Facial recognition technology is everywhere, and it may not be legal

Although at least in Germany this will collide with masking regulations (you are not allowed to mask in public gatherings).

https://en.wikipedia.org/wiki/Gait_analysis

> They'd rather carry around an ID that can be stolen, copied, and sold on the black market thus ruining their financial livelihood for the rest of their lives than switch over to a more reliable biometric based method of identification

That's a problem with the financial institutions, not a problem with privacy. Reliable biometric identification is not a requirement for safe finances.

Credit bureaus having way too much power over the lives of individuals (see, privacy!) is as big a part of the problem.

Using that data to track users in the shop is not. That's just Big Data.

If you're also interested in hot spots around the shop to optimize ways and where to present high value items, those can be obtained through different means (eg. light barriers that simply count and send accumulated data every 10 minutes - no need to infer where any given customer has been at any time).

When wondering about "ID that can be stolen, copied, and sold on the black market thus ruining their financial livelihood for the rest of their lives", there are several ways to approach it. One of them involves making loss of ID instruments a less severe event.

"ID theft protection services" is a business model I've only seen in the US.

It's not privacy that's broken, but lazy and unambitious business models that collect data first and think about how to use it second, and tolerate that abuse of that data leads to horrible outcomes every now and then (as long as it's on somebody else's dime).

So your concern is that privacy gets in the way of commercializing biometric technology. May it do that for a long, long time.

And you can't take them away from other people, nor revoke them when they are "compromised". In particular for faces and voices, they can be used to identify you without your knowledge and consent. That means they can be used to discriminate against you on whatever basis the discriminator chooses. This may just be price discrimination, which is what people are concerned about in the retail context. Or it may be more extreme. You could use it to deny job applications or credit to anyone who'd been at a political demonstration filmed by police, for example.

https://www.opendemocracy.net/opensecurity/val-swain/disrupt...

We have enough trouble with the simple human-recognisable biometric classifier of "race" being used to discriminate against people.

Not the first time I read this. It seems that in USA the identity theft issue is a very big one... even someone knowing your bank account number is hugely risky, from what I read. This not need be like this, there are other countries where this is adequately protected by law.

In Europe is normal for small businesses to publish their bank account so people can send them the money of a purchase, and that does not put them in risk. Also, for me it is unheard of that someone had a problem because his/her ID got stolen. Credit cards? Ok. But ID?

Is it a law issue? A financial industry one? (Another poignant thing for me is the degree to which US, France and other countries still use the cheque, or the problems to pay with international cards - visa / mastercard / amex - in Germany).

I am picking on poor Zuck here but we all know whatever wealth gets generated from biometrics is going to land up in the hands of the few who already own all our data.

It's also the case that fingers, voice and eyes can be taken from a person. It's a brutally violent act, but it's quite possible. Maybe not in way that is useful in attacking biometric security, but think denial of service...

What we need is to take the thin concepts around publicity rights and expand them a bit. So for instance, Walmart probably has reasonable business reasons to track purchases, but society can push back and say that they are not allowed to publish those observations without the permission of the observed (or at least clear notification).

I'd rather have my ID token stolen than my finger chopped off.

A quibble, but perhaps not a minor one. Privacy and anonymity are not the same thing. While it's possible to argue that the U.S. constitution confers a right of privacy, I am not aware of any serious argument that it also confers a right of anonymity.

> Privacy as we knew it is dead

I wonder if the next round of physical criminal technology advances will be about shielding and forging identities, using fake fingerprints (3d printed, perhaps), fake contacts (again, perhaps 3d printable?), fake faces (again, perhaps 3d printable, plus makeup?), fake gaits/comportment (which can be disguised or imitated, with enough practice).

And where that's not practical, like DNA evidence at crime scenes, there will be countermeasures. The second episode of Almost Human comes to mind, with its passing mention of "DNA bombs" that shower a room with what I expect was imagined as lots and lots of dna snippets, or perhaps rapid-growing bacteria or fungi with many engineered variants of human STR loci to FUBAR PCR analysis.

If, instead, there were limits on what could be shared and companies were credibly liable for misuse, breaches, etc. I think many people would be far less concerned with use of information.

> Your face, your voice, your fingerprint, your iris, all of these things cannot be spoofed and are uniquely yours and cannot be taken away from you.

Conversely, this illustrates how important it is to have massive penalties – on the scale of “you are out of business and managers cannot have a position of authority involving personal data for years” – for storing biometric data because there's no way to recover when it's compromised. This is particularly important when you realize that biometric data cannot be trusted over a network connection so there's no point in deploying biometric systems anyway because they can only be trusted when one entity has end-to-end control over the entire system.

What should be deployed is PKI which, unlike direct biometrics, can be made robust against compromises using a revocation mechanism. This also allows biometrics to be used safely because you could have an authenticator which uses biometrics which never leave the device and has no replay value for an attacker once a compromise has been discovered.

Consider the recent breach at the U.S. Office of Personnel Management. The attackers reportedly got everything listed on background and security clearance applications, which burns every common authentication system because the attacker could easily answer most “security” questions. Consider how much worse that would have been if biometrics were in common use and scans of fingerprints, voice or iris patterns, etc. were also available to the attacker.

And that is the crux of the issue. It needs to be made a right and enforced like every other right. The problem is that it isn't and it is like the wild west when it comes to people's privacy and data. Given the rapid rise of big data and the surveillance state I would say that a time of flux is just starting. My sincere hope is that it ends with strengthened rights for the individual. I am not convinced it will, however.

One common failure of biometrics is that they often fail to work reliably and then you have to offer a feedback mechanism that offers really low security. Security is always only as strong as its weakest link.

http://arxiv.org/abs/1412.1897

Not to mention bio-engineering possibilities on the horizon. Of course, just because we can use a certain technology doesn't mean we should...

Maybe I'm misunderstanding your focus here, but face, fingerprints, iris and voice prints have all been spoofed - some of them trivially easily. Fingerprints are particularly problematic as you leave them on most things you touch. Fingerprints have been lifted off of objects and fooled scanners with apparatus as everyday as gummi bears...