Hacker News Reader

Comment by skj | Hacker News Reader

(disclosure: I am a Googler, but I have nothing to do with this project)

Passwords are problematic, easy to lose, easy to steal, but an issue with biometric identify verification is that you can no longer maintain multiple personas. Using a password with 2FA, you can quite easily maintain two sets of those credentials, assuming that the authority doesn't demand proof of real name or such nonsense.

If you trust the authority, it's no big deal. And, I trust Google... today. But do I trust Google tomorrow? I don't yet know tomorrow's Google.

View on HN

>>> If you trust the authority, it's no big deal. And, I trust Google... today.

Google yes/maybe. But when you talk to Google who else is involved? Which governments are granted access, with or without google's knowledge? How many 20-something analysts at three-lettered agencies have access? I would like to trust a large publicly-traded company, but the reality today is that they seem in little more control than the individual. We've seen their logos on too many leaked documents.

My trust in Google comes from me believing Google is capable of preventing undetected access, and limiting detected access to that which is legally obligated. I'm not going to try to convince you that this is the case, only state that it's what I believe.

Capable? Have you heard about prism? Google claims to have been in the dark, that data was siphoning off as it flowed between data centers. That is an admission that Google is not capable of protecting against such things. They claim to have not even contemplated the attack.

To quote the boss:

"Until this week’s reports, we had never heard of the broad type of order that Verizon received—an order that appears to have required them to hand over millions of users’ call records. We were very surprised to learn that such broad orders exist."

https://googleblog.blogspot.ca/2013/06/what.html

Yes, and as a result traffic is now encrypted between data centers.

And I'm not sure what your quote adds to the point.

My point is that google's claims today cannot be trusted any more than when those same claims made three years ago. Google was wrong about it's abilities then as it may be wrong about them today.

Google is now so large that 'trust' is impossible. Google's attack surface is now so vast, the data so valuable, and cross-talk of personnel with government so common that the likelihood of another undetected breech is too great to ignore. (Same for apple/facebook et al).

His point is - if I may - that if they could not foresee that this was the case in the past that there is a good reason to assume they won't be able to foresee similar things in the present.

It's not as if it took a great feat of imagination to suspect that data flowing between datacenters would be tapped.

This response is too terse given the calmness and energy other people have put into their discussion. If people were saying blatantly stupid responses, that's understandable -- but that's not apparent here whatsoever.

Google has been penetrated before, and Google has had to comply with government agencies, and legislation has passed legally shielding Google from complying with orders later found to be unlawful.

Now you're saying that Google can't be penetrated again, and can be trusted with user privacy. Nobody is saying that getting Google to lawfully turn over user privacy, or that penetrating Google is easy. But Google is a massive organization, and it's not surprising that the USA or China can penetrate it -- lawfully and unlawfully.

As I mentioned in another post, I'm not trying to convince anyone. I'm just saying I have confidence.

Even so, security is a road, not a destination. If people want to argue that you should put your data anywhere, I'll buy it. But of the places your data can go, right now I think good is the best steward. And that certainly includes just keeping it yourself.

>I trust Google... today.

This is really hard problem for our society. A lot of people say 'nothing to hide', most people don't have a problem with gov. surveillance, only because we live in a semi-democratic countries and a lot of them were not hurt by communistic governments. People in Germany and Poland look differently at such things, they still remember Stasi (Ger) and SB with WRON(Pl). Clearly our governments want more power and information and it's not for our safety, this situation is reminding people that communism can be turned into democracy, and democracy into communism, very quickly.

It is just freaky Western people today are so ignorant about McCarthyism or COINTELPRO (https://en.wikipedia.org/wiki/COINTELPRO).

I think most people understand your last point as you meant it, but Democracy and communism are Apples and Oranges.

That's not really true though, if the access to both of these accounts is granted with the same credentials it does not matter whether those credentials are a password or biometric data.

The bad part is when the account disappears completely and you only have the option to use the biometric data.

So there is a middle ground.

> And, I trust Google... today.

I don't. Todays google is the google I saw coming quite a few years ago and it is as bad as I feared it would be and too large to be able to get around without losing out on valuable participation. Facebook, Microsoft and Apple are a lot easier to avoid than Google.

Maybe the biometric verification could be done on a home server, if it makes sense. Make like a hash of the behavior, and share the hash instead. So you'd have privacy, and multiple personas, and the ease of use.

Also, I imagined "contracts of morality", where corporations are enforced into ethical behavior, if they choose to, so they can be 'trusted' on a longer scale, to be 'good' beyond the common law. I understand it's not easy to define.

For the password, I think it could end like Facebook, anonymity sacrificed. It just gives you an edge. It's a form of tragedy of commons. It gives you an edge until it doesn't. (but I trust it'll be worked out)

It could be even creepier if the biometric data could be sold to third parties, or if Google were to offer an identification service for third parties.

Biometrics are an excellent technology for tracking convicts because they can't be changed.

Edit: Downvotes? Prisons and corrections would love this thing for checking convicts identities. They already use fingerprints and mugshots which are cruder biometrics. This is just taking it to the next level.

Medical researchers?

Insurance Agents?

So, Mr. Owl, I'm afraid that your insurance premiums are going up. Why? Because of that slip on the ice two days ago; our monitoring indicates that you have injured your back. Yes, I know you haven't even seen a doctor yet, but there's a 62% probability that you will be making a large claim shortly, so up with your premiums!

I've stated elsewhere in the thread that there would need to be privacy protections, e.g. require Google or anyone using biometrics to be HIPAA compliant, make it opt-in only, but if anyone is actually going to implement this, medical research should benefit.

Reply on news.ycombinator.com