4 ms·

They also quite explicitly state it does not store the actual fingerprint, which might be (is? logic follows) notable. It 'converts to a numerical value' instea

They also quite explicitly state it does not store the actual fingerprint, which might be (is? logic follows) notable. It 'converts to a numerical value' instead. That can't just be hashing (how do you check that when validating later? images won't be exact) but instead would be some form of parsing to a subset of data which is 'unique enough' for their purposes. Their purpose is something like identification across current visitors with statistical significance, preventing ticket sharing. I'd expect that that has the side effect of the data NOT being unique enough for other purposes where the ticket isn't present. I suspect this was inevitable given Disney's obsession with removing friction. It seems like they at least take the implications fairly seriously, which is nice to see.

crooked-v 9y ago
Disney is one of the few companies I'd sorta-kinda trust with this sort of thing, given their extraordinary attention to detail and laser focus on long-term customer happiness with everything park-related and the attention to data security that would also imply.
- diafygi 9y ago
  But that's not who you're trusting. The issue now is that any "business record" is available to be requested by law enforcement without a warrant. The case law around third party doctrine is a huge friction point in establishing corporate trust.
  - icebraining 9y ago
    It's useful to remember the words of the prescient Privacy Protection Study Commission, from 1977: "The real danger is the gradual erosion of individual liberties through the automation, integration, and interconnection of many small, separate recordkeeping systems, each of which alone may seem innocuous, even benevolent, and wholly justifiable."
mynameisvlad 9y ago
> I suspect this was inevitable given Disney's obsession with removing friction. Yeah, I would say it's this 100%. Disney wants people to leave their wallets at their hotel. The RFID band they give you can be used for everything from entering your hotel room to getting into the park and your rides (including Fastpass) to even paying for things if you link a credit card. Obviously, it's easy to take the band off and give it to someone else, so they needed some other way to check if you're the person who originally used the ticket. Hashes based on fingerprints are unique enough to be the replacement to traditional IDs.
candiodari 9y ago
Which is about as reassuring as saying "we don't store your criminal record, just the bytes that make it up". What you want to do with fingerprints is compare them to fingerprints found. Hashes let you do that. THAT's what we want to prevent from happening in order to have privacy.
- deleted 9y ago
  [deleted]

crooked-v 9y ago

Disney is one of the few companies I'd sorta-kinda trust with this sort of thing, given their extraordinary attention to detail and laser focus on long-term customer happiness with everything park-related and the attention to data security that would also imply.

diafygi 9y ago
But that's not who you're trusting. The issue now is that any "business record" is available to be requested by law enforcement without a warrant. The case law around third party doctrine is a huge friction point in establishing corporate trust.
- icebraining 9y ago
  It's useful to remember the words of the prescient Privacy Protection Study Commission, from 1977: "The real danger is the gradual erosion of individual liberties through the automation, integration, and interconnection of many small, separate recordkeeping systems, each of which alone may seem innocuous, even benevolent, and wholly justifiable."

mynameisvlad 9y ago

> I suspect this was inevitable given Disney's obsession with removing friction. Yeah, I would say it's this 100%. Disney wants people to leave their wallets at their hotel. The RFID band they give you can be used for everything from entering your hotel room to getting into the park and your rides (including Fastpass) to even paying for things if you link a credit card. Obviously, it's easy to take the band off and give it to someone else, so they needed some other way to check if you're the person who originally used the ticket. Hashes based on fingerprints are unique enough to be the replacement to traditional IDs.

candiodari 9y ago

Which is about as reassuring as saying "we don't store your criminal record, just the bytes that make it up". What you want to do with fingerprints is compare them to fingerprints found. Hashes let you do that. THAT's what we want to prevent from happening in order to have privacy.

deleted 9y ago
[deleted]