Hacker News Reader

Comment by PaulKeeble | Hacker News Reader

Biometrics are creeping into everyday life. One of my local gyms this week switched to requiring fingerprints or you were barred from access. Another local gym uses facial recognition for entrance, although you can choose to have a member card instead if you ask for it directly, they don't list it as an option.

Thankfully in the EU we have GDPR. It considers biometrics as a similar sensitivity to medical data, so unless you genuinely need it (maybe a hospital) then you can only get it with explicit consent. If consent is not given then that can not bar you from service.

So I reported a company to the ICO this week for the introduction of fingerprint scanners and was assured they consider it was a breach and will deal with them. GDPR isn't perfect and I think defaulting to consent is wrong and alternatives must be called out but you can't help people sleeping walking into it, it is very convenient.

View on HN

My gym also uses facial recognition, but does it via a person sitting behind a desk checking that my member ID matches my face. I don't think many people are uncomfortable with this process, and this biometric method has been used for a long time.

Yes, but there are few chances that the person sitting behind the deck will be the target of a brain cyberattack!

Yet

What exactly do you think phishing is?

Yes, but that person can't copy your biometric data stored in their brain, convert it to a standardized format, and distribute it to millions of other devices.

You mean like a photo?

They would have to use a camera, which you would have to allow.

Every gym I've joined snaps your picture when you sign up.

not yet but that day is coming soon.

https://after-on.com/episodes-31-60/039

>and distribute it to millions of other devices...

Or just hundreds of other organizations and corporations.

the big difference is that the data is stored temporarily in a human brain.

as opposed to, you know, somewhere in a poorly designed system which gets hacked.

(sorry, apparently joined a chorus)

The photo on the card is already stored in a system somewhere, and already vulnerable to attack. The brain is just for authentication at the door.

good point, though there might be a bit more biometric data required for a good facial recognition system.

Not necessarily.

the gym thing seems like a bit of a red herring. certainly when you're in your own home you have a reasonable expectation of privacy. even in a shared public space, you ought to have some legal protection against being arbitrarily tracked/surveiled. but on the literal physical premises of a private business, I'm not sure it's such a reasonable expectation.

Biometrics are the future equivalent of using the same password everywhere.

It seems more like 2FA using body parts instead of a phone.

I leave my U2F token in way fewer places than I leave my fingerprints.

Can we agree to 3FA then?

I think the main concern with biometrics is surveillance. Not as much the security problems associated with using the same password everywhere.

i think the implication is that, because it is insecure, it will not be deployed everywhere.

Hmm, I'm not sure that makes sense, since a lot of the deployments we're concerned about don't involve authentication (using biometrics in place of passwords), but other kinds of surveillance.

Sort of a tangent, but I wonder if there are any EU countries that have mandatory biometric ID cards. After a cursory (5-10 minute) search I found countries that either used to have ID cards but currently don't, used to have biometric ID cards but currently don't require biometrics, or have biometric ID cards that are optional. It does seem likely that in the future some country will, if it hasn't already, concede and mandate ID cards that contain biometrics.

Practically, anyway, GDPR seems like a much more effective measure.

The vast majority of countries (EU or not) only issue biometric passports these days: https://en.wikipedia.org/wiki/Biometric_passport#Countries_u...

There are still some loopholes which one can use in order to escape this, but they’re getting fewer and fewer. For example here in Romania they don’t ask you for your biometric data if you apply for a short-term one-year passport, but the issue is that over time going that way is more expensive than directly applying for a 5-year or 10-year passport (which do ask for your biometric data). And loopholes like this one will close pretty soon, I fear.

Spain. I've owned a government issued ID with my fingerprints for forty years. That's no tragedy, believe me. I don't want government to have certain data and I don't want private companies to have other data. If you think about identity as a right, you might start to see things under a different light.

For many private actions companies demand ID number. That reduces identity theft to a bad movie plot.

How does this prevent identity theft, do the private companies verify the fingerprints?

The national ID prevents identity theft. If someone gets something using a fake ID, it's a problem of the provider, so they have every incentive to check the card and request a signature for every transaction. If someone gets past the first filter, you simply go there with your card and make it their problem, not yours.

Hungary scanned my fingerprints when I applied for a residence permit.

Facial recognition for gym entrance sounds wonderful!

If that's banned I'll be in the Resistance!

Indeed, privacy-wise it is equivalent to having cameras recording. But convenience wise it is brilliant, when I want to do sports.. I do not want to bring keys or gym cards, just sports clothes

Far from equivalent my friend. Going through tapes is a manual laborious process that can only be done on a case-by-case basis. Transforming tapes into perfect database line-items that can be combined into a comprehensive profile on all your activities and whereabouts is a much more valuable and dangerous data set.

There already is regulation around storing biometrics in a few states, Ohio and Texas if I remember correctly, and in turn, most national companies avoid storing this data all together because of the risk it causes should people move between those states.

  One of my local gyms this week switched to requiring fingerprints or you were barred from access

If this is a membership gym with contracts, wouldn't they have to wait until your next contract to impose such a change?

I'd say probably not, but it would likely allow you to cancel your membership early (and receive paid fees back, pro-rated).

This is actually a nice hypothetical for that idiotic vision of replacing law and the court system with algorithms. It's extremely unlikely that the specific case would be foreseen in a contract. There is a continuous spectrum of such changes, and it's impossible to formulate any specific rule that would capture them all.

Example A: The gym changes from keys to plastic membership cards. Would this be a breach of contract? I think most everyone would agree that no, it isn't.

Example B: The gym requires whole-genome sequencing (once), then requires a drop of blood every time you enter to check your identity? Breach of contract? -> Obviously.

For any two such changes, you can probably come up with yet another example that's somewhere in between. The closer they get, the more often you will find people disagreeing, yes. But that just shows how justice is a constant conversation not easily set in stone.

As for the specific case: European law really doesn't like biometric data, and it's unlikely they can get away with it.

(the following is based only on my knowledge of German and Portuguese law)

BUT, ) if they do, the pro-rated refund is the most likely outcome. It works both ways, though: if you move away, they also cannot require you to keep paying fees. It's a concept loosely translated as a "cessation of the foundational requirements of the contract).

I wonder what the implications are for the large number of secondary schools that now apparently use fingerprint biometrics for school meal payments.

> If consent is not given then that can not bar you from service.

But they probably can increase the price to cover "administrative costs/..."

in somewhat functional markets that are subject to competition, companies cannot arbitrarily raise prices.

In markets where a "Privacy Fee" is considered standard, the price raise will not be considered arbitrary. I fear this is a potential reality.

Disneyland Paris doesn't use biometrics?

I really hope the politicians in the US champion a GDPR law here. Unfortunately I'm not optimistic.

you know, after saying something like this, you have to vote :P

My datacenter uses biometrics too.

If consent is not given then that can not bar you from service.

What’s the reasoning for this? Shouldn’t I have the freedom to pick the conditions under which I offer my services, except for discrimination? Is it discrimination if I only offer biometric ID, say for business convenience?

The same reason that you aren't allowed to mix sawdust into the flour you sell, even if it is cheaper. Having a business incentive does not mean that you have a moral justification.

What's the moral justification here? Most people love biotmetrics.

What you describe is called freedom of contract, which has the problem that it's the opposite of free when you have inequal parties. For most people contracts have a take it or leave it character, so there needs to be government regulation, to ensure freedom for them.

Calling an imbalance of leverage "the opposite of free" is peak absurdity.

Reply on news.ycombinator.com