Slashdot Mirror

← Back to Stories (view on slashdot.org)

Twitter CEO Jack Dorsey Says Biometrics May Defeat Bots (duo.com)

Posted by BeauHD on from the cause-and-effect dept.

Trailrunner7 shares a report from Duo Security: From the beginning, Twitter's creators made the decision not to require real names on the service. It's a policy that's descended from older chat services, message boards and Usenet newsgroups and was designed to allow users to express themselves freely. Free expression is certainly one of the things that happens on Twitter, but that policy has had a number of unintended consequences, too. The service is flooded with bots, automated accounts that are deployed by a number of different types of users, some legitimate, others not so much. Many companies and organizations use automation in their Twitter accounts, especially for customer service. But a wide variety of malicious actors use bots, too, for a lot of different purposes. Governments have used bots to spread disinformation for influence campaigns, cybercrime groups employ bots as part of the command-and-control infrastructure for botnets, and bots are an integral part of the cryptocurrency scam ecosystem. This has been a problem for years on Twitter, but only became a national and international issue after the 2016 presidential election.

Twitter CEO Jack Dorsey said this week that he sees potential in biometric authentication as a way to help combat manipulation and increase trust on the platform. "If we can utilize technologies like Face ID or Touch ID or some of the biometric things that we find on our devices today to verify that this is a real person, then we can start labeling that and give people more context for what they're interacting with and ideally that adds some more credibility to the equation. It is something we need to fix. We haven't had strong technology solutions in the past, but that's definitely changing with these supercomputers we have in our pockets now," Dorsey said. Jordan Wright, an R&D engineer at Duo Labs writes: "I think it's a step in the right direction in terms of making general authentication usable, depending on how it's implemented. But I'm not sure how much it will help the bot/automation issue. There will almost certainly need to be a fallback authentication method for users without an iOS device. Bot owners who want to do standard authentication will use whichever method is easiest for them, so if a password-based flow is still offered, they'd likely default to that."

"The fallback is the tricky bit. If one exists, then Touch ID/Face ID might be helpful in identifying that there is a human behind an account, but not necessarily the reverse -- that a given account is not human because it doesn't use Touch ID," Wright adds.

60 comments

  1. Use the Force, Twitter by SuperKendall · · Score: 0

    By "Force" I mean the Shadow Ban engine.

    If you are not a blue check, or not authenticating via touch/face, maybe you get some lower views on your tweets, maybe they only show for 10% of your followers.. something like that. Explain that and it doesn't matter how "easy" the other paths are.

    I still feel like bots will figure out some way around those systems though... also not sure how that works in a world where Twitter themselves have driven people to use the web more by killing off as many native clients as possible - including some of theirs.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Use the Force, Twitter by AHuxley · · Score: 1

      Think of the fun the ads will have with an account linked to a face :)

      --
      Domestic spying is now "Benign Information Gathering"
    2. Re:Use the Force, Twitter by SuperKendall · · Score: 1

      It's not like Twitter (or anyone else) gets any face data with FaceID though... all they know is the system has used biometric authentication successfully with the user.

      --
      "There is more worth loving than we have strength to love." - Brian Jay Stanley
    3. Re:Use the Force, Twitter by AHuxley · · Score: 1

      But they know its one user and a very unique user :)

      --
      Domestic spying is now "Benign Information Gathering"
    4. Re:Use the Force, Twitter by Antique+Geekmeister · · Score: 1

      Think of the sale of data correlated to users that goes _past_ anonymity efforts, that is tied to the same recognizable face even for different user accounts. Think of the sale of such data to foreign governments or criminal organizations, or even to domestic surveillance. Think of the poor security of such data against privileged technical or managerial staff at the companies where the data is gathered.

