand it's about weighing privacy concerns. But that doesn't mean some good can't come out from this.
- jstanley 9y ago
  No. I'm not having a photo of my face and the inside of my home associated with every online purchase. That's ludicrous.
  - no1youknowz 9y ago
    I agree. From a consumer point of view, you are welcome to take that position. However, my comment was purely from a credit card processor, acquirer or even bank. At the end of the day, if something like this was introduced. You are free to not comply, pay with an alternative method or shop elsewhere.
    - wu-ikkyu 9y ago
      >You are free to not comply, pay with an alternative method or shop elsewhere You are increasingly not free to choose an alternative, given the increasing centralization of the "too big to fail" finance and tech industries.
    - Nullabillity 9y ago
danjoc 9y ago
Coursera required face verification recently. Once I found out, I had my course fee refunded and have not signed up for another course.
- exabrial 9y ago
  The policy might have been changed? An article I just read says: "taking a photo via webcam, uploading a photo of a picture id issued by the government, and making a record of their typing pattern."
  - notgoingaway 9y ago
    Sounds like spyware.
nootropicat 9y ago
Black Mirror predicted this in a much more realistic business case - forcing users to view ads. https://www.youtube.com/watch?v=QleMXX24v5g&t=52s https://www.youtube.com/watch?v=QleMXX24v5g&t=52s
- demircancelebi 9y ago
  I think that is highly unlikely. If lots of people are not okay with watching ads, there would be economic incentives for people to create ad-free alternatives. Even now we have lots of such alternatives. If someone is not able to afford that alternative, it may actually be harmful to advertisers to spend their money on showing these people ads anyway.
  - beckler 9y ago
    I think it's hard to consider at this moment, but I'm sure this is something they'll at least investigate and consider. The ad industry is cutthroat, and if this gave them anyone an edge, you can bet all of them will follow suit in time.
  - smallnamespace 9y ago
    > economic incentives for people to create ad-free alternatives Yes, but they will have to fight a giant up-hill battle because ads exploit a quirk of human psychology, which is that most people strongly undervalue their own attention.
txsh 9y ago
Do people realy think identities are stolen by criminals peaking over shoulders? And, if so, couldn’t they use a camera, or mirror, or periscope to bypass this software?
- gruez 9y ago
  or looking at the screen outside the camera's fov, which shouldn't be hard to do considering IPS have up to 178 degrees viewing angle.
  - unit91 9y ago
    For real, good grief. Telescopic lenses and office windows also exist.
    - epicide 9y ago
      Alright, it might be time to finally jump on getting a privacy filter.
exabrial 9y ago
If you can be prosecuted for storing someone's diagnostic medical images improperly under HIPAA law, this seems like a VERY risky thing for a company to implement.
thetall0ne 9y ago
I think this is really about having powerful machine learning tools like face recognition, image recognition, content personalization and recommendation etc. in the browser.
dibujante 9y ago
Oh my god don't
tzahola 9y ago
We obviously need to make this tech mandatory. You wouldn’t want your children looking at harmful websites, would you?
nitwit005 9y ago
> Banks don’t want private account details (like the user’s current balance and credit limits etc) being seen by anybody other than the account holder. Unless it's an in-person interaction, a face has little security value, because it's not a secret. Getting a photo, or even full motion video of someone often just requires finding their Instagram page.
- deleted 9y ago
  [deleted]
desireco42 9y ago
I see we will soon stop putting stickers on camera holes, but will use screwdrivers to pry them out and remove them. :)
Proven 9y ago
Creepy shit
jageen 9y ago
How much secure this will be ? My concern is what if some one show my digital photo to the website, will framework detect it ? Apple said that they over come this by using true depth technology (which i guess required specific hardware). I like the idea thought, but there is a big reason people did not implemented this before.
bbarn 9y ago
So what stops me from creating a device that registers itself as a webcam natively, but just puts a loop of a pre-recorded video that satisfies the face recognition software? Stop trying to find solutions to problems that aren't real.
- Mayzie 9y ago
  i.e. what people were doing on ChatRoulette for a long time (and probably still are).
cocochanel 9y ago
No! No! No! How much more intrusive do we need to get seriously? This is a naive solution to the problem stated. And a bad one at it, too.
cmaureir 9y ago
Technologically speaking: Yeah, that's a nice feature. Real world: This will be awful, I really don't want any DB to have a photo of me associated with transaction or authentification. Yes, I do have profile pictures, but allowing a service to get a "stream" of your face will be way worse, and I cannot imagine what would happen if this DB get compromised...anyway...still a nice Black Mirror episode though..
- cjmoran 9y ago
  "We noticed that you've looked away from your screen. Please continue watching the advertisement in order to continue!" "Eye roll detected. Would you like to send feedback to this ad partner?"
  - Deestan 9y ago
    "Thanks for watching! Please help keeping this channel alive and do not look away during the ads. Bye!"
ycmjason 9y ago
What happens if I do inspect elements and remove styling? :D

