5 ms·

If I won’t give Amazon my palm print to pay at Whole Foods, why the f would I give Mastercard a pair of retinal scans? Seems like MC executives grew up on “Min

by xyst 2y ago

If I won’t give Amazon my palm print to pay at Whole Foods, why the f would I give Mastercard a pair of retinal scans? Seems like MC executives grew up on “Minority Report” and thought, damn this is a good idea!

jgalt212 2y ago
or got FOMO regarding Worldcoin.
cempaka 2y ago
People willingly do this for the minor convenience of saving 30 minutes in TSA lines. And I imagine the MC executives picture themselves as part of the cosseted ruling class depicted in 'Minority Report'.
- BadHumans 2y ago
  With TSA precheck, you are just giving the one government agency permission to have data another government agency already has. I wouldn't willing give MasterCard any information about me.
  - samtheprogram 2y ago
    They aren’t referring to TSA precheck, they are referring to Clear PLUS.
  - criddell 2y ago
    With TSA precheck, you have to be fingerprinted, no?
    - BadHumans 2y ago
      Yes you do.
    - toomuchtodo 2y ago
      Yes. State Dept already has my photo from my passport, fingerprints stored by DHS aren’t that much more (Global Entry specific). I trust federal agencies more than private corporations, having seen the inside of both.
      - cempaka 2y ago
        Am I missing something? Aren't fingerprints a form of PII that everyone just leaves lying around on everything they touch? And that the government isn't really permitted to collect & catalog except as part of a criminal investigation (or a few other minor licensing hurdles like selling alcohol)?
        toomuchtodo 2y ago
        https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_10-fingerprint_consumer_friendly_content_1400_words.pdf https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_10-f... https://www.dhs.gov/biometrics https://www.dhs.gov/biometrics
- hammock 2y ago
  30 seconds. TSA has the stereo 3d cameras at a lot of ID/boarding pass checkpoints now, but all you have to do is say "no camera thanks" (and hold some paper over the lens if you want) and they will check you the regular way
drdaeman 2y ago
Are retinal scans a big deal? It requires a decent camera with very good optics or short distance from your eyes to get a meaningful identification, so your casual CCTV mass surveillance isn't a problem. If I want anonymity, irises are going to be very low on my list of potential worries. Also, I consider those to be public data (just like my face, fingerprints, overall appearance, voice or DNA), because anyone willing within a reasonable proximity can get this data anyway and there's no stopping it. So, if some company wants to use that as an authenticator... well, that's a stupid idea that I would protest for anything sensitive (unauthorized access to which could actually cause me some griefs), but as long as it's not my liability (and for a credit card it is not - fraud disputes aren't fun but it's not my money either) they can do... whatever, I guess. Or am I missing something?
- autorizo 2y ago
  You nailed it, we should not use public data for important things like this that could result in fraud.
  - drdaeman 2y ago
    Totally! Like I said - biometrics is a very bad idea for anything actually sensitive. I wouldn't let my door lock open upon seeing my face - high convenience but high risk. But I don't mind a PAM module on a non-portable desktop computer that would let me passwordless sudo when camera sees me - low risk, high convenience. And if some credit organization or airport security says they're fine with using it - I see this as their risks, not mine. And giving them my biometrics isn't hurting me because I won't use it for anything I care about. Unless, of course, I'll be forced to, somehow - but I doubt that's likely. I see MasterCard doing this as they estimated a risk-to-profit factor to be satisfactorily low. My overall impression of banking/finance industry is that they're very different when it comes to security - they tend to have what we'd call poor security practices, but they compensate this by taking responsibility for when things fail, swallowing the losses (cheaper than upgrading everyone and everything) and just making sure they earn more than they lose. It's more prominent in US (where half of the industry relies on knowing last four of secret SSN number that you have to share-not-share with a lot of companies, and some very "secret" questions like my birthday - and the economy still works somehow!) than in EU, though.

by xyst 2y ago

jgalt212 2y ago

or got FOMO regarding Worldcoin.

cempaka 2y ago

People willingly do this for the minor convenience of saving 30 minutes in TSA lines. And I imagine the MC executives picture themselves as part of the cosseted ruling class depicted in 'Minority Report'.

BadHumans 2y ago
With TSA precheck, you are just giving the one government agency permission to have data another government agency already has. I wouldn't willing give MasterCard any information about me.
- samtheprogram 2y ago
  They aren’t referring to TSA precheck, they are referring to Clear PLUS.
- criddell 2y ago
  With TSA precheck, you have to be fingerprinted, no?
  - BadHumans 2y ago
    Yes you do.
  - toomuchtodo 2y ago
    Yes. State Dept already has my photo from my passport, fingerprints stored by DHS aren’t that much more (Global Entry specific). I trust federal agencies more than private corporations, having seen the inside of both.
    - cempaka 2y ago
      Am I missing something? Aren't fingerprints a form of PII that everyone just leaves lying around on everything they touch? And that the government isn't really permitted to collect & catalog except as part of a criminal investigation (or a few other minor licensing hurdles like selling alcohol)?
      - toomuchtodo 2y ago
        https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_10-fingerprint_consumer_friendly_content_1400_words.pdf https://www.dhs.gov/xlibrary/assets/usvisit/usvisit_edu_10-f... https://www.dhs.gov/biometrics https://www.dhs.gov/biometrics
hammock 2y ago
30 seconds. TSA has the stereo 3d cameras at a lot of ID/boarding pass checkpoints now, but all you have to do is say "no camera thanks" (and hold some paper over the lens if you want) and they will check you the regular way

drdaeman 2y ago

Are retinal scans a big deal? It requires a decent camera with very good optics or short distance from your eyes to get a meaningful identification, so your casual CCTV mass surveillance isn't a problem. If I want anonymity, irises are going to be very low on my list of potential worries. Also, I consider those to be public data (just like my face, fingerprints, overall appearance, voice or DNA), because anyone willing within a reasonable proximity can get this data anyway and there's no stopping it. So, if some company wants to use that as an authenticator... well, that's a stupid idea that I would protest for anything sensitive (unauthorized access to which could actually cause me some griefs), but as long as it's not my liability (and for a credit card it is not - fraud disputes aren't fun but it's not my money either) they can do... whatever, I guess. Or am I missing something?

autorizo 2y ago
You nailed it, we should not use public data for important things like this that could result in fraud.
- drdaeman 2y ago
  Totally! Like I said - biometrics is a very bad idea for anything actually sensitive. I wouldn't let my door lock open upon seeing my face - high convenience but high risk. But I don't mind a PAM module on a non-portable desktop computer that would let me passwordless sudo when camera sees me - low risk, high convenience. And if some credit organization or airport security says they're fine with using it - I see this as their risks, not mine. And giving them my biometrics isn't hurting me because I won't use it for anything I care about. Unless, of course, I'll be forced to, somehow - but I doubt that's likely. I see MasterCard doing this as they estimated a risk-to-profit factor to be satisfactorily low. My overall impression of banking/finance industry is that they're very different when it comes to security - they tend to have what we'd call poor security practices, but they compensate this by taking responsibility for when things fail, swallowing the losses (cheaper than upgrading everyone and everything) and just making sure they earn more than they lose. It's more prominent in US (where half of the industry relies on knowing last four of secret SSN number that you have to share-not-share with a lot of companies, and some very "secret" questions like my birthday - and the economy still works somehow!) than in EU, though.