5 ms·

What about the major problem with biometrics? You can change your credit card. Change your bank. Change your name. And for the sheep who are so inclined, ev

What about the major problem with biometrics? You can change your credit card. Change your bank. Change your name. And for the sheep who are so inclined, even change your underwear. But you can't change your biometric data. Now suppose some bad guy cuts off your hand at the wrist. They can then produce that bloody item at the POS terminal and use it to pay for goods. At this point you have just become the victim of a serious crime because you are now responsible for payment.

JoshTko 5y ago
I think owing $50 for groceries is not what someone is going to be worrying about the most here...
justicezyx 5y ago
Let's be real. Changing your name does not change your credit history. Losing an illusory value you have never owned by adopting a new technology, that's not a real problem.
frumper 5y ago
Maybe a less dramatic situation than your hand being removed, what if a bad guy figures out the ability to copy your palm print.
- JumpCrisscross 5y ago
  > what if a bad guy figures out the ability to copy your palm print Then you would dispute the charge and have your own geolocation data or the store's video footage to substantiate your claim. This is a grocery store, not a diamond merchant.
  - frumper 5y ago
    The problem isn't this one transaction. Of course you could dispute it, but you're in for a life of disputing charges as you can't tell the merchant to not accept your hand print and use a newly issued one like a card number when it is compromised
    - NovemberWhiskey 5y ago
      The article says that you have to register the palm print vs a credit card. A common-sense approach would suggest that if you cancel the credit card, then registration also lapses. If you happen to have attracted the attention of this master counterfeiter who has duplicated your palm you would simply have the option of not registering your new card with the system. If this happens on a large scale, yes, the whole project is doomed.
      - pavel_lishin 5y ago
        What happens when you register with the next credit card? It's not like your palm print will change.
        NovemberWhiskey 5y ago
        Don't do that then. If you find that someone has (somehow) managed to duplicate your palm print then you probably do not want to enroll with that option for payments in the future.
        pavel_lishin 5y ago
        That's great advice for me - a person who's not going to register his palm anyway - but what would be your advice to Amazon for how to deal with this? Or what would be your advice to someone who wants to use their palm with a different credit card once their palmprint has been lifted and used to commit fraud?
      - frumper 5y ago
        Again, it's not that this specific issue can't be dealt with by canceling your palm print or convenient checkout. You're just left with not being able to safely register your palm print with any company if your biometric data gets stolen. I can envision a world where it doesn't take a master counterfeiter to 3d printer a palm print that gets through the scanner and a database of stolen palm print data people can buy and trade like they currently do with stolen credit card numbers. The issue is once your biometric data is compromised you have no recourse to regenerate it. Your solution is you just don't get to participate in these features anymore.
- text70 5y ago
  Or create a palm reading fortune app that sells for 1.99, and sell the data to amazon to train their AI. Unless that database has been purged of PID, there would be the potential for abuse if it was sold or stolen for getting some free groceries.
renewiltord 5y ago
I feel like the crime of hand-cutting is way worse than the crime of using a stolen credit card. Like, it feels like the worst way to buy groceries. The cases in Malaysia with the cut off thumbs to start a Mercedes make sense but for groceries the concept is outlandish.
- tyingq 5y ago
  I think the idea is that Amazon is big enough to make palm prints a strong precedent that eventually ends up in things like expensive cars.
  - throwawayboise 5y ago
    An employer of mine used biometrics (palm scan) to control entry. They dropped it and went back to NFC cards and PIN. Never explained why.
- olyjohn 5y ago
  Do you think they're only using this for groceries and that it will never be expanded to other retail? In the article it says they are already in talks with other vendors. This means your hand does more than just buy groceries, it will work anywhere there is a palm scanning terminal. It will work at WalMart or Best Buy to buy thousands of dollars of electronics, or maybe even one day to buy a car. Maybe your phone will even be able to read palm prints, and you can buy and sell private goods, or illegal goods using it. That's a lot more than a bunch of groceries.
  - renewiltord 5y ago
    Sure but if you're walking into a store you can use my contactless card. Using my hand is kind of...unnecessary. At that point, you're just cutting off my hand for the sake of it.
  - NovemberWhiskey 5y ago
    If people are willing to go to these extents then the biometrics aspect is just a red herring. They kidnap your spouse/child/parent and threaten to murder them unless you go through with the transaction. They hold a gun to your head while you transfer the contents of your bitcoin wallet to them. They beat you with a rubber hose until you give them your safe combination.
RandallBrown 5y ago
You wouldn't be responsible for the payment just like you aren't responsible for the payment with a stolen credit card. I also wouldn't be surprised if these terminals had a pulse detector that would stop a severed hand from working at all. You'd probably even have an easier time proving your hand was stolen it since your hand is missing. It's still a problem that if someone compromises your biometric data they'll have full access forever. In practice that isn't a huge problem because it's still really hard to do.
notatoad 5y ago
>They can then produce that bloody item at the POS terminal given the general attitudes towards privacy and biometric data here on HN, i honestly can't tell if people trying to pay for groceries with bloody severed limbs is a concern you legitimately have or if this is satire.
- DannyB2 5y ago
  Shirley being responsible for payment wouldn't be the first serious crime that one would have been the victim of if their hand were severed.
- cheschire 5y ago
  Well maybe it's intended to be tongue-in-cheek, like "prepare for the zombie apocalypse, and you prepare for all catastrophic events."
- evanextreme 5y ago
  The cutting off a hand thing might be satire, but the threat of biometric data being replicated and used if its the only measure of authentication isn't. If we have the ability to read and scan palm prints, than the technology to replicate those prints into maybe a faux glove and trick this system isnt that far off i'd assume, right? Comparing this system to, for instance a chip card reader, the palm print is significantly less secure because it uses a single factor (something you are) versus a chip which requires the customer to both have the card with the chip present for payment, and to know the PIN in order to authenticate. Or your phone for example, if someone steals your fingerprint (or even models your face), they still need to have your physical phone to unlock it. With this palm scanning tech, all you need is the palm and you can pay for anything anywhere because there's no secondary confirmation
maxk42 5y ago
Serious response to your non-serious question: There are numerous reports of people being locked out of their biometric accounts after an injury. If you burn yourself cooking and have a blister on your hand you may not be able to go buy first aid supplies at Whole Foods afterward. Alternatives are required.
AndrewMock 5y ago
Biometrics are immutable! I don't think anybody's going to cut your arm off to steal a television with. However, extremely secure environments certainly avoid biometrics as a "single factor" for this reason. https://arstechnica.com/information-technology/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/ https://arstechnica.com/information-technology/2014/12/polit...