115 points by thetall0ne 9y ago

xori 9y ago

Am I the only one who doesn't quite understand the point? I would assume you wouldn't only use this tech to secure information. But I don't see really how this adds any security when software cams exist. Plus you have other issues, like people like me who work in low light, or picture frames in the shot, etc. Cool hobby project though.

AbacusAvenger 9y ago
Yeah, this whole thing seems a bit silly. You can't trust the webcam to be real or even functional. And even if you could trust the entire website-to-webcam path end-to-end, you can't trust the image the hardware is reading. There's a reason that other face recognition systems like Windows Hello require that you have an IR camera, so that it knows it's not just looking at a photograph of a person.
_rpd 9y ago
It's just a cheap/easy biometric. Retina pattern or finger print are better biometrics, but generally require special purpose hardware for ease of use.

jstanley 9y ago

Please, no. This has to be a parody. > Banks don’t want private account details (like the user’s current balance and credit limits etc) being seen by anybody other than the account holder. This is exactly the kind of justification they'd use. And surprise surprise there won't be a box that says "I'd rather risk somebody seeing my account details than have a biometric model of my face stored in your database and given to whoever you give it to".

nabeards 9y ago
Do people really consider the ethics of introducing tech like this? I guess it just comes down to a consequentialism vs deontology whether someone thinks this is a good idea. And, obviously, if they don't do it, I guess someone else will?
- IntronExon 9y ago
  This is why software needs an association with some teeth, because professional ethical standards don’t grow on trees. Note how a doctor doesn’t just say, “Well if I don’t dose these people without their knowledge or consent, someone else will.”
  - notgoingaway 9y ago
    Fuck no
- Rotdhizon 9y ago
  There was an article about just that the other week, on here I believe. It was detailing how a lot of the controversial tech ideas coming out of places like silicon valley are from these tech/startup moguls who are so disconnected from reality that they don't understand the concept of ethics or technological consequence. To them it doesn't matter how intrusive a design is, if it solves a problem, then that justifies all negatives.
  - rhizome 9y ago
    I'm willing to consider that they're all confused Futurama fans. They heard "technically correct...the best kind of correct!" and transmogrified it to "technically a good idea, the best kind of idea!"
- gricardo99 9y ago
  The great irony is that often technological innovations are believed to be liberating and done with the motivation of improving the common lot of humanity. Two examples: Social networking - Enabling more meaningful and greater connection between people, leading to greater happiness and fulfillment? Or, fostering more divisions, balkanization into "like" echo chambers, promulgating fear and prejudice, leading to greater depression and mass manipulation? Cryptocurrencies - Disintermediation! need I say more ;) All kinds of utopian views of how this is supposed to promote freedom, security and efficiency. But top of the wish-list for the most paranoid and repressive authoritarian tyrant would have to be a magical way to fully control and monitor all economic activity: A cash-less society where every single transaction is done with the government controlled digital currency, recorded on the government controlled blockchain.
chrisvalleybay 9y ago
For most people, the biometric model of their face is available to nearly anyone. Most people have multiple profile photos available on Facebook, Instagram, LinkedIn etc.
- IntronExon 9y ago
  As someone who has been careful about not doing that for a couple of decades, just fuck me, hm?
  - cryptoz 9y ago
    How careful have you been about that? Do you just mean not uploading your own profile photo to sites? What about any birthday parties or group pictures you might be in? Photos for a work event or with friends? Unless you've been very careful not to appear in any public photos of any kind, especially ones taken by your family and friends (as it is easily traced to you), then I would expect you have just as much of an online photo-profile identity as anyone else.
    - IntronExon 9y ago
      I’ve been that weirdly careful, yes. I’ve searched for a picture of me, and have only ever found a grainy one from two decades ago. That is it.
      - cryptoz 9y ago
        If you've been that careful, then props to you. Good job. > I’ve searched for a picture of me, and have only ever found a grainy one from two decades ago. That is it. But that's not what I mean. Facebook knows who you are. Maybe you can't find it yourself using search terms, but that's not the point. You have a Facebook profile with an email and a set of pictures and a social web connected, I'm sure, even if you've never signed up. There's just a db flag set that says 'waiting for this person to sign up'. Facebook knows.
        9y ago
ReverseCold 9y ago
Now that this is possible, what stops bad people/companies/governments from (ab)using this? There's really nothing else you can do apart from wearing a mask and sunglasses, which will also be bypassed soon enough. (Not to mention that no one wants to do that.) Unlike weapons, a lot of these ai tools have some force of good behind them as well - so good governments won't pass laws against this either.
- gruez 9y ago
  disable your webcam? webcams aren't exactly standard on desktops.
  - ReverseCold 9y ago
    Where "this" = face recognition technology :) It's here, and I can't think of anything you can do about it (especially in public).
    - ceejayoz 9y ago
      Plenty of fashionable options for messing with facial recognition. https://cvdazzle.com/ https://cvdazzle.com/
DeepYogurt 9y ago
Not all computers have cameras. Pray that it remains that way.
mirimir 9y ago
My reaction too. But then, I use no devices with cameras or microphones.