    5. Re:Use the Force, Twitter by rtb61 · · Score: 2

      The reality of twitter. It only gains attention when it leaves twitter, whilst on twitter no matter the appearance of interaction, just one bird screaming to see how many other birds are listening and every twit lost in the din, as millions upon millions of birds, 'er', idiots scream for attention, most not listening to each other. Hey get one to leave twitter it has some tranction but whilst on there just another empty scream. Which shows you the real value of twitter, basically zero, it is meaningless until it leaves twitter and get broadcast beyond one empty worthless platform.

      Most the the bullshit coming out of Dorsey mouth is just marketing crap to try to inflate the worth of twitter, to create the illusion of meaning in those idiot tweets, it wake makes the lame arse rich.

      You still use twitter than you are a twat. Grow up, it is the internet for screaming kiddies, it has zero worth or social meaning, an advertising platform, whose content is largely ignored, until it is shifted off the platform and they pay people to do that, marketing.

      --
      Chaos - everything, everywhere, everywhen
    6. Re: Use the Force, Twitter by Anonymous Coward · · Score: 0

      This is a brilliant point about tweets meaning nothing until they leave the platform.

      Normally I thunk you are incredibly stupid but credit where credit is due. This likely the best comment on /. in months from anyone.

    7. Re:Use the Force, Twitter by Jane+Q.+Public · · Score: 1

      The day Twitter requires biometrics in order to post is the day Twitter dies.

      Biometrics are generally a bad idea anyway... but for Twitter? Hell, no.

  2. TouchID and FaceID by Anonymous Coward · · Score: 0

    Are good methods

  3. Uhm, no by Necron69 · · Score: 2

    Being an old school fart, the vast majority of my Twitter usage comes while I'm sitting at my computer, not on my phone.

    - Necron69

    1. Re:Uhm, no by sunking2 · · Score: 0

      Being an old fart, nobody will miss you if you can't post any more.

    2. Re: Uhm, no by Anonymous Coward · · Score: 0

      Applies to you as well and 99.9999999 pct of twitter users.

    3. Re:Uhm, no by Mashiki · · Score: 1

      Being an old fart, nobody will miss you if you can't post any more.

      Well let's be fair. If you have a blue check mark, you're probably pining out to be added to a disability list anyway. At least that old fart, has useful skills they can pass down to another generation.

      --
      Om, nomnomnom...
    4. Re:Uhm, no by Anonymous Coward · · Score: 0

      Are you saying there are people who do that?

      There are people who have lives so hinged on someone's tweets that they will be incomplete if they can't suckle anymore?

      Your standard is so high I'm not sure it exists.

      But hey, I have to admit that technically makes you oh so special.

    5. Re:Uhm, no by AmiMoJo · · Score: 1

      Javascript watches the pattern of your keystrokes to see if they are human-like or bot-like. Google Recaptcha does something similar with mouse movements.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
    6. Re:Uhm, no by nevlow · · Score: 1

      Yeah, same. Not to mention I have a tendency to *not* want my face and fingerprints associated with a service claiming to provide you an anonymous voice.

  4. Which part of Privacy does he not GET? by WillAffleckUW · · Score: 1

    Also, biometrics are very very easy to defeat.

    --
    -- Tigger warning: This post may contain tiggers! --
    1. Re:Which part of Privacy does he not GET? by gnasher719 · · Score: 1

      Also, biometrics are very very easy to defeat.

      Says who?

    2. Re:Which part of Privacy does he not GET? by Bobrick · · Score: 1

      Says research on the subject... do you have any other dumb questions?

    3. Re:Which part of Privacy does he not GET? by Anonymous Coward · · Score: 0

      Even if it weren't, only a really stupid person would ever trust these companies with a form of ID that you cant change.
      They dont just leak your data, they sell it.

    4. Re:Which part of Privacy does he not GET? by Anonymous Coward · · Score: 0

      Says the vendor when s/he guarantees fuckall.

    5. Re:Which part of Privacy does he not GET? by ShanghaiBill · · Score: 0

      Says research on the subject... do you have any other dumb questions?

      Biometrics are widely deployed. How many in-the-wild exploits have there been?

