Slashdot Mirror
Fingerprint Requirement For a Work-Study Job?
BonesSB writes "I'm a student at a university in Massachusetts, where I have a federal work-study position. Yesterday, I got an email from the office that is responsible for student run organizations (one of which I work for) saying that I need to go to their office and have my fingerprints taken for the purposes of clocking in and out of work. This raises huge privacy concerns for me, as it should for everybody else. I am in the process of contacting the local newspaper, getting the word out to students everywhere, and talking directly to the office regarding this. I got an email back with two very contradictory sentences: 'There will be no image of your fingerprints anywhere. No one will have access to your fingerprints. The machine is storing your prints as a means of identifying who you are when you touch it.' Does anybody else attend a school that requires something similar? This is an obvious slippery slope, and something I am not taking lightly. What else should I do?"
Start looking for another job..
I'm sorry, I can't hear you over the sound of how awesome I am.
Its a time clock. Many jobs have them along with your address, phone number, date of birth, and social security number. Welcome to the working world. I could just as easily steal your fingerprints from your car door handle or the can you threw in the trash. After this fiasco don't expect the job offers to roll in.
Only the State obtains its revenue by coercion. - Murray Rothbard
As long as you are assured that your privacy is protected...this is a huge non-issue. Fingerprint scanners are the best (In terms of ease of implementation) way to prevent people from clocking in and out for each other, even though they are obviously easily defeated by anyone sufficiently motivated.
Same as the old one... My wife's workplace has this system. Works terribly but somehow it got past some CxO. Not sure if the privacy issue is a big deal however. You train the system in the system (if it's the same one). The print doesn't go out to the big Gov.
Not saying that they couldn't do that, but you do realize (being an aluminum foil shielded card carrying Slasdotter) that 'they' can get your fingerprints, DNA and bog knows what else without much of a problem these days.
Hell, at least it's pretty unlikely to show up on Facebook.
Faster! Faster! Faster would be better!
Apparently what it is storing is a statistical summary of the biometric information (if that's not redundant). It doesn't store the fingerprints themselves anymore than an operating system will store your password. With the password, whatever you type in has to have a hash which matches the hash associated with your account. With the scanner, the summary generated each time you plop your hand on the scanner has to match (to a significant degree) the summary on file.
But, yes, if someone finds your fingerprints somewhere else, and they have access to this data, they can be reasonably certain it is you.
My other car is a 1984 Nark Avenger.
Not many posts yet but I already see a LOT of posts pushing the idea of not working for this employer. This is not a solution. If we don't fight it and win, it will be adopted by more and more employers until it snowballs into something too big to fight. If we think this is a bad idea, it needs to be fought now while it's still in its infancy.
I am in the process of contacting the local newspaper...
Are you for real? Other than than the fact that they likely won't give a rats ass about this, you are treading on very thin ice. I'm not sure what it is you're planning on doing after graduation, but being labeled a well-known whistle-blower isn't going to do you much justice when you're out looking for a job.
I installed these at a client.
The issue was the employees would take an afternoon off to go to an appointment, and get buddy to clock them out at the end of the day - The emplyoee would then get paid for an afternoon they didnt work.
The time clocks have a fingerprint scanner. You place your thumb on the device as you punch out. Now buddy cant swipe out for you, and you cant defraud your employeer.
They also had biometric locks instead of prox cards on the doors. Much more convieient then having to remember a card the few days when i was on site.
All they have to do is get your fingerprint from something
like your finger? Look, if "they" want your fingerprint, they're going to come get it from you. If you're a suspect you will be fingerprinted. This time clock is not connected to a federal black-helicopter database, no matter how exciting that might be.
making a stink about something trivial like this makes legitimate privacy concerns look bad
Literalism isn't a form of humor, it's you being irritating.
Safety means you won't get your finger chopped off by someone who wants to impersonate you to enter the building.
Safety (for people) is higher when there's no biometric system in place, becaus the bad guys don't have an incentive to chop their fingers off or gouge out their eyes.
The purpose of this device is to keep people from cheating on their hours. You can get all Big Brothery all you like, but there is one and only one technology that can reliably ensure that people come to work and do the jobs they're paid to do.
It's called "management". The way it works is, you know your employees' names, you stop by their workstations, both to help them with problems they're having and to check to see that they're doing their jobs. You build up a culture of trust, so that when they need to leave work they *tell* you, and you arrange for them to make up the time.
Or you can treat them like condemned criminals, and let them be monitored by machines while you sit in your throne of an office eating donuts and browsing bmw.com. It's really up to you.
Wouldn't work, for technical reasons.
Both major algorithms need to be able to compare the data from an authoritative database against the test sample.
