Would You Submit Biometric Data to Join a Gym?

An anonymous reader asks: "I went to my gym (Rocky River, OH branch) yesterday and there was a huge line of people at the counter. When I went to the scanner to swipe my membership card, I noticed they were training people in the use of their new security system that requires the input of your thumb print. There currently a story on boingboing that mentions a tanning salon in Arkansas that is enacting a similar policy. I'm going to call the gym later today and see what type of security they have on their network. I guess we can look forward to a future where these sorts of personal services clubs require the submission of biometric data. I was wondering how the members here at Slashdot feel about the security risks involved in submitting biometric data to small private companies?"

Comments

No. Thank. You.

[nb caffeine]

I wouldnt be a member of that gym for much longer (or, any gym, really). I wonder if i can copywright my fingerprints, and then charge royalties for anyone who requires a print? that would be sweeet.

Re:No. Thank. You.

[tha_mink]

" I wouldnt be a member of that gym for much longer (or, any gym, really). "

But then, someone could steal your fingerprint without the trouble of hacking some system simply by getting you to hold on to something, for example, a frosty beer or maybe even your gym card.

Re:No. Thank. You.

[Total_Wimp]

I wouldnt be a member of that gym for much longer

I went to check out a nice large brand-new gym near my house. They handed me a form to fill out including a questionnaire and a space for my name phone number and address. I answered a few of their questions and just put my first name on the form.

They mentioned that they'd like me to fill in my phone number and address and I said, "no thank you, I'd like to check out the equipment first before signing up." They told me they couldn't show me the gym without that information. Still thinking we just had a misunderstanding I pointed out that I wasn't there to use the gym, I just wanted to see what they had to offer before signing up. They then proceeded to point out to me that they were prepared to give me a tour, but would not do so without my phone number and address.

I said, "goodbye" and walked out the door. Even my bank doesn't require biometrics and didn't ask for an address before they told me about their features. These fitness center folks are too big for their own britches. Pushups and situps are free and running shoes don't cost that much compared to a gym membership. I'd like to use the gym, but I don't have to and I certainly wont consider it untless they figure out how to be less intrusive.

TW

How secure is their security?

[AndroidCat]

Once they've got your biometric data, how secure are they going to keep it? Unlike a password, it's not possible to change your biometric data if someone steals the gym's files and uses it to spoof other systems.

Re:How secure is their security?

[shaitand]

Latex or geletin successfully fools almost all biometric security devices in use today.

http://www.security-focus.com/news/6717

Re:How secure is their security?

[anthony_dipierro]

It's already been done. There was even a Slashdot article on it. The guy took an computer image and make a mold and use gelatin. Then he put the gelatin on his thumb and fooled almost every finger print device he could find. He could also eat the gelatin off if someone got suspicious.

So why not make a fake gelatin thumb when you sign up? Surely you can find a thumbprint image somewhere on the internet. Then the gym won't have your thumbprint, they'll have the fake one.

It's...um...bad

[tha_mink]

I am fearful regarding theft of my fingerprint or any other biometric information since I KNOW that eventually, someone will steal it from anyone who collects it from me. But then, someone could easily get my fingerprint by following me around for a little while and picking up my trash. Same with DNA for that matter.

Re:It's...um...bad

[sartin]

But then, someone could easily get my fingerprint by following me around for a little while and picking up my trash.

Yes, but following you around is labor intensive and targets you specifically. For less effort (at most small business networks I've seen), a hacker could recovers hundreds or thousands of fingerprints (or other biometric data). This change in scale changes the nature of the problem and removes control from you. Without the biometric data stored in the business computer, the paranoid can wear gloves or dab their fingertips with various substances to disrupt attempts to get fingerprints. That control is gone when the data gets stored on computers owned by various businesses.

Re:It's...um...bad

[Total_Wimp]

That control is gone when the data gets stored on computers owned by various businesses.

Well, not really. It's more like a hash. Unless the people that designed the security sytem didn't have a clue, they wouldn't store reversable fingerprint information at all.

I remember having this discussion with my old boss when he wanted to go biometric a few years ago. He even got ahold of a some fingerprint readers for testing. We found that the industry, and this manufacturer, were very clear on the matter. No one wanted to actually store your fingerprints.

So, feeling confident, he installs the software, plays with it for a little bit and invites me over to try to "hack" his account with my thumb. I put my thumb on the plate and sure enough the device tells me I'm unauthorized... while displaying a giant picture of my thumb accross most of the display.

My conclusion: I believe the companies really aren't storing reversible fingerprint information. I also believe they're doing a lousy job of making people feel confident about this fact.

I think there are enough other downsides that this technology should be condered DOA for most purposes, but this particular issue is probably just a PR problem.

TW

Re:It's...um...bad

[metamatic]

It's more like a hash. Unless the people that designed the security sytem didn't have a clue, they wouldn't store reversable fingerprint information at all.

Well, the problem is I have to trust on blind faith that it's a hash, and that it's different from the hash used by other companies.