      Despite the research, in practice biometrics have proven to be more secure than PINs or passwords. About 5% of debit card holders write their PIN on the card. Biometrics work well even for stupid and careless people.

    6. Re:Which part of Privacy does he not GET? by Rockoon · · Score: 4, Insightful

      Biometrics are widely deployed.

      So was snake oil.

      --
      "His name was James Damore."
    7. Re:Which part of Privacy does he not GET? by Anonymous Coward · · Score: 1

      Biometrics are widely deployed.

      That says nothing. Windows is a bad idea done badly, and it's the widest deployed desktop emulation software around.

      The popularity of biometrics is basically due to hollywood, blanket endorsements via vendors (and vendor-"knowledge"-certification), idiot politicians, lobbying, and all the rest of the zoo promoting bad ideas. There's money to be made selling the gadgetry. And it looks spiffy, with blinky lights and the memories of those dressed-up props in hollywood movies. Zoom-zoom your hand is scanned just like on the big screen. Those facts don't make the peddled goods safe or secure.

      In fact, there are strong indications that these things get deployed without adequate testing. Including in highly sensitive applications. Manchester airport comes to mind. Very interesting report about how well the automated passport-reading face-recognising gates performed... or rather, didn't. Either they didn't work or they didn't usefully discern, say, the husband and wife who'd accidentally swapped passports. Yet this crap was allowed into production without a human providing backstop for the machinery's mishaps.

      Of course, this sort of thing is rather common in "high security applications such as airports", like with the pervy scanners. They're really pervy, complete with snickering TSA goons in dark rooms, but they are easily fooled if you know how they work. Conclusion: The machinery isn't about actual security or public safety. It's about something else.

      How many in-the-wild exploits have there been?

      Plenty. That we know of? Also a bunch.

      The Aussie kids with the gummi bears, the Brazilian doctors with latex fingers, Merkel's and Schaueble's fingerprints complete with insta-copy kits, the bbc reporting on the guy getting his finger chopped off as well as his car stolen, and so on. That's just the stuff I remember from the top of my head.

      So yes, biometrics are easily defeated. Just holding up a photo or another mobile phone playing a bit of video of the other guy will do fine, often enough.

      Despite the research, in practice biometrics have proven to be more secure than PINs or passwords.

      That requires a lot of cherry-picking. First off, biometrics involve no secrets. They're somewhat usable as noisy, shitty, username substitutes. They're convenient and showy, but utterly useless, as password-substitutes.

      About 5% of debit card holders write their PIN on the card. Biometrics work well even for stupid and careless people.

      PINs are fantastically weak passwords. And yes, there'll always be people you can't really bother with even those. But that doesn't mean the approach is a silver bullet, or even apt for the majority of your intended audience.

      So you claim 5% of the general population are "unbotherables". Endorsing biometrics means you just fucked up security for 100% of the user population, justified by pointing to your claimed 5% unbotherables. You could have not entirely stupid security for 95%, but you endorsed privacy-hating stupidity for the 100% instead.

      Worse, biometrics means taking nigh-irreplaceable bits of public(!) information and making like that's usable as a shared secret. It means you're making the user expendable: Gets compromised, cannot be recovered, kick'im out of the system to preserve the system's integrity. At the cost of the user, but hey, no skin off your nose, eh?

      Wait, what, hating on privacy with public information? Yeah. That's the problem with privacy. It's elevating formerly-innocuous public stuff like your fingerprints (you leave'em everywhere) or your likeness, and tie lots of sensitive stuff, like access to your bank account, to that. Suddenly the innocuous stuff is no longer innocuous, but carries consequences.

      Forgetting a PIN is benign by comparison, as you can recover from that. Miss Chinese Tech CEO got publicly shamed for jaywalking because her likeness was on the side of a bus. Consequences.

