Hacker News Reader

Comment by yalogin | Hacker News Reader

So far what Apple and other companies did is to keep the biometric auth tied to the device and not let leak out. Now Amazon is saying leaking it is the feature. They are using the hand as the identifier, so the biometric id is what is used to identify a person, not an email address, not a random number or a handle. The biometric data that cannot be changed ever is the identifier.

It's very troubling.

- The privacy and security implications are huge.

- Its tied to commerce, not some airport entry thing. Commerce has legs.

- On top of that its scary because Amazon can push this all over the world and give their tech for free to businesses.

- Other companies will provide this "feature" too.

The one door I was hoping will never be opened is opened now.

View on HN

> tied to the device and not let leak out

there are laws against facial recognition (https://www.msn.com/en-us/news/us/portland-becomes-the-first...)

how is palm recognition different from facial, aside from scanner proximity?

Off the top of my head: cameras are, and will remain, a lot more common than palm scanners.

To play devils advocate I guess you could argue that Facial Recognition is passive. Finger print, and by extension palm, requires proactive participation of the user.

I.e. you choose to hand over your palm to be read, you do not make the same choice in Facial Recognition scenarios.

What if the palm recognition is done without the person's knowledge via camera? Fingerprinting can already be done at a distance. Here's a story about it below from back in 2011.

What if the technology is built into door handles or other objects that require active use?

As soon as there is an incentive to scan people's palms, technology will be implemented or created to do so. However, Amazon has no incentive to let the public know if there's evidence of multiple people with indistinguishable palms, the rate of false identifications, or other shortcomings of the software.

https://www.technologyreview.com/2011/01/14/197589/fingerpri...

This is not true at all. One of the reasons fingerprints and DNA are so valuable is that they are left behind by people as they go about their business, and you can go in retrospectively without their knowledge and collect their biometrics.

There's also this gem in the FAQs:

> If I decide I don’t want to use Amazon One any more after signing up, can I delete my biometric data?

> Yes, you can request to delete data associated with Amazon One through the device itself or via the online customer portal at one.amazon.com. We believe customers should always be in complete control of when and where they use the service, and we designed Amazon One with this in mind.

Maybe I'm paranoid, but that FAQ feels like it was worded by Orwellian doublespeak experts:

- you can "request" (thank you for granting us permission to make a request of you)

- data associated with Amazon one (all the data or only certain data? Do you keep data that's not associated with an account but maybe still associated with my identity?)

This is why we need laws like the California CCPA and GDPR to be in more places. Regulation with high penalties for not complying is the solution here.

yeah it doesn’t take a tech or legal genius to suss out that this wording leaves the door to fuckery wide open.

Also, what about false identifications?

With Face/TouchId it’s authentication, not identification (as there’s only one identity associated with the device).

What’s the fallback here for “twin palms”?

I guess those unlucky people will have to swipe in using traditional methods?

Or just keep buying things the other guy will be paying for...

This is the door you didn't hope was opened? So many other more terrible doors are open. Not saying this is great. But look at what social media is doing to the social fabric. This is just shopping.

I would caution against such statement “this is just shopping”.

Social media also used to be underestimated in the damage they can do. Privacy information brokers are like an Hydra, you cut one head, 3 new ones grow... and before you know it, your biometrics, bed time conversations, source of news, children habits... are up for sell because someone thought “it’s just X“ and underestimated what someone else can do with all the data they collected.

I believe we need to change our optimistic attitude when it comes to individual privacy as we are nothing if not seeding the world of tomorrow, the world of the generations to come.

Purchasing behavior is literally what drives and directs the world today.

Reply on news.ycombinator.com