It doesn't matter if my fingerprint is hashed to an opaque 0x0116632c51bde43 if every other system made by the same manufacturer will accept that hash as representing my fingerprint. I'm still screwed, because I can't change my fingerprint and can't change the hash.

Think of hashed fingerprints as a PIN tattooed on your finger...

thumbs are useful

[chewy]

Though I feel you are correct for being sceptical about the security of biometrics, I think that the convenience of using a thumbprint machine for entry into a gym is worth the sacrifice.

Better than having swipe-cards that fail after a single wash. (Thumbs are wash-proof!)

But using thumbs as positive I.D. for your bank account is a bad idea.

See?

Re:thumbs are useful

[KronicD]

Yeah... I have dermatitis, basically when my skin is exposed to soap (the skin on my hands is more susceptible to this) it starts to "peel" off and the skin does not recover for 4-6 weeks. I avoid soap as much as possible, the non soap alternatives are quite expensive however.

When I am exposed to soap it causes a lot of problems with fingerprint scanners for me. So yeah, cards are a better option for people with my condition.

Why not go for something like card + hand geometry identification if they're so concerned with people "sharing" gym memberships.

Re:thumbs are useful

[EnronHaliburton2004]

I think that the convenience of using a thumbprint machine for entry into a gym is worth the sacrifice.

Sacrificing your deeply personal information for the convenience of a simple consumer product is plain dumb. Aren't you concerned with security? This is plain sleezy, and it wouldn't suprise me to see "24-hour Nautilus" (Sleezebags) use this scheme in a couple years.

The gym isn't doing this for your convenience. They do it to prevent people from sharing memberships, which is fine, but not when they resort to invasive tactics.

Better than having swipe-cards that fail after a single wash.

What if the thumb print machine breaks? I bet the gym bought some cheap thumb print machine out of the Tiger Direct catalog...

My gym just requires me to flash an ID card. If someone else borrows the card for a day, they don't care too much, and don't require some fascist technique to verify my identity.

Re:thumbs are useful

[Bradee-oh!]

There are other ways to prove identity without sacrificing such fundamentally private information. e.g. At my gym you walk in, they scan your card's barcode, and your PICTURE shows up on the screen and, believe me, they look at you and confirm.

If any argument is made that "well, a hacker could break in and change the picture on record," then you need to realize that it would be exactly as difficult for a hacker to break in and change the thumbprint on record.

The difference is my thumbprint is my own business whereas I already show my face by walking through my front door into public.

Copyright (C) Yourself. Right now.

[torpor]

The only solution is for you to copyright all your details, about yourself.

Someone should fire up a dot-com which allows people to copyright all biometric info about themselves. Yes, it would be a registry. No, it wouldn't be "Big Brother" - the purpose would be to allow any individual worried about protecting their information, to have legal grounds to stand on in pursuing action against any other party using that information inappropriately.

A 'clearing house', or 'group repository of biometrics' database, backed by serious corporate power, with the #1 purpose being the consistent and determined protection of individual members biometric info.

Someone, please do this. Give me a way of registering all of my private details, in a fully legal way, and assign me the copyright to all of that information. So that, from that point on, any other company that wants it, has to go through my corporate 800lb biometric ownership clearning house gorilla...

It might sound odd, but sometimes in life the way you fight something is to become it. We consumericans need to form our own corporations/organizations if we truly want to protect ourselves from other corporations/organizations hell bent on abusing biometric system information.

Something like the person who copyrighted their DNA, only bigger, better, with full disclosure, with teeth, and .. the hard part .. with the money and wherewithal to truly go to bat to protect us in times of violation. Call it a "DNA Cult" if you must, but I think its going to be truly necessary, sooner or later.

My University did this.

[dayid]

I work for (and attend) a State University. Our gym (in 2002) enacted similar policies and equipment. It was *optional* however, and was enacted for people who didn't want to have to carry around a membership-card or student/employee-ID just to be able to get into the gym (since most gym shorts don't have a pockets, and many people on campus just walk to/from the gym rather than driving or bringing a full bag and using a locker). It was an option for about one year, until they realized that the extreme costs of using the hardware and managing it (and its slight errors) far outweighed pleasing a minority of people who attended. It's good to see the technology developing, but I still prefer losing my identity to a bunch of little numbers on a card.

Not feet

[AndroidCat]

If they want your thumb, give them a finger.

Then you have to ask

[Safety Cap]

If it is that easy to steal, what is the value in collecting it in the first place?

If there is no value, they don't need to collect it, do they?

In a word:

[LouCifer]

No. And if the gym the wife and I belong to switches to biometrics, I'll demand a full refund of mine and my wife's membership.

Fuck 'em. We already own a treadmill and the wife's been wanting to buy an elliptical anyway.

Slowly things like this get introduced and the stupid sheeple submit en masse. The more people that stand up and argue with the un- and under-educated about such invasiveness, the better.

Sure, these things may not be so bad yet but this may just be the tip of the iceberg. Give 'em and inch and they'll take a mile.

Once these become the norm, it'll be easier for the government and so-called private "security agencies" to strip us of our right to privacy.

