Slashdot Mirror
Your Fingerprint Buys Groceries in Seattle
lildogie writes: "The Seattle Post-Intelligencer reports that a Thriftway grocery store is installing fingerprint scanners that they will use to identify customers." Each customer's payment method (credit, debit) is then automatically applied at checkout. Haven't they seen Charlie's Angels?
If this becomes widespread, then fingerprint laundering would become widespread. Don't hold that drinking glass at the restaurant too tightly - the waiter may decide to lift the prints and sell it to the Mafia for money. So people will start wearing gloves. Buy stock in glove copmanies!
"If we can come up with a payment method where there's no opportunity for fraud, then the fees come down," Kapioski said.
That's what they said about ATM's.
That's what they said about Net banking.
Its all cheap and rosy until its mainstream and then BANG up jump the fees.
The technology might be cool, it may be convienient, but dont be fooled into thinking that it will be cheaper.
I'll think of a funny sig later on
That is interesting once, for some time now, it's known that, contrary to popular belief, fingerprints are not unique. If I can use an analogy, the same applies for network card MAC addresses. Btw, the chances of finding similar fingerprints are greater then MAC addresses.
Now, I wonder why people continue to use non unique data as identification methods. It really scaries me, then I think about the kind of trouble one get get into on these issues.
morcego
No, the main advantage is easier tracking of the customer.
Verifying the identity of the customer would be absolutly key here.
(from the article)
"It takes about one minute to enroll," Kapioski said.
I somehow doubt that these people are carefuly examining multiple forms of identification in less than a minute. Also:
"Employees underwent 15 or 20 minutes of training in the system this week."
The system itself might be secure, but identity theft the issue that it seems to be today, I would be most worried about these "18 year old clerks" that can't be trusted with cash taking a 15 minute training course and being put in charge of registration.
It's beyond me how anyone would trust their biometrics to random companies (or other entities). Hell, I wouldn't trust the government with mine (they can take prints from my dead cold hands).
The problem is, that they are not just creating a "hash" from your prints - they need to store the exact print in order for the recognition to work. This means, any script kiddie lucky enough to get into their database, will have the prints.
The next logical step is, to hook this system up to the feds and interpol (post sept-11 this is not fiction!)
The real problem will be, that people trust technology blindly. When I "check out" of the store, putting my thumb on the reader, and the alarm bells sound (and the big "armed and dangerous, shoot on sight" sign starts flashing), guards, police, whatever, will trust the damn machine.
Now if one could trust that the responsible parties would (and could) ensure "absolute security" around their biometrics systems, there really wouldn't be that much of a problem. But believing that IT departments in regular companies (or even government agencies) who all live with finite budgets will ensure that their back-end systems are un-crackable is naiive.
Luckily, the iris scanning in the airports is still optional (and actually sold at an extra charge, as some sophisticated "luxury" - hah!).
Even using cash can seem unsecure if you are parinoid enough. For instance, you withdraw 50$ from an ATM in the mall. Cross reference that with the purchaces made in the next 50 minutes and then filter anything >$75. They can quickly build a list of possible purchaces which will become increacingly accurate over time. The mall has the ability to do this as they probably own the ATM or have access to the log.
Ok, so now you are to the point where you can no longer withdraw cash form the mall ATM. You may be thinking, "I'll just use the QuickieMart ATM down the street." In time, and with better AI software, the places where you get cash annonymously will shrink. Right now, I consder the counter at my local bank the only place to get cash and not have my name cross-referenced to an ammount and then published to the world. But who knows what kind of deal your bank may have with local merchants. Even if they don't share your info, someone clever enough can find your pay scale, subtract your bills, and target you for specific advertisements based on what you will likely buy. Even knowing that it really isn't difficult for a 3rd party to find out how much free cash you have every month can scare the hell out of you.
I'd rather you do it wrong, than for me to have to do it at all.
Pardon me, but as, for example this document, and multiple others state. Fingerprint ID has a false positive identification rate just under one percent. And gross biometric accuracy of 1:500.
:))
Simple mathematics applied, when the store gets some success, and it's customer base exceeds 500 or let's say even thousand - you are likely to always match someone else's fingerprint.
Sincerely, fingerprints were not made for shopping.