The reason for this is no two scanners, in fact even the same scanner will not produce identical results for the same fingerprints. There will always be "fuzziness" to the data that the algorithm must interpret.
You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
This leads to the principle flaw of biometrics: If someone manages to reproduce the key (synthetic fingerprint for example), there is no way to issue a different key to the owner of the original. Anywhere you authenticate with a fingerprint, the people who control the system can gather all information which is needed to create a fake fingerprint, plus there are countless other ways to get a person's fingerprint, and you still only have that one set of fingerprints that you can't change. What are you going to do then?
I totally agree with commodore64_love
I don't want the government tapping into my phone, spying on my Internet traffic, or searching through my house without just cause.. but we're talking finger prints here.
And while I do agree.. saying the only alternative is welfare was a little extreme.. you are definitely limiting yourself by refusing to allow any intrusions into your precious privacy.
I suppose some people will accept a lot of money to surrender their freedoms.
This is completely true.. and I think in a lot of cases.. people are better off for it. Everything is a balancing act.. certain jobs (especially government) require a fair degree of background checking.. this is of course an invasion into your privacy.. but you are compensated for it (both financially and in terms of getting to work on some really cool stuff).
It's not about completely selling out your privacy.. but it's not about living the life of a paranoid delusional who thinks the world is out to get them either. It's about finding a balance you're comfortable with.
As someone who has "given up" a lot of privacy in exchange for a very enjoyable career.. I've felt no ill effects from it. What exactly do the tin foil types of the world think the government / Illuminati / whatever .. are doing with this information.. and specifically.. how do they think it's going to realistically effect their lives in an actual concrete way (vice some paranoid "when the commies come back" throb).
Hashing would work if the scanners were taking absolute, binary measurements without error. But they are not, not a single biometrics unit has or can have that sort of precision. If you capture your fingerprint parameters with the same device, with the same process, two or three times in a row, you'll see significant changes in the parameters from one time to the next. While the detection algorithms are designed to cope with such scanning errors, hashing would make relative comparisons fail 100% of the time. And there lies the problem with biometrics: once you use them once (or even before you do), your "parameters" are no longer a secret under your control. If you give your fingerpring parameters to your bank, your school and your employer, each of them can in theory authenticate as you to the others. That's why I always say: biometrics are technically useless as an authentication mechanism. They can be used for identification (replacing your username) but not for validation (your password) because they are NOT a secret, they CAN'T be revoked, you don't have the option to use different ones for different organizations and they are easy to fake. Of these issues, only the last one can be improved with better technology, the rest are intrinsic to the concept.
I agree. I just pulled out my Pennsylvania drivers license, and it has on there my eye color, height, and *sex*.
That's a privacy concern.
OH MY GOD THERE'S A PICTURE OF ME ON HERE TOO
Nope, because the non-voters agree with everything that comes up by default.
"It's such a fine line between stupid and clever" -- David St. Hubbins, Spinal Tap
So first you bash people's legitimate desire for privacy, than you claim to have a legitimate reason for anonymity? You *do* realise, don't you, that anonymity is just another aspect of privacy?
So, either you're for privacy, or you're not, but stop pretending you have a legitimate reason for abolishing it while taking full advantage of it.
Required reading for those 'I've got nothing to hide' people.
Also, perhaps you can explain how somebody chooses not to be born in a particular country?
Not posting anonymously because I'm not scared of what people have to say.
"Necessity is the plea for every infringement of human freedom. It is the argument of tyrants; it is the creed of slaves
This is why fingerprints should be usernames, not passwords.
This isn't a flaw of biometrics so much as it's a flaw of any dongle-based, single-layer security system.
For example, you have the same problem with a door with the same key issued to 1000 people -- yes it technically can be changed, but it's quite expensive, so in practice it's never done. That leads to people who should no longer have access still having access, and the ability to easily copy the key and use the copy without detection.
The solution is trivial. If you combined a password with a fingerprint there would be a secret bit of information that's easy to change AND a physical bit of security apparatus that's harder to reproduce/copy than a password. This same solution also solves the key problem above. And it's the same solution already used in all sorts of applications where security is actually important.
It's not in use for this timeclock system because the problem they're trying to solve is not a high-security application. They're going from the honor system for clocking in to a single-layer physical-dongle security system, likely in an attempt to raise the barriers for clocking in a co-worker. If they were relying on this system to allow you to make changes to your direct deposit account it would be a problem, but for the stated application I don't see why it's a concern.
Now, you could be concerned about them having your fingerprints on file -- I understand the desire to keep people from collecting information about you. But honestly, unless you wear gloves all day long, they could already have your fingerprints if they wanted them; fingerprints are not secret information in the first place.