Not a big deal...

[bafio]

As far as I know, biometric devices store only a signature of your fingerprint (like a digest of key points), so the stolen data would be of little use. Moreover they care about security because they normally control access to places.
I would worry more about the other data they could hold on their machines, which could contain more sensitive personal information and could be stored in less secure machines.
There's still a lot of sensitive data (medical records etc.) stored in Access databases and similar by people not really expert on computer security, often in old not updated windows PCs... that scares a lot me more!

I'd like to tell you ...

[cybermage]

but you'll have to press your thumb in the box below to read my response.

I..........I
I..........I
I..........I
I..... .....I
I..........I

Your unquestioning compliance in this matter would be greatly appreciated.*

Thank You,

The Management

* By supplying your thumb print, you agree to abide by our Terms of Service. You may request a copy of the Terms of Service directly from our Corporate Headquarters.

This country was founded by criminal lovers

[Safety Cap]

you'd only really need to be worried if you planned to commit a crime; for non-criminals there's really nothing to worry about.

Damn those long-haired freak Founders and their crazy ideas. If only someone would've told them that innocent men have nothing to hide, they could've avoided making many unnecessary additions to the US Constitution.

Re:Copyright (C) Yourself. Right now.

[GigsVT]

You can't copyright facts. There's no creative process involved with recording the length of various things on your body.

Not big brother

[brian6string]

Alright, everyone take a deep breath here. The idea of a fingerprint to sign in at the gym is there as a customer convenience You don't have to carry a membership card into the place, and then find somewhere to stash it while you're exercising. This is actually a good thing.

And, as someone pointed out already, there is no security concern to be worried about. Even if someone copied their thumbprint database, I mean, what could you do with that? Nada...

The right way to do it

[greenhide]

In the gym in question, it's clear that this isn't being done to heighten security; it's just to keep people from having to drag a gym id around. Also, it's much faster to slam your thumb on a pad than to hold out a card for someone to scan.

But here's how to implement a thumbprint-as-login system and keep people, including the paranoid freaks here at slashdot, happy.

1) Make it optional. Don't want to submit your thumbprint? Fine. Just make sure you always show up with your card.

2) Make it hashed, using a public key unique to that system. That way, the information stored is effectively useless. If a hacker gets in, all that they will be able to do is see a bunch of GUIDs. Whoop de doo.

I'm almost 100% that this is, in fact, just what is being stored. I mean, imagine actually storing a thumbprint. That's got to take up more space, and is really slow and inefficient for data lookup.

Someone more knowledgeable in biometrics, please rip me a new one if necessary.

Re:The right way to do it

[NoSuchGuy]

1) Make it optional. Don't want to submit your thumbprint? Fine.
But if you switch you get a 3% discount and a free drink every month! But you loose a bit of privacy.

That's the way big stores (Walmart&Co) get you to switch to their rabate system. You safe $50 a year. They earn $100 because the sell your data to "data blackhole" companies like ChoicePoint.

How much worth is your privacy?

Don't wait until there is any kind of self regulation in the "data grabbing business".

In Germany the data belongs YOU! You have the right to demand for information regarding your personal data. If the company does not ansnwer in time (14 days) you can inform the data protection officer and he will investigate for you.

Re:The right way to do it

[anthony_dipierro]

So your gym uses biometrics too. I wonder if the slashdot crowd has a problem with this.

Re:At the risk of being offensive... you clowns!

[avi33]

If I wanted you'd fingerprints it would take me approximately 30 seconds to get them unless you're SO fucking paranoid you go everywhere in gloves...You'd be surprised how fast your 93 character password would come out after 30 seconds with a rubber hose.

...or you could just offer the gym's counter-jockey $200 for a backup of everyone's name, thumbrint, ssn, mother's maiden name, and password. The point is, they don't need any of it, for 'ease of entry' or any other reason.

Maybe the thumbprint is superfluous for identity theft at the moment, but it could be valuable in a couple years if bank x starts using a thumbprint as part of their security procedures.

I notice that you valued your privacy enough to submit this comment as an AC.

ask for their data retention and privacy policies

[weld]

If anyone is collecting sensitive information from you: SSN, biometric data, etc. you need to get a data retention and privacy policy in writing.

Will they transfer this data if the company is sold or goes out of business? Remember eToys had a privacy policy that went out the window during bankrupcy. Will they destroy the data when you cancel your membership. What security mechanisms and audit procedures do they have in place?

When you bring it up it may be the first time they have thought of it so be prepared to wait.

-weld

Re:theft of my fingerprint?

[PaxTech]

I'm fearful regarding theft of my finger!

Well, if it goes missing, you can just check all of your local Wendy's franchises. It seems all missing fingers end up in a bowl of chili eventually.

Mmm.. chili. It's finger lickin' good!

Re:theft of my fingerprint?

[stanmann]

You realize of course that the woman who CLAIMED to find that finger is now facing fraud charges right?
here
or here
or here even
another one

In other words.. she's a known con artist, and now she's paying the price for being clumsy.