wgerard 9y ago

There's something about software like this that really creeps me out, even though I realize it's not ridiculously advanced (i.e. it's way more common than I think) anymore. That might just be a personal aversion, though. I can imagine useful scenarios for this even if I get a bit of an icky feeling from it. My co-founder and I have talked about things like this as an "anti-cheating" measure (we developed a take-home assessment platform), but it always feels way too overboard and invasive for an exaggerated problem (and I'm just against it in pretty much every way imaginable). Interestingly this somehow feels better than overt measures like ProctorU, but that's an emotional reaction and not a logical one. In some ways it's probably much worse.

danso 9y ago
Some more info about ProctorU (for others who haven't heard about it): https://www.chronicle.com/article/Behind-the-Webcams-Watchful/138505 https://www.chronicle.com/article/Behind-the-Webcams-Watchfu... > Rather than one proctor sitting at the head of a physical classroom and roaming the aisles every once in a while, remote proctors peer into a student's home, seize control of her computer, and stare at her face for the duration of a test, reading her body language for signs of impropriety. That article is from 2013, I wonder how much of this is now partially automated (i.e. relying on human remote proctors)?
- tekromancr 9y ago
  Online proctoring is actually a really busy space in edtech. There are numerous companies with products deployed that are fully automated. They record videos of students taking the tests through a webcam, then send the analysis back to the instructors highlighting which videos are worth watching.
  - username223 9y ago
    This system seems designed to encourage abuse by all parties involved.
  - gruez 9y ago

deleted 9y ago

[deleted]

no1youknowz 9y ago

I can see from a privacy standpoint, this may cause some concern. However, from a credit card processor point of view and combating "friendly fraud". This could be an excellent tool to prevent that. For example. The scenario where a transaction has been processed and 6 weeks later, it is disputed because the card holder doesn't recognise the transaction. Perhaps the wife used the husbands card whilst he was in the shower, for [insert candy crush clone]. A capture of the users face would definitely help the merchant win the representment against Visa/Mastercard. In a scenario where goods are being shipped cross-border. Lets say from China to the US and it's for a large amount. Then this could be an extra step, where the data hasn't passed a certain threshold and thus further information is required. Having a real-time snapshot and validation to prove the card holder is legitimate. Ensures the transaction goes through. Ultimately, I do understand it's about weighing privacy concerns. But that doesn't mean some good can't come out from this.

jstanley 9y ago
No. I'm not having a photo of my face and the inside of my home associated with every online purchase. That's ludicrous.
- no1youknowz 9y ago
  I agree. From a consumer point of view, you are welcome to take that position. However, my comment was purely from a credit card processor, acquirer or even bank. At the end of the day, if something like this was introduced. You are free to not comply, pay with an alternative method or shop elsewhere.
  - wu-ikkyu 9y ago
    >You are free to not comply, pay with an alternative method or shop elsewhere You are increasingly not free to choose an alternative, given the increasing centralization of the "too big to fail" finance and tech industries.
  - Nullabillity 9y ago

danjoc 9y ago

Coursera required face verification recently. Once I found out, I had my course fee refunded and have not signed up for another course.

