Hacker News Reader

Comment by alkonaut | Hacker News Reader

If a private company says they'll take a picture of me at checkin and then verify that at boarding vs the same picture - then destroy the picture, I'm fine with that. It's a temporary storage of biometric data. I'm especially fine with it if I can opt to go for a paper passport instead.

BUT

If a private company uses some database, especially a centralized/government database, to do the same task - then it's absolutely dystopian.

View on HN

Yes I think there's a ton of potential benefit for facial recognition in terms of streamlining processes which require a lot of ID checks, like air travel, but I would only be OK with it if they implemented it within some parameters which should be enforced with regulation:

- The identification step should be completely anonymized. I.e. the facial recognition step is completely black-box. When I buy my ticket, I submit a photo, and a token is produced which is shared with the airline, and they can compare this token with one which is produced when I show my face at checkin. Like with password storage, even if the facial recognition dataset were somehow compromised, it should not give attackers a way to link my face with my identity. And it should not be possible to type in my name and get to pictures of my face.

- The dataset used to identify me should have a finite lifetime (i.e. from when I check in until the plane takes off) and should be verifiably destroyed afterwards.

- It should be possible to possible to opt-out and identify myself by other means.

I don't think the big issue is the identity change between ticket purchase and checkin, but between checkin and boarding. I.e. no photo is needed when buying ticket. At the checkin step you show your face. When boarding you verify it. Otherwise, I agree with what you said.

This type of biometric check of "the person dropping the bag is the person boarding" has been in use for more than a decade e.g. on Scandinavian, and I think it's basically fine if they use temporary and secure data storage.

The biometric verification didn't take place at all if you didn't check in a bag. https://en.wikipedia.org/wiki/Scandinavian_Airlines#Fingerpr...

Somehow I would trust Scandinavians to handle this better than, say, the US or the UK. Those societies seem to have a better ethic around the public good than others.

What do you think are the chances that any of this data is actually destroyed?

I think zero because as far as I understand this data is actually the second type - i.e. they aren't aquiring this data themselves, they are given access to the authorities' database.

Is the issue with the private company, or with the centralized/government instead? Suppose I start my own little company - at least on paper - can I submit a request to access this face-recognization database as well?

The issue is a bit of both. Customer assumed private company had unauthorized personal data after the company performed the boarding pass checkin.

I meant paper boarding pass of course.

Reply on news.ycombinator.com