4 ms·

> Net-net, shifting toward biometrics is good I disagree. It's a disclosable but non-revokable authentication mechanism. If your fingerprints leak, there's no

> Net-net, shifting toward biometrics is good I disagree. It's a disclosable but non-revokable authentication mechanism. If your fingerprints leak, there's no way to revoke them. If your fingerprints change, like with your friend's kid, you'll find that the systems are not designed to handle updates. It's an ID that you cannot discard but might accidentally ruin.

kulahan 3y ago
IMO it needs to be something that can't change, like your basic DNA, or something to that effect. We definitely do need a better way to positively identify people.
- ycombinatrix 3y ago
  why? that's horrifying for privacy
  - kulahan 3y ago
    Privacy is a new-age luxury that causes more problems than it's worth. I know this is unpopular, and I'm not justifying the abuse of information, but it changes nothing about the fact that we are by-and-large a social species, and being able to positively identify someone would likely have more benefits than drawbacks, because our society is organized around the idea that we know who we're working with.
  - KMag 3y ago
    and also a problem for my identical twins. I just realized we thought we were being a bit cute by giving them names that meant the same thing, but in different languages. Now, I realize that if they translate their names into written Chinese, they better be phonetic translation... if they end up with identical names, same birthday, identical DNA, that could cause problems.
    - scarface_74 3y ago
      And how is this any different than currently using your photo ID and someone looking to see if the ID matches your face? You would still have the identical twin problem
  - syndicatedjelly 3y ago
    Humans don’t need a better way to ID people, computers do
    - kulahan 3y ago
      We find a dead person with no ID. Only a computer cares who they are?
  - PeterisP 3y ago
    Well, in any scenario where you need to verify someone's identity, privacy and anonymity not only aren't goals, but they aren't acceptable. Now you could argue that in many situations you don't need to verify someone's identity and shouldn't have the right to do so; but if you do (like during border control) then your identity isn't supposed to be private.
- dredmorbius 3y ago
  The issue isn't identity but attestation or assertion of identity. The problem with DNA, as with fingerprints, voiceprints, retina scans, and the rest, is that a small sample or simulacrum of the original object or characteristic can often create a false positive. You leave your fingerprints, and DNA, on everything you touch, literally. Your voice is now being recorded in high fidelity at great frequency, and your eyeballs are visible to whatever it is you are looking at. The original use-case for computer passwords, as inveted by Fernando Corbato, was in a specific facility, with a physical location and at least reasonably-limited access, largely as a measure to prevent either accidental or typically prankish mis-use of other people's computer resources. The "universe" was a few score people. We're now relaying on passwords (and numerous other proxies for identity attestation) in a universe of roughly ten billion people, with remote 24/7/365 access and highly-automated attacking systems, over a channel which provides very narrow capabilities for high-credibility, non-spoofable assertions. For humans interacting in person, there are many simultaneous indicia of who an individual is, particularly amongst people well-known to one another: visual appearance, voice, height, gait and carriage, mannerisms, and personal/intimate knowledge. Even for in-person identity assertion, these factors break down at scale, as our primate brains can recall the features of a few score individuals, but not many hundreds or thousands, let alone billions. (An interesting exercise is to consider the span of a year, or your life, and how much time you could dedicate to n number of people in that time. Even over a lifetime, you can only get to know perhaps 50,000 people for an hour or more 1:1, roughly a medium-sized town's population. Not even a large city, let alone a state/province or nation, let alone the global population.) I'm coming to feel that the idea that we can transact significant interactions at this scale (population, distance, time) may well prove to be greatly flawed. Airgapping and limited access have their benefits.
- a_gnostic 3y ago
  Your DNA can change, and has changed -at a spot in sensible people's arm- in recent years.
  - KMag 3y ago
    If you're referring to mRNA vaccines, one of us needs to brush up on basic cellular biology. If you're referring to Adenovirus vector COVID-19 vaccines, I believe episomal replication makes their DNA short-lived in the host. Also, as it's never reverse-transcribed into the human genome, there's a semantic argument that the Adenovirus DNA is never a part of the person's DNA, even when it is short-term resident in the nucleus. Though, I suppose there might be some rare form of translocation that might still result in Adenovirus DNA being incorporated into the Human genome. I don't know enough about viral genetics to know the corner-case caveats associated with the claims that Adenovirus vector vaccines don't modify human DNA.