JoshTko 5y ago

I think owing $50 for groceries is not what someone is going to be worrying about the most here...

justicezyx 5y ago

Let's be real. Changing your name does not change your credit history. Losing an illusory value you have never owned by adopting a new technology, that's not a real problem.

frumper 5y ago

Maybe a less dramatic situation than your hand being removed, what if a bad guy figures out the ability to copy your palm print.

JumpCrisscross 5y ago
> what if a bad guy figures out the ability to copy your palm print Then you would dispute the charge and have your own geolocation data or the store's video footage to substantiate your claim. This is a grocery store, not a diamond merchant.
- frumper 5y ago
  The problem isn't this one transaction. Of course you could dispute it, but you're in for a life of disputing charges as you can't tell the merchant to not accept your hand print and use a newly issued one like a card number when it is compromised
  - NovemberWhiskey 5y ago
    The article says that you have to register the palm print vs a credit card. A common-sense approach would suggest that if you cancel the credit card, then registration also lapses. If you happen to have attracted the attention of this master counterfeiter who has duplicated your palm you would simply have the option of not registering your new card with the system. If this happens on a large scale, yes, the whole project is doomed.
    - pavel_lishin 5y ago
      What happens when you register with the next credit card? It's not like your palm print will change.
      - NovemberWhiskey 5y ago
        Don't do that then. If you find that someone has (somehow) managed to duplicate your palm print then you probably do not want to enroll with that option for payments in the future.
        pavel_lishin 5y ago
        That's great advice for me - a person who's not going to register his palm anyway - but what would be your advice to Amazon for how to deal with this? Or what would be your advice to someone who wants to use their palm with a different credit card once their palmprint has been lifted and used to commit fraud?
    - frumper 5y ago
      Again, it's not that this specific issue can't be dealt with by canceling your palm print or convenient checkout. You're just left with not being able to safely register your palm print with any company if your biometric data gets stolen. I can envision a world where it doesn't take a master counterfeiter to 3d printer a palm print that gets through the scanner and a database of stolen palm print data people can buy and trade like they currently do with stolen credit card numbers. The issue is once your biometric data is compromised you have no recourse to regenerate it. Your solution is you just don't get to participate in these features anymore.
text70 5y ago
Or create a palm reading fortune app that sells for 1.99, and sell the data to amazon to train their AI. Unless that database has been purged of PID, there would be the potential for abuse if it was sold or stolen for getting some free groceries.