    8. Re:Which part of Privacy does he not GET? by Anonymous Coward · · Score: 0

      Look at what he wants to do: he wants a biometric identifier, which may or may not be verified against anything, to verify what people are doing on the internet.
      This will not stop any bot. Asking for ID does not mean that the ID supplied will be valid, correct, or that it came from a human.
      I see this as a way of being able to tag what everyone does on the internet, and make it a viable way for enforcement agencies to link people to actions on the internet. I don't believe this is something that people want. I do believe it is something that governments and companies want from people.

    9. Re:Which part of Privacy does he not GET? by Torvac · · Score: 1

      afaik only retina scan isnt defeated yet ?

    10. Re:Which part of Privacy does he not GET? by dissy · · Score: 1

      Biometrics are widely deployed. How many in-the-wild exploits have there been?

      So long as you are willing to count "incorrectly implemented" as an exploit, then there have been countless exploits.
      This sounds like one of those times.

      Think about it, he wants to take an actual biometric - something humans have but bots don't - and interpret that biometric through an electronic reader device (be it fingerprint sensor or camera or whatever) to convert it into a series of bits to transfer over a network - something bots can do perfectly well.

      Biometrics work OK as a form of identification when you have a full chain of trust between the use of the reader and *all* hardware up to the point the identification is used.
      "Trust" in this sense means trusted by Twitter, not necessarily trust involving you. A twitter owned and controlled reader, electrical connection, processor, and server.

      TouchID and FaceID have this, as Apple tightly controls all of the hardware in their device and makes it as difficult as possible for anyone else to get their fingers anywhere inside the this chain of events. (pun not intended)

      Short of carrying around a twitter built security device, this simply can't work.
      And if they are willing to go that far and issue security devices, why not just use a self-destructing-on-tamper certificate key / smartcard style fob and just skip the biometrics all together?

    11. Re:Which part of Privacy does he not GET? by Anonymous Coward · · Score: 0

      >which part of privacy does he not get?

      What makes you think communist faggots from California give a fuck about their users' privacy?

  5. lol what the fuck by stonecypher · · Score: 1

    i honestly feel like jack dorsey is just flailing at this point looking for a way to not pay people to just sit down and get rid of the creeps

    biometrics won't solve anything. nobody has or wants the devices. i'll leave twitter before i start giving them my biodata, and i almost guarantee everyone else will

    this just comes down to twitter can't accept that their absurd extremist free speech stance leads to constant abuse and a dramatically limited platform

    --
    StoneCypher is Full of BS
    1. Re:lol what the fuck by Anonymous Coward · · Score: 0

      The creeps are the reason Twitter exists.

      It's full of people with blue checkmarks that call for the death of certain people/groups and get celebrated for it, not banned.
      Then those people have a bunch of peon followers (mostly bots). That's what Twitter sells to advertisers and investors.

      I don't know who keeps giving them money, because it's been well known for years that Twitter is almost all bots, and beyond that a cesspool of liberal hate and bigotry.

    2. Re:lol what the fuck by Narcocide · · Score: 1

      Well if they just blocked all traffic from outside police jurisdiction, and blocked all traffic from known/obvious anonymous relay services like proxies and vpns, etc., whatever else slipped through would be within reach of either hiring staff to moderate by hand.

      But then, advertising revenue would plummet too...

    3. Re:lol what the fuck by Anonymous Coward · · Score: 0

      extremist free speech stance

      Well then I hope you never have an opinion that The Party disapproves of.

      The fact that you even care about giving up the biodata in the first place means you worry about that. Yet, you'd gladly implement the requirement just to silence your own personal enemies even to your own determent.

      What a sad place the US has become.

      Captcha: backhand.

  6. Censorship and an internet ID by AHuxley · · Score: 1

    Why all the need by social media to control what people read and think in free nations?
    People are sharing their own links and self publishing their own ideas.
    The content on social media is user created.
    Let the users create, share and link as they want.
    Should a social media site want to be a news publisher they can do that and have no comments.

    What happens when someone publishes a comment found to be blasphemy? A user who wants to publish about the 1989 Tiananmen Square protests?
    To share a funny meme about a politician who gave a short speech?
    Now that needs an ID approved by social media? An ad company gets to look after a persons ID?

