Slashdot Mirror
Do You Own Your Own Fingerprints? (bloomberg.com)
Slashdot reader schwit1 quotes an article from Bloomberg: These days, many of us regularly feed pieces of ourselves into machines for convenience and security. Our fingerprints unlock our smartphones, and companies are experimenting with more novel biometric markers -- voice, heartbeat, grip -- as ID for banking and other transactions. But there are almost no laws in place to control how companies use such information. Nor is it clear what rights people have to protect scans of their retinas or the contours of their face from cataloging by the private sector.
There's one place where people seeking privacy protections can turn: the courts. A series of plaintiffs are suing tech giants, including Facebook and Google, under a little-used Illinois law. The Biometric Information Privacy Act, passed in 2008, is one of the only statutes in the U.S. that sets limits on the ways companies can handle data such as fingerprints, voiceprints, and retinal scans. At least four of the suits filed under BIPA are moving forward... Under the Illinois law, companies must obtain written consent from customers before collecting their biometric data. They also must declare a point at which they'll destroy the data, and they must not sell it... "Social Security numbers, when compromised, can be changed," the law reads. "Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
There's one place where people seeking privacy protections can turn: the courts. A series of plaintiffs are suing tech giants, including Facebook and Google, under a little-used Illinois law. The Biometric Information Privacy Act, passed in 2008, is one of the only statutes in the U.S. that sets limits on the ways companies can handle data such as fingerprints, voiceprints, and retinal scans. At least four of the suits filed under BIPA are moving forward... Under the Illinois law, companies must obtain written consent from customers before collecting their biometric data. They also must declare a point at which they'll destroy the data, and they must not sell it... "Social Security numbers, when compromised, can be changed," the law reads. "Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
The government can take your things, your land, and your life rather easily. You are just a pawn.
Once it's put into the system just assume everyone has access to it.
Just because it's supposedly secure now doesn't mean someone wont in the future get in.
I'll give you my fingerprints when you pry them from my cold, dead hands.
Do café's need to get permission to take your entry glasses? Do photographers need permission to photograph a person's face and eyes?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
But unfortunately there was a "breach" the other night, and it's all gone*..
The check is in the mail :-)
*Same MO for weapons transfers in the middle east to the "rebels".
“He’s not deformed, he’s just drunk!”
They'll accuse you of stealing your own identity.
In the EU the data is private and must be handled privately. It can also not been transported out of EU, except in other save countries. Surprisingly due to the PrivacyShield treaty the US is declared to be save. Unfortunately they have no such standards.
Currently, that appears to depend on where you live and the laws of that land.
If a fingerprint is recorded as a pattern, can you own that pattern? The answer is no. Practically and legally in the US.
Then an alternate pattern (approximation) will be used and so on...
What about your DNA sequence? What about your hair after a haircut? The answer is no over a long enough time period. Nothing about you will be deemed to be owned by you until the state has ruled it so and then the state ignores that ruling anyway in the interest of convenience or justice or whatever reason dejour until the concept fades. Get used to it, make your money where you can in the meantime, copyright your fingerprints.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
your fingerprints AND your DNA are subject to collection/confiscation/confinement.
Next day you died. Did it help you.
Fingerprints, DNA, etc. If companies abuse it you sue their face off.
Well, it is entirely clear what rights people have to protect their scans of their retinas or the contours of their face from cataloging by the public sector: none right now.
What a bloody stupid question. Of course I do.
Nuff said.
The FBI certainly has no intent to limit their access to just your fingerprints. See for instance https://privacysos.org/blog/fb....
Got that link from this interview here http://scotthorton.org/intervi... .
So I don't know what currently happens to the fingerprint you're using to log in but I'm pretty sure it's soon all going into a central database - and from there to other databases of people with nothing but the best intentions.
Authentication tools? If company X has your fingerprint data to "secure" your data (and does so poorly) - what happens when they get hacked and that data is used against company Y and Z? You can't request new fingerprint or biometric data
Fingerprints should never be shared with any other party unless mandate by the law, like after being convicted of felony and being jailed.
Actually, this whole race for biometrics security is flawn. What parties want, is a way to make sure you are who you claim you are. For that purpose, they do not need to store your actual fingerprints to compare and match. They just need a digital signature which you can conveniently produce from your fingerprints without sending the fingerprints or features of your fingerprints. The same way you can encrypt a password with a one-way function, you can encrypt your fingerprints + some credentials from the party requesting the digital signature. This way, the digital signature is not a sole function of your fingerprints. Each party will get a different signature depending on their own credentials. They will not receive the actual fingerprints neither and they will not be able to sell it to someone else.
Just making a law to forbide selling, sharing, keeping longer than required fingerprints is not sufficient.
Collecting fingerprints or any other biometric marker in first place should be forbidden.
Achille Talon
Hop!
>"Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
Which is why fingerprints should never be used for biometrics.
Using fingerprints and allowing a third-party to have access to that data is unacceptable. Fingerprints are left everywhere and can be collected and accessed without your permission. Once collected, that data will NEVER be erased or restricted, regardless of claims or laws. They will like go or leak into huge databases and shared between various government agencies and used however they want for as long as they want. With every crime investigation, you will be searched without probable cause.