exabrial 9y ago
The policy might have been changed? An article I just read says: "taking a photo via webcam, uploading a photo of a picture id issued by the government, and making a record of their typing pattern."
- notgoingaway 9y ago
  Sounds like spyware.

nootropicat 9y ago

Black Mirror predicted this in a much more realistic business case - forcing users to view ads. https://www.youtube.com/watch?v=QleMXX24v5g&t=52s https://www.youtube.com/watch?v=QleMXX24v5g&t=52s

demircancelebi 9y ago
I think that is highly unlikely. If lots of people are not okay with watching ads, there would be economic incentives for people to create ad-free alternatives. Even now we have lots of such alternatives. If someone is not able to afford that alternative, it may actually be harmful to advertisers to spend their money on showing these people ads anyway.
- beckler 9y ago
  I think it's hard to consider at this moment, but I'm sure this is something they'll at least investigate and consider. The ad industry is cutthroat, and if this gave them anyone an edge, you can bet all of them will follow suit in time.
- smallnamespace 9y ago
  > economic incentives for people to create ad-free alternatives Yes, but they will have to fight a giant up-hill battle because ads exploit a quirk of human psychology, which is that most people strongly undervalue their own attention.

txsh 9y ago

Do people realy think identities are stolen by criminals peaking over shoulders? And, if so, couldn’t they use a camera, or mirror, or periscope to bypass this software?

gruez 9y ago
or looking at the screen outside the camera's fov, which shouldn't be hard to do considering IPS have up to 178 degrees viewing angle.
- unit91 9y ago
  For real, good grief. Telescopic lenses and office windows also exist.
  - epicide 9y ago
    Alright, it might be time to finally jump on getting a privacy filter.

exabrial 9y ago

If you can be prosecuted for storing someone's diagnostic medical images improperly under HIPAA law, this seems like a VERY risky thing for a company to implement.

thetall0ne 9y ago

I think this is really about having powerful machine learning tools like face recognition, image recognition, content personalization and recommendation etc. in the browser.

dibujante 9y ago

Oh my god don't

tzahola 9y ago

We obviously need to make this tech mandatory. You wouldn’t want your children looking at harmful websites, would you?

nitwit005 9y ago

> Banks don’t want private account details (like the user’s current balance and credit limits etc) being seen by anybody other than the account holder. Unless it's an in-person interaction, a face has little security value, because it's not a secret. Getting a photo, or even full motion video of someone often just requires finding their Instagram page.

deleted 9y ago
[deleted]

desireco42 9y ago

I see we will soon stop putting stickers on camera holes, but will use screwdrivers to pry them out and remove them. :)

Proven 9y ago

Creepy shit

jageen 9y ago

How much secure this will be ? My concern is what if some one show my digital photo to the website, will framework detect it ? Apple said that they over come this by using true depth technology (which i guess required specific hardware). I like the idea thought, but there is a big reason people did not implemented this before.

bbarn 9y ago

So what stops me from creating a device that registers itself as a webcam natively, but just puts a loop of a pre-recorded video that satisfies the face recognition software? Stop trying to find solutions to problems that aren't real.

Mayzie 9y ago
i.e. what people were doing on ChatRoulette for a long time (and probably still are).

cocochanel 9y ago

No! No! No! How much more intrusive do we need to get seriously? This is a naive solution to the problem stated. And a bad one at it, too.

cmaureir 9y ago

Technologically speaking: Yeah, that's a nice feature. Real world: This will be awful, I really don't want any DB to have a photo of me associated with transaction or authentification. Yes, I do have profile pictures, but allowing a service to get a "stream" of your face will be way worse, and I cannot imagine what would happen if this DB get compromised...anyway...still a nice Black Mirror episode though..

cjmoran 9y ago
"We noticed that you've looked away from your screen. Please continue watching the advertisement in order to continue!" "Eye roll detected. Would you like to send feedback to this ad partner?"
- Deestan 9y ago
  "Thanks for watching! Please help keeping this channel alive and do not look away during the ads. Bye!"

ycmjason 9y ago

What happens if I do inspect elements and remove styling? :D