    How about going back to freedom of speech, freedom after speech and the freedom to publish on social media.

    --
    Domestic spying is now "Benign Information Gathering"
  7. Great by Bobrick · · Score: 1

    Good news for any moron who has a Twitter account and a phone with FaceID or a goddamn fingerprint reader, I guess?

  8. Anonymous Speech is Free Speech by Anonymous Coward · · Score: 0

    This isn't about bots. This is about making sure that the message stays on track.

  9. yes, but by Anonymous Coward · · Score: 0

    bears beats battlestar galactica

  10. That's incredibly stupid. by fuzzyfuzzyfungus · · Score: 2

    Does Dorsey not understand how 'biometrics' are used in this context? You don't send a picture of your fingerprints/retina/whatever to the remote host(indeed, doing the processing on-module so that the main OS never gets a crack at the data is a feature you typically brag about on your spec sheet if you've avoided cheaping out enough to support that).

    The biometric widget is just used by the local device as a mechanism for controlling whether or not to unlock the actual authentication material(whether it's just a tepid shared secret in the case of a password manager or one of the fancier FIDO/etc. cryptographic things).

    Now, the part of this plan that might work would be coupling it with a platform that (in a feature technically unrelated to biometrics but probably implemented in the same securi-SoC) doesn't use something generic like a password; but includes an element that's hard to spoof without access to a slightly expensive device. Like, not terribly hypothetically, a private key or device certificate signed by the platform vendor. This has nothing to do with biometrics whatsoever; but it could make it much harder to just spam new accounts without also finding a source for extremely cheap TPMs or iphone secure enclaves or the like to pop up as a new device.

    1. Re: That's incredibly stupid. by GrahamJ · · Score: 3, Insightful

      You seem to be the only commenter that understands the technology. The problem with current authentication APIs is that all they can do is store and compare provided tokens. Itâ(TM)s up to the app to report back to servers what the result was, and thereâ(TM)s no way for the server to verify that any of it actually happened.

      What would be needed is a new API where the app makes a call and receives back a unique token (perhaps a random per-app ID signed with an Apple private key). The server could then make a call to Apple servers to verify the token is authentic.

      This way Twitter receives no user-specific information but can verify that a biometric capture took place.

    2. Re: That's incredibly stupid. by fuzzyfuzzyfungus · · Score: 1

      Unless he's really just an idiot; or (probably correctly) assuming that this proposal sounds just plausible enough to be held out as a 'twitter, actually has a plan it's totally working on to not be a bit farm forever' fluff proposal to mollify people for a while; I suspect that something like what you propose is what he would really like(though biometrics would be of limited relevance of platform vendors were to give it to him: something that ties login/account creation attempts to relatively expensive hardware would also ruin the economics of bots).

      Qhe big question would be if platform vendors(basically read 'Apple', since knocking your app off iOS over the issue probably isn't happening) will want to play ball.

      They certainly could, architecturally. In the Apple case I think Apple-blessed client authentication certs are already a big part of APN(if memory serves that's one of the obstacles that has scuttled any serious effort to get iMessage and FaceTime working in non-blessed areas(I think they haven't fully closed it off on hackintoshes, though it already requires plenty of fiddling and wouldn't be a huge surprise to see getting the axe properly, against any attack short of dumping keys out of the T2 chip from an actual Apple device once Apple phased out the models that don't have one of those). The PC and Android sides are more chaotic; but anything with a TPM(implementing a piece of software that behaves according to the TPM spec is quite doable and basically all the recent hypervisors support doing so; but obtaining a supply of private endorsement keys signed by one of the vendors 3rd parties will trust? Not so simple, which is what makes remote attestation toothy and could be used to prevent client activity not tied to actual hardware the bot herder would have to purchase or compromise) could add a hard to clone device-unique element tothe authentication process; as could many common 'trustzone'-implemented things, though there's less uniformity there.