hedora 3y ago
It’d be good from an individual liberty perspective if all passwords and other authentication tokens were public, like biometrics are. (I’m not an anarchist or well-funded criminal though, so I agree with you.)
fbdab103 3y ago
There was a story in 2015[0] where someone was able to reproduce the fingerprints of the German defense minister from a photograph. >Jan Krissler, known in hacker circles as Starbug, used commercial software called VeriFinger and several close-range photos of von der Leyen, including one gleaned from a press release issued by her own office and another he took himself from three meters away, to reverse-engineer the fingerprint. [0] https://www.dawn.com/news/1154284 https://www.dawn.com/news/1154284
- scarface_74 3y ago
  I have yet to see biometric security done by airport security - either TSA or Clear that doesn’t show your picture when it recognizes your fingers.
Terr_ 3y ago
The key is whether someone falsely believes they are secret. Using your fingerprint instead of typing a username? Fine. Using your fingerprint instead of typing a password? Uh oh.
- chias 3y ago
  If you are in the US, the same is true of your social security number. But good luck with that.
  - DebtDeflation 3y ago
    Just look at the history of credit card security. It started with just having Name / Card Number / Expiry, all of which are printed right on the card, being all that was necessary to conduct a transaction. Then they put a magnetic strip on the back of the card and storing the same information in plain text on that strip. Then they started printing a "secret" 3 or 4 digit number (CVC) on the card for "extra" security. Now we have chips in cards which helps with brick and mortar transactions in an era when most transactions are online.
    - coffeebeqn 3y ago
      The latest thing some do is to issue a virtual card for just one transaction. Which as far as I can tell is actually pretty good
      - KMag 3y ago
        The next thing I'd like to see are deposit-only bank account numbers tied to your regular bank account number, so that you can give someone the information necessary for them to send you money via ACH without them having all the information necessary to drain your bank account. At present, I transfer money into my checking account for each and every outgoing transaction, so there's both a small time window and a small limit on the amount of a theft, and I have less to worry about giving out my checking account number for incoming transfers.
bogota 3y ago
Its just the next SSN and we all know how great that is going
broken-kebab 3y ago
You are right if to speak about access control, but TSA, police, and the likes have other goals. They want to establish firmly one physical person <-> one DB id relation. People checked may for various reasons try to thwart such attempts. In such circumstances it's hard to come with a solution which is not bio*
- roelschroeven 3y ago
  It's hard to come with a solution full stop.
KMag 3y ago
Right, I meant biometrics for identification, as in this TSA use case. Biometrics for authentication/authorization are terrible, at least as currently implemented.
sonicanatidae 3y ago
This is already in place. After EQ was breached, I wasn't sure who to go to, to change my Date of Birth, so it's still the same. :| There is already a lot of truly immutable and practically immutable data that's tracked. The other issue is the courts have dictated that you don't own your own biometrics. Phone locked with face or fingerprint? They can get a court order that allows them to force unlock it. A pin code is considered more secure, because it can't be force bypassed, like biometrics.
- bear141 3y ago
  This is called the 5th amendment.
  - sonicanatidae 3y ago
    That doesn't mean what you think it means.. at least not in the US, today. 1. https://fuscolaw.org/police-cant-force-you-to-unlock-your-smartphone-using-fingerprint-or-face/ https://fuscolaw.org/police-cant-force-you-to-unlock-your-sm... (highlighting is mine) This decision overrules previous circuit court rulings in California that biometric features were considered testimonies since suspects weren’t verbally giving up their numeric passcodes or passwords. 2. https://jsberrylaw.com/blog/can-police-officers-force-you-to-unlock-your-cellphone/ https://jsberrylaw.com/blog/can-police-officers-force-you-to... The method by which you choose to lock your cellphone can make the difference between being required to unlock it for a police officer or not. Police officers cannot force you to unlock your phone by a testimonial act that reveals the contents of your mind. You can be forced to unlock your phone by a nontestimonial act. Nontestimonial acts are things like your biometrics, your DNA, etc.
    - bear141 3y ago
      Thank you for elaborating for me. That’s what I was trying to say but my response was lazy.
boring-alterego 3y ago
I had a big problem with fingerprints and hand geometry stuff after recovering from some serious burns. They had to delete my account to readd me into the system because it changed so much.

