4 ms·

> I could age verify myself only once at an Amazon One kiosk and then have my legal age linked to my verified palm Why not do the same thing, but instead of ve

> I could age verify myself only once at an Amazon One kiosk and then have my legal age linked to my verified palm Why not do the same thing, but instead of verifying your palm you verify a device that's responsible for authenticating you? This could be a special phone app (like Singapore's SingPass[1]) or even a small card with a built-in fingerprint reader. Once you authenticate yourself to the device, it can attest to your identity and the transaction can be finished via NFC. Seems like the best of both worlds - automate identity validation without a centralized biometric database. 1. https://www.singpass.gov.sg https://www.singpass.gov.sg

dustinmoris 6y ago
> Why not do the same thing, but instead of verifying your palm you verify a device? Because my (imaginary) 12 year old son can grab my phone and then pretend to be an adult when doing booze shopping. This is the reason why most Western countries don't allow this kind of technology for age verification. For example in the UK you have to file an application if your new technology can be authorised to be used for age verification in pubs, restaurants and other venues and that wouldn't pass their requirements. On the other hand, a palm cannot be given to a 12 year old person. If Amazon One uses an element of palm veins in their biometric template, then even if you chopped off your hand it wouldn't work anymore because the blood flow would stop and therefore fail the identification. It is true that an adult could still pay for booze for a 12 year old by presenting their palm, but that is already the case today where parents can go shopping with their children and buy alcohol as part of the family basket. EDIT: At the end of the day, a biometric will ensure that the adult is actually physically present at the time of purchase, which is what the law requires for things like alcohol shopping. Devices don't have that extra layer of quality assurance. EDIT 2: > But why couldn't the device handle your biometric authentication? Your 12-year-old son can't (hopefully) steal your face or your fingerprint Because what happens on the device is unknown to the thing which needs to know that you are of legal age. At the end of the day it's just a phone which says "yes person is above 18" but how do you know that my phone didn't just reply that because it was programmed by me to do so? If the biometric is verified by the Amazon One device which is not my personal device then it's infinitely less likely to have bene tampered with.
- culturestate 6y ago
  But why couldn't the device handle your biometric authentication? Your 12-year-old son can't (hopefully) steal your face or your fingerprint.
  - dane-pgp 6y ago
    You might be able to avoid a central database of biometric data, but who is going to certify the accuracy of these biometric authentication devices? Presumably if a manufacturer made a device that didn't actually bother checking the fingerprint, the systems that integrate with these devices would have to refuse to accept claims from it.
    - culturestate 6y ago
      If this were an interoperable standard, I imagine the pool of "approved issuers" would be relatively small, limited to e.g. governments or banks. Bloomberg uses a system not entirely dissimilar to this[1], and I could see Apple and Google building an OS API that the issuers' apps would use specifically for this. 1. https://security.stackexchange.com/questions/101862/what-advantage-does-the-bloomberg-authentication-system-have-over-traditional-2 https://security.stackexchange.com/questions/101862/what-adv...
      - dane-pgp 6y ago
        Yup, and I could see governments demanding that these devices have "lawful interception" capability, allowing the biometric data to be scooped up with individual warrants, or in bulk with a National Security Letter, to "catch all the terrorists".
- mmm_grayons 6y ago
  If your son is stealing your stuff to go buy booze there's a bigger issue and the answer is not invasive biometrics, nor is it government restriction of alcohol sales. Kids will drink if they want to; only a willingness not to do so will stop them.
- 6y ago

dustinmoris 6y ago

> Why not do the same thing, but instead of verifying your palm you verify a device? Because my (imaginary) 12 year old son can grab my phone and then pretend to be an adult when doing booze shopping. This is the reason why most Western countries don't allow this kind of technology for age verification. For example in the UK you have to file an application if your new technology can be authorised to be used for age verification in pubs, restaurants and other venues and that wouldn't pass their requirements. On the other hand, a palm cannot be given to a 12 year old person. If Amazon One uses an element of palm veins in their biometric template, then even if you chopped off your hand it wouldn't work anymore because the blood flow would stop and therefore fail the identification. It is true that an adult could still pay for booze for a 12 year old by presenting their palm, but that is already the case today where parents can go shopping with their children and buy alcohol as part of the family basket. EDIT: At the end of the day, a biometric will ensure that the adult is actually physically present at the time of purchase, which is what the law requires for things like alcohol shopping. Devices don't have that extra layer of quality assurance. EDIT 2: > But why couldn't the device handle your biometric authentication? Your 12-year-old son can't (hopefully) steal your face or your fingerprint Because what happens on the device is unknown to the thing which needs to know that you are of legal age. At the end of the day it's just a phone which says "yes person is above 18" but how do you know that my phone didn't just reply that because it was programmed by me to do so? If the biometric is verified by the Amazon One device which is not my personal device then it's infinitely less likely to have bene tampered with.

culturestate 6y ago
But why couldn't the device handle your biometric authentication? Your 12-year-old son can't (hopefully) steal your face or your fingerprint.
- dane-pgp 6y ago
  You might be able to avoid a central database of biometric data, but who is going to certify the accuracy of these biometric authentication devices? Presumably if a manufacturer made a device that didn't actually bother checking the fingerprint, the systems that integrate with these devices would have to refuse to accept claims from it.
  - culturestate 6y ago
    If this were an interoperable standard, I imagine the pool of "approved issuers" would be relatively small, limited to e.g. governments or banks. Bloomberg uses a system not entirely dissimilar to this[1], and I could see Apple and Google building an OS API that the issuers' apps would use specifically for this. 1. https://security.stackexchange.com/questions/101862/what-advantage-does-the-bloomberg-authentication-system-have-over-traditional-2 https://security.stackexchange.com/questions/101862/what-adv...
    - dane-pgp 6y ago
      Yup, and I could see governments demanding that these devices have "lawful interception" capability, allowing the biometric data to be scooped up with individual warrants, or in bulk with a National Security Letter, to "catch all the terrorists".
mmm_grayons 6y ago
If your son is stealing your stuff to go buy booze there's a bigger issue and the answer is not invasive biometrics, nor is it government restriction of alcohol sales. Kids will drink if they want to; only a willingness not to do so will stop them.
6y ago