      Not as obvious that they would want to. Unless handled rather carefully doing so would be handing every random app-slinger a persistent hardware GUID with robust cryptographic backing(which, if the clampdown on IMEI scraping is anything to go by, they aren't entirely happy with); and it would also mean making available to 3rd parties an advantage that they currently enjoy themselves: if you want to sell your own account system as a de-facto standard for 3rd party services(and reap the ecosystem lock in and sweet, sweet data) that would be a powerful selling point: why let Twitter and such enjoy that for free when you could, instead, tell them that they can roll their own authentication and accounts, and fight bots and such; or bow to Apple IDs and enjoy assurances that logins are being made under controlled circumstances(untampered hardware whose platform key hasn't been burned as cloned or stolen, from a user who has recently performed a biometric authentication, etc.)

      That's something valuable enough that he won't necessarily see vendors tripping over themselves to offer it as an agnostic API of some sort just to make solving his not problem easier. Platform vendor exploitation of the ability to do that would also get pretty dystopian pretty quickly; but that's not really a reason to think it won't happen.

    3. Re: That's incredibly stupid. by GrahamJ · · Score: 1

      All good points, thanks. Food for thought.

      I still think there could be benefits to the biometric option. If it was only a matter of creating an account on approved hardware I could imagine a truckload of iPhone 5Ss and a room full of cheap labour being an effective account generation scheme. If it was per-post but based on a per-install token that would solve that problem but would make using multiple devices difficult, especially while maintaining anonymity. And that's already possible.

      A per-post biometric scan has the benefit of Twitter not relying on a particular biometric scheme, not needing to save any kind of per-device token in the user profile, and also not incentivizing device manufacturer federated authentication schemes. After all, Apple already knows who you are and what apps you use so if they want to keep those data to themselves then offering an API as I described would actually be better.

  11. Sausage-auth by easyTree · · Score: 1

    https://www.youtube.com/watch?...

    --
    Requiem for the American Dream
  12. Jesus .. by Anonymous Coward · · Score: 0

    If we can utilize technologies like Face ID or Touch ID or some of the biometric things that we find on our devices today to verify that this is a real person, then we can start labeling that and give people more context for what they're interacting with

    The ripple of dystopian fear which starts at my sphincter when I read these words is hard to describe.

    So, Twitter should have access to biometric access for billions of users, and we should all think this is going to be for our own good?

    *shudder*

    When the internet requires biometric identification, I'm pretty much going dark.

  13. Jack the Nazi Faggot by Anonymous Coward · · Score: 0

    F him

  14. As if the bots weren't bad enough by Opportunist · · Score: 1

    Now they want me to hand over biometric data to read bad bot posts?

    Nah. Reading some bullshit from Twitter twats ain't important enough for this. Anyone know an alternative that doesn't suck?

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    1. Re:As if the bots weren't bad enough by Anonymous Coward · · Score: 0

      There's always 4chan, with the added benefits of not requiring any personal information to read/post and having a slightly higher post quality.

  15. It doesn't have to be all or nothing by krakrjak · · Score: 1

    I mean, please add all the methods possible to discriminate between bots and humans. For instance, if someone replies to a tweet in less than 5 seconds with a 200+ character response, mark it as a potential bot post. Other sorts of controls could be added too that mark potential tweets as sent by bots or automated accounts. With all the tools at Twitter's disposal, it seems that they are explicitly NOT looking for ways to discriminate between bots and humans. This is likely for commercial reasons.

    Twitter can be a playground for both bots and humans, but detecting the bots and marking their tweets as such could be a great way to help level the playing field and would help humans understand how the information is really flowing through the site. It doesn't have to be all blue checks and biometrics, but those are good as well.

    1. Re:It doesn't have to be all or nothing by c-A-d · · Score: 1

      >detecting the bots and marking their tweets as such could be a great way to help level the playing field and would help humans understand how the information is really flowing through the site.

      I thought that's what the blue checkmark was for.

      --
      some karma... and kinda lukewarm