Hacker News Reader

Comment by rzerowan | Hacker News Reader

One thing that i would prefer in biometrics would be that the iris/fingerprints get treated as what they are publicly available and easily obtainable data.

At worst using it a a secret key is similar to using your name as a hidden variable for authorisation, whent it sshould strictly be a identification token.And once leaked you cant revoke it .

Back on topic , a Gattaca type system is unbelievably bleak and when(not if) it is finallly shoved through.It wont take long to foist it on the rest of the planet (see the recent visa requirements viz social media and insane bond requirements demanded of some countries like Mali citizens being asked for $15K per visa application).

View on HN

Absolutely not. That is legitimately beyond insane.

Fingerprints are used for investigating crimes. Giving them the access to this information before hand puts you as being investigated everytime they find a fingerprint at a crime scene.

They haven’t seen those movies.

Imagine someone wanting to frame someone for a crime and using their publicly available fingerprint data to manufacture gloves that reproduce that fingerprint.

Also, the science behind fingerprints is not particularly solid. Fingerprint experts can sometimes disagree on whether a particular print matches or not and even then, it hasn't been proven that fingerprints are unique - it's just likely to be so.

DNA too. Until 2018 it was used here as waterproof evidence until the police managed to lock up an innocent person based on DNA and blurry surveillance camera photos only. He was only exonerated because the real perpetrator was caught by chance and confessed a week later.

The transmission chain that was later identified on CCTV was hand to escalator rail to hand, a 2+ km walk, and finally hand to latex glove.

That transmission chain is fascinating. I haven't been able to find which case this is describing - can you provide any more details?

Biometrics are identification means (including DNA).

They can be used to uniquely identify you, but they're not secret. You literally leave fingerprints and DNA everywhere you go, and obtaining your biometrics is not as hard as guessing your password.

Biometrics should be used for identification, for authentication along with other means (passwords, PIN, device keys, etc), and never for authorization.

It'll be treated just as stupidly as Social Security numbers, and soon we'll have biometric data breaches. >sigh<

Aside: Social Security numbers should be public now, too. That ship sailed a long time ago and it should be recognized.

What if people just publicized their own social security number, and then whenever they had to deal with "identity theft", they just pointed out that their SSN is public information and so it was negligent for the company to believe it was them just because of a SSN.

Just for the record, I think it’s a crazy idea to make things like DNA or fingerprints public. But a social security number is different. It’s wild how in the US, if someone gets hold of your number, they can do so many things with it. I’m from Sweden, and here we have a similar number called a personal identification number. The last digits are not secret but still sensitive. You can actually Google and find out almost anyone’s number if you want to, and it’s used for similar purposes. But it wouldn’t be enough to cause serious harm just by knowing someone’s number. Identity theft happens here too, but for a company it’s not much different from someone just having your name. It’s still a pain, but it’s nothing like in the US where your life can basically fall apart if someone gets your social security number.

Most doctor's offices just use my name and birthday to assume authorization to transfer sensitive medical information. I kinda feel like privacy is massive "emperor has no clothes" aspect of society.

This behaviour is just because their IT system doesn’t allow regular users to search for names, just for birth dates. Then they pick you by name from a list of people with that birthday.

This is nowhere near the only use of the "birthday + name == all info" hack in the US medical industry. It's basically one big giant frat club with shakes and implicit trust all around. Except that it doesn't actually work; you can fake being a doctor to just about any US medical office and get nearly any American's private medical data.

Exactly. This is just snake oil. No idea why I'm getting downvoted for stating the truth: the employee doesn't care about privacy. They don't use the birthdate because they think it's more secure, the ask for it because they have to.

Names are not unique

So what? The person on the counter doesn't care at all about your privacy. They just cannot type your name into a search box, they have to ask for your birth date first before they can select you from a list based on the name that you state afterwards. At least that's the case at many doctor's offices I've been to.