renewiltord 5y ago

I feel like the crime of hand-cutting is way worse than the crime of using a stolen credit card. Like, it feels like the worst way to buy groceries. The cases in Malaysia with the cut off thumbs to start a Mercedes make sense but for groceries the concept is outlandish.

tyingq 5y ago
I think the idea is that Amazon is big enough to make palm prints a strong precedent that eventually ends up in things like expensive cars.
- throwawayboise 5y ago
  An employer of mine used biometrics (palm scan) to control entry. They dropped it and went back to NFC cards and PIN. Never explained why.
olyjohn 5y ago
Do you think they're only using this for groceries and that it will never be expanded to other retail? In the article it says they are already in talks with other vendors. This means your hand does more than just buy groceries, it will work anywhere there is a palm scanning terminal. It will work at WalMart or Best Buy to buy thousands of dollars of electronics, or maybe even one day to buy a car. Maybe your phone will even be able to read palm prints, and you can buy and sell private goods, or illegal goods using it. That's a lot more than a bunch of groceries.
- renewiltord 5y ago
  Sure but if you're walking into a store you can use my contactless card. Using my hand is kind of...unnecessary. At that point, you're just cutting off my hand for the sake of it.
- NovemberWhiskey 5y ago
  If people are willing to go to these extents then the biometrics aspect is just a red herring. They kidnap your spouse/child/parent and threaten to murder them unless you go through with the transaction. They hold a gun to your head while you transfer the contents of your bitcoin wallet to them. They beat you with a rubber hose until you give them your safe combination.

RandallBrown 5y ago

You wouldn't be responsible for the payment just like you aren't responsible for the payment with a stolen credit card. I also wouldn't be surprised if these terminals had a pulse detector that would stop a severed hand from working at all. You'd probably even have an easier time proving your hand was stolen it since your hand is missing. It's still a problem that if someone compromises your biometric data they'll have full access forever. In practice that isn't a huge problem because it's still really hard to do.

notatoad 5y ago

>They can then produce that bloody item at the POS terminal given the general attitudes towards privacy and biometric data here on HN, i honestly can't tell if people trying to pay for groceries with bloody severed limbs is a concern you legitimately have or if this is satire.

DannyB2 5y ago
Shirley being responsible for payment wouldn't be the first serious crime that one would have been the victim of if their hand were severed.
cheschire 5y ago
Well maybe it's intended to be tongue-in-cheek, like "prepare for the zombie apocalypse, and you prepare for all catastrophic events."
evanextreme 5y ago
The cutting off a hand thing might be satire, but the threat of biometric data being replicated and used if its the only measure of authentication isn't. If we have the ability to read and scan palm prints, than the technology to replicate those prints into maybe a faux glove and trick this system isnt that far off i'd assume, right? Comparing this system to, for instance a chip card reader, the palm print is significantly less secure because it uses a single factor (something you are) versus a chip which requires the customer to both have the card with the chip present for payment, and to know the PIN in order to authenticate. Or your phone for example, if someone steals your fingerprint (or even models your face), they still need to have your physical phone to unlock it. With this palm scanning tech, all you need is the palm and you can pay for anything anywhere because there's no secondary confirmation

maxk42 5y ago

Serious response to your non-serious question: There are numerous reports of people being locked out of their biometric accounts after an injury. If you burn yourself cooking and have a blister on your hand you may not be able to go buy first aid supplies at Whole Foods afterward. Alternatives are required.

AndrewMock 5y ago

Biometrics are immutable! I don't think anybody's going to cut your arm off to steal a television with. However, extremely secure environments certainly avoid biometrics as a "single factor" for this reason. https://arstechnica.com/information-technology/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/ https://arstechnica.com/information-technology/2014/12/polit...