Slashdot Mirror
Would You Submit Biometric Data to Join a Gym?
An anonymous reader asks: "I went to my gym (Rocky River, OH branch) yesterday and there was a huge line of people at the counter. When I went to the scanner to swipe my membership card, I noticed they were training people in the use of their new security system that requires the input of your thumb print. There currently a story on boingboing that mentions a tanning salon in Arkansas that is enacting a similar policy. I'm going to call the gym later today and see what type of security they have on their network. I guess we can look forward to a future where these sorts of personal services clubs require the submission of biometric data. I was wondering how the members here at Slashdot feel about the security risks involved in submitting biometric data to small private companies?"
Once they've got your biometric data, how secure are they going to keep it? Unlike a password, it's not possible to change your biometric data if someone steals the gym's files and uses it to spoof other systems.
One line blog. I hear that they're called Twitters now.
I am fearful regarding theft of my fingerprint or any other biometric information since I KNOW that eventually, someone will steal it from anyone who collects it from me. But then, someone could easily get my fingerprint by following me around for a little while and picking up my trash. Same with DNA for that matter.
You'll have that sometimes...
Though I feel you are correct for being sceptical about the security of biometrics, I think that the convenience of using a thumbprint machine for entry into a gym is worth the sacrifice.
Better than having swipe-cards that fail after a single wash. (Thumbs are wash-proof!)
But using thumbs as positive I.D. for your bank account is a bad idea.
See?
The only solution is for you to copyright all your details, about yourself.
.. the hard part .. with the money and wherewithal to truly go to bat to protect us in times of violation. Call it a "DNA Cult" if you must, but I think its going to be truly necessary, sooner or later.
Someone should fire up a dot-com which allows people to copyright all biometric info about themselves. Yes, it would be a registry. No, it wouldn't be "Big Brother" - the purpose would be to allow any individual worried about protecting their information, to have legal grounds to stand on in pursuing action against any other party using that information inappropriately.
A 'clearing house', or 'group repository of biometrics' database, backed by serious corporate power, with the #1 purpose being the consistent and determined protection of individual members biometric info.
Someone, please do this. Give me a way of registering all of my private details, in a fully legal way, and assign me the copyright to all of that information. So that, from that point on, any other company that wants it, has to go through my corporate 800lb biometric ownership clearning house gorilla...
It might sound odd, but sometimes in life the way you fight something is to become it. We consumericans need to form our own corporations/organizations if we truly want to protect ourselves from other corporations/organizations hell bent on abusing biometric system information.
Something like the person who copyrighted their DNA, only bigger, better, with full disclosure, with teeth, and
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
" I wouldnt be a member of that gym for much longer (or, any gym, really). "
But then, someone could steal your fingerprint without the trouble of hacking some system simply by getting you to hold on to something, for example, a frosty beer or maybe even your gym card.
You'll have that sometimes...
If there is no value, they don't need to collect it, do they?
Yeah, right.
Damn those long-haired freak Founders and their crazy ideas. If only someone would've told them that innocent men have nothing to hide, they could've avoided making many unnecessary additions to the US Constitution.
Yeah, right.
You can't copyright facts. There's no creative process involved with recording the length of various things on your body.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Alright, everyone take a deep breath here. The idea of a fingerprint to sign in at the gym is there as a customer convenience You don't have to carry a membership card into the place, and then find somewhere to stash it while you're exercising. This is actually a good thing.
And, as someone pointed out already, there is no security concern to be worried about. Even if someone copied their thumbprint database, I mean, what could you do with that? Nada...
In the gym in question, it's clear that this isn't being done to heighten security; it's just to keep people from having to drag a gym id around. Also, it's much faster to slam your thumb on a pad than to hold out a card for someone to scan.
But here's how to implement a thumbprint-as-login system and keep people, including the paranoid freaks here at slashdot, happy.
1) Make it optional. Don't want to submit your thumbprint? Fine. Just make sure you always show up with your card.
2) Make it hashed, using a public key unique to that system. That way, the information stored is effectively useless. If a hacker gets in, all that they will be able to do is see a bunch of GUIDs. Whoop de doo.
I'm almost 100% that this is, in fact, just what is being stored. I mean, imagine actually storing a thumbprint. That's got to take up more space, and is really slow and inefficient for data lookup.
Someone more knowledgeable in biometrics, please rip me a new one if necessary.
Karma: Chevy Kavalierma.
biometrics are LESS SECURE. Repeat this, over and over again. They are trivial to steal (especially fingerprints or DNA - you leave them everywhere) and impossible to change! Lose an ID - get a new one (at my university that deactivates the old one). A password is compromised - change it. Try that with a fingerprint!
so repeat after me - biometrics are LESS SECURE.
Maybe the thumbprint is superfluous for identity theft at the moment, but it could be valuable in a couple years if bank x starts using a thumbprint as part of their security procedures.
I notice that you valued your privacy enough to submit this comment as an AC.