kulahan 3y ago

IMO it needs to be something that can't change, like your basic DNA, or something to that effect. We definitely do need a better way to positively identify people.

ycombinatrix 3y ago
why? that's horrifying for privacy
- kulahan 3y ago
  Privacy is a new-age luxury that causes more problems than it's worth. I know this is unpopular, and I'm not justifying the abuse of information, but it changes nothing about the fact that we are by-and-large a social species, and being able to positively identify someone would likely have more benefits than drawbacks, because our society is organized around the idea that we know who we're working with.
- KMag 3y ago
  and also a problem for my identical twins. I just realized we thought we were being a bit cute by giving them names that meant the same thing, but in different languages. Now, I realize that if they translate their names into written Chinese, they better be phonetic translation... if they end up with identical names, same birthday, identical DNA, that could cause problems.
  - scarface_74 3y ago
    And how is this any different than currently using your photo ID and someone looking to see if the ID matches your face? You would still have the identical twin problem
- syndicatedjelly 3y ago
  Humans don’t need a better way to ID people, computers do
  - kulahan 3y ago
    We find a dead person with no ID. Only a computer cares who they are?
- PeterisP 3y ago
  Well, in any scenario where you need to verify someone's identity, privacy and anonymity not only aren't goals, but they aren't acceptable. Now you could argue that in many situations you don't need to verify someone's identity and shouldn't have the right to do so; but if you do (like during border control) then your identity isn't supposed to be private.
dredmorbius 3y ago
The issue isn't identity but attestation or assertion of identity. The problem with DNA, as with fingerprints, voiceprints, retina scans, and the rest, is that a small sample or simulacrum of the original object or characteristic can often create a false positive. You leave your fingerprints, and DNA, on everything you touch, literally. Your voice is now being recorded in high fidelity at great frequency, and your eyeballs are visible to whatever it is you are looking at. The original use-case for computer passwords, as inveted by Fernando Corbato, was in a specific facility, with a physical location and at least reasonably-limited access, largely as a measure to prevent either accidental or typically prankish mis-use of other people's computer resources. The "universe" was a few score people. We're now relaying on passwords (and numerous other proxies for identity attestation) in a universe of roughly ten billion people, with remote 24/7/365 access and highly-automated attacking systems, over a channel which provides very narrow capabilities for high-credibility, non-spoofable assertions. For humans interacting in person, there are many simultaneous indicia of who an individual is, particularly amongst people well-known to one another: visual appearance, voice, height, gait and carriage, mannerisms, and personal/intimate knowledge. Even for in-person identity assertion, these factors break down at scale, as our primate brains can recall the features of a few score individuals, but not many hundreds or thousands, let alone billions. (An interesting exercise is to consider the span of a year, or your life, and how much time you could dedicate to n number of people in that time. Even over a lifetime, you can only get to know perhaps 50,000 people for an hour or more 1:1, roughly a medium-sized town's population. Not even a large city, let alone a state/province or nation, let alone the global population.) I'm coming to feel that the idea that we can transact significant interactions at this scale (population, distance, time) may well prove to be greatly flawed. Airgapping and limited access have their benefits.
a_gnostic 3y ago
Your DNA can change, and has changed -at a spot in sensible people's arm- in recent years.
- KMag 3y ago
  If you're referring to mRNA vaccines, one of us needs to brush up on basic cellular biology. If you're referring to Adenovirus vector COVID-19 vaccines, I believe episomal replication makes their DNA short-lived in the host. Also, as it's never reverse-transcribed into the human genome, there's a semantic argument that the Adenovirus DNA is never a part of the person's DNA, even when it is short-term resident in the nucleus. Though, I suppose there might be some rare form of translocation that might still result in Adenovirus DNA being incorporated into the Human genome. I don't know enough about viral genetics to know the corner-case caveats associated with the claims that Adenovirus vector vaccines don't modify human DNA.