What do you mean so what? How does asking for a name help if it comes back with a list of multiple people with the same name? Adding the birthday makes it (much closer to) unique

Classic take on "identity theft":

https://www.youtube.com/watch?v=CS9ptA3Ya9E

poor netsec aside, at least I don't leave my social security number lying around every time I touch a door knob.

Hey now, at least I'm able to change my social security number and passwords.

Good luck changing eyes.

https://youtu.be/nAttA7gzhOI?t=41

Changing your social security number is only slightly easier. Okay, maybe that's hyperbole. But having your SSN exposed isn't a good enough to be able to change it. You have to show it is actively being abused, and you can't address the problems another way.

Gotta rotate your access eyelenses every 3 months office policy incoming. /s

A coworker from Chile has described their equivalent to a SSN as being used as a public ID rather than a password. Every IT company and government service has the same primary key in their database for each citizen. Wouldn't that be great!

My question would be how do we get there?

Lots of countries use the SSN equivalent as a public ID and sometimes have for decades now. The Nordic countries, for example, often require it on any application that requires your real name. I, as an academic, just put in a grant application to a private foundation, and my number was required there like many other places.

In the US, leak of SSN apparently can result in identity theft and so its public use can seem especially troubling, but other countries use different secrets and processes for identity.

yea, in the US, we use the SSN or the last 4 digits, as a security question, which is why it can lead to identity theft

the goal would be to stop using SSN(4) as a secret

Biometrics can be a secure secret key, as long as there's a trusted guard manning the reader, ensuring that you're showing your real fingerprint / face and not a fake.

Why bother with the scan if you can have a perfect guard in place?

The guard makes sure the biometircs presented to the reader actually belong to the person standing there. The reader identifies who (in its database) the presented biometircs belong to.

Not very secret though, considering that they are publicly visible most of the time. You might as well get your bank PIN tattooed on your face if you think that faces are secret.

> Biometrics can be a secure secret key

Nadela, is that you ? /s

Why should they be publicly available and easily obtainable?

Many SSNs have been compromised already. The jig is up. It was never supposed to be an identity system but organisations keep insisting on using it as one. Even if they aren’t literally publicly available and easily obtainable, they should be treated as such.

https://constella.ai/verifying-the-national-public-data-brea...

Unless you’ve been a hermit or homeless for the entirety of your life, just about anyone can get your SSN from Accurint or TLO for a few bucks.

Sure, in theory Accurint and TLO do KYC. In practice you can find tons of people on various crime forums offering those lookups for a few dollars a pop.

That's not what GP said though.

The point was not to make them publicly available but treat them as if they had already leaked and allowed anyone to frame anyone else.

Visit a bus stop, pick up a stubbed out cigarette, leave it at the scene of your next crime.

You're gonna want somewhere where people are much more likely to have a record and be in the system than a bus stop.

A bus stop in a rough part of town then.

1. Most people already share this data in the form of photos posted online.

2. So people don't treat it as a "secure secret," because we've been down this road more than once before.

That's so stupid. Just because I posted a video on TikTok doesn't mean someone should be able to go to the city's public website, look me up on a yellow page and download my photo id and fingerprints.

That’s not what the poster meant.

What treating this biometric info as public means is that it won’t be accepted as valid proof of identity. Just because you posted a video on TikTok shouldn’t mean that a scammer can take out a loan in your name.

> 1. Most people already share this data in the form of photos posted online.

So most people have a red iris. Problem solved. /s

You don't leave iris prints everywhere you go. Even most fingerprints you leave are unusable for identification. Contrary to what CSI may have taught most Americans, even usable DNA samples aren't a given.

Biometrics aren't "publicly available" let alone "easily obtainable". They're easy to extract from you but this is why extraction and retention of this kind of data should be considered extremely invasive and sensitive. That wallet in your pocket may be "publicly available and easily obtainable" but that doesn't mean we should treat it as such - rather we should make sure it's actually illegal to do so without your consent: that's why theft is a crime.

Reply on news.ycombinator.com