There is only one safer and practical biometric I know of- that is deep vein palm scan. That registration data cannot be readily abused. It can't be latently collected like DNA, fingerprints, and face recognition can. You have to know you are registering/enrolling when it happens. You don't leave evidence of the biometric all over the place. When you go to use it, you know you are using it every time. And on top of all that, it is accurate, fast, reliable, unchanging, live-sensing, and cheap. If you must participate in a biometric, this is the one you should insist on using.
Example: http://www.m2sys.com/palm-vein...
We all need to realize that IT IS NOT EVERYONE'S BUSINESS WHAT WE ALL DO. And you can't trust latent biometrics with security.
As such it is a do-whatever-you-want for US companies.
lose a finger in an accident... heart attack alters the pacemaker path... lots of ways for biometrics to say you are not you any more.
if this is supposed to be a new economy, how come they still want my old fashioned money?
To answer the question of the original topical question with an actual solution:
Yes, and you should own ALL of your personal information. You should be able to store it where you want it and ANY use of your personal information should be according to your preferences. Retention of someone else's personal information without their permission should be regarded as a crime, and when that information is held without permission by a government authority, it should be regarded as a violation of the Fourth Amendment (in America).
Technically speaking, much of the personal information might require signatures by other parties (to insure that it is not tampered with), but the information should only be accessed and used in accord with your wishes. Requests for the information should require authentication of the identity of the requester and specification of the purposes to which the information will be used, and in most routine cases can be approved or denied by reference to your personal privacy policies. Once the approved information has been used and the purpose has been satisfied, then the copies should be deleted.
Lots of uses of "should" there, but don't hold your breath. The big corporations will NEVER allow that to happen, and even though it is an anthropomorphic lie to attribute any human attribute or behavior to a corporation or government entity.
So before I made that comment I searched for anything along those line. The article has been up for some hours and I think it's an important topic. Unable to find anything of relevance or even a single funny-moderated comment. Where have all the funny and insightful commenters gone? Long time passing...
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
> "Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, [and] is at heightened risk for identity theft."
The very attribute that made biometrics so attractive -- uniqueness -- is exactly the reason why it should be rejected as criterion for establishing identities.
Once you copy a fingerprint (actually, its data) there will be many "yous" everywhere.
Of course, technical people would never think of that (engineers should be forced to go to a Philosophy College, if nothing more to stop them repeating as baboons that they understand logic better than other professionals).
But, as long as they don't find out I'm missing, I should be f....
... hold on, someone is at the door...
Normally, with a question in the title, the broadly valid answer is "No"
But this is an exception.
aaaaaaa
The problem I always had with biometrics, specially in articles saying they should completely replace passwords and whatnot, is exactly that: they are uniquelly identifiable and non-exchangeable. We all know well enough that biometrics are far from being as secure as their evangelists will tell you, plenty of fingerprint scanners have been cracked, yet every now and then I'll read once again in some superficial, when not sponsored, article how biometrics are going to replace everything because they are impossible to replicate and whatnot. Yes, it's definitely harder for an attacker to get your fingerprint rather than guess your stupid "password" or "1234" password. And yes, there has been advances to prevent the most common types of attacks against fingerprint scanners. Here's the major flaw with biometrics though: if attackers ever finds a way to replicate it, that's it. You can't change your fingerprint, you can't change your iris, you can't change your voice speech pattern.... well, ok, you might be able to after some painful procedures, but you get what I mean. Do you own your fingerprints? Does it even matter anymore? At the very least, the government already has it, and last I heard, their security practices are not all that much reliable. It wouldn't surprise me the least to find out there are already leaks available for purchase on some darknet website for less than a bitcoin. It's easier to steal then than most people think. I mean, if people were really interested in compiling a fingerprint database with personal information, I can't imagine it'd be very hard to surreptiously install door handles in a bunch of public places with cameras that will take your fingerprints, a shot of your face, and then easily find who you are using some image/gps search. The only thing fingerprints are good for are convenient locks (having in mind that no lock is absolutely secure). For good security, you'll always need extra independent steps. It's always about making it hard enough for attackers that they will end up not bothering, going for the next easier target...
It would seem that biometric information should be treated very similarly to any other set of facts. Why we do have restrictions like for libel, slander, obscenity, sedition, classified information, copyright , trade secrets, non-disclosure agreements, perjury, etc. It would seem that restricting these kinds of facts should be judged with heightened or strict scrutiny.
* a compelling governmental interest
* narrowly tailored
* least restrictive means
I'm not sure if the government has a compelling interest in abetting the fiction that biometrics can be reliable used as authenticators and not merely identifiers.
I'm also not sure if it's narrowly tailored enough.. HIPPA is tailored for only some businesses for instance.
And there fucking SHOULD be laws in place for all of it. It's time to end the separation of digital rights/real world rights. What a ridiculous yet important question! Surely we are not this incapable of moralistic and critical thought these days.