hedora 3y ago

It’d be good from an individual liberty perspective if all passwords and other authentication tokens were public, like biometrics are. (I’m not an anarchist or well-funded criminal though, so I agree with you.)

fbdab103 3y ago

There was a story in 2015[0] where someone was able to reproduce the fingerprints of the German defense minister from a photograph. >Jan Krissler, known in hacker circles as Starbug, used commercial software called VeriFinger and several close-range photos of von der Leyen, including one gleaned from a press release issued by her own office and another he took himself from three meters away, to reverse-engineer the fingerprint. [0] https://www.dawn.com/news/1154284 https://www.dawn.com/news/1154284

scarface_74 3y ago
I have yet to see biometric security done by airport security - either TSA or Clear that doesn’t show your picture when it recognizes your fingers.

Terr_ 3y ago

The key is whether someone falsely believes they are secret. Using your fingerprint instead of typing a username? Fine. Using your fingerprint instead of typing a password? Uh oh.

chias 3y ago
If you are in the US, the same is true of your social security number. But good luck with that.
- DebtDeflation 3y ago
  Just look at the history of credit card security. It started with just having Name / Card Number / Expiry, all of which are printed right on the card, being all that was necessary to conduct a transaction. Then they put a magnetic strip on the back of the card and storing the same information in plain text on that strip. Then they started printing a "secret" 3 or 4 digit number (CVC) on the card for "extra" security. Now we have chips in cards which helps with brick and mortar transactions in an era when most transactions are online.
  - coffeebeqn 3y ago
    The latest thing some do is to issue a virtual card for just one transaction. Which as far as I can tell is actually pretty good
    - KMag 3y ago
      The next thing I'd like to see are deposit-only bank account numbers tied to your regular bank account number, so that you can give someone the information necessary for them to send you money via ACH without them having all the information necessary to drain your bank account. At present, I transfer money into my checking account for each and every outgoing transaction, so there's both a small time window and a small limit on the amount of a theft, and I have less to worry about giving out my checking account number for incoming transfers.

bogota 3y ago

Its just the next SSN and we all know how great that is going

broken-kebab 3y ago

You are right if to speak about access control, but TSA, police, and the likes have other goals. They want to establish firmly one physical person <-> one DB id relation. People checked may for various reasons try to thwart such attempts. In such circumstances it's hard to come with a solution which is not bio*

roelschroeven 3y ago
It's hard to come with a solution full stop.

KMag 3y ago

Right, I meant biometrics for identification, as in this TSA use case. Biometrics for authentication/authorization are terrible, at least as currently implemented.

sonicanatidae 3y ago

This is already in place. After EQ was breached, I wasn't sure who to go to, to change my Date of Birth, so it's still the same. :| There is already a lot of truly immutable and practically immutable data that's tracked. The other issue is the courts have dictated that you don't own your own biometrics. Phone locked with face or fingerprint? They can get a court order that allows them to force unlock it. A pin code is considered more secure, because it can't be force bypassed, like biometrics.

bear141 3y ago
This is called the 5th amendment.
- sonicanatidae 3y ago
  That doesn't mean what you think it means.. at least not in the US, today. 1. https://fuscolaw.org/police-cant-force-you-to-unlock-your-smartphone-using-fingerprint-or-face/ https://fuscolaw.org/police-cant-force-you-to-unlock-your-sm... (highlighting is mine) This decision overrules previous circuit court rulings in California that biometric features were considered testimonies since suspects weren’t verbally giving up their numeric passcodes or passwords. 2. https://jsberrylaw.com/blog/can-police-officers-force-you-to-unlock-your-cellphone/ https://jsberrylaw.com/blog/can-police-officers-force-you-to... The method by which you choose to lock your cellphone can make the difference between being required to unlock it for a police officer or not. Police officers cannot force you to unlock your phone by a testimonial act that reveals the contents of your mind. You can be forced to unlock your phone by a nontestimonial act. Nontestimonial acts are things like your biometrics, your DNA, etc.
  - bear141 3y ago
    Thank you for elaborating for me. That’s what I was trying to say but my response was lazy.

boring-alterego 3y ago

I had a big problem with fingerprints and hand geometry stuff after recovering from some serious burns. They had to delete my account to readd me into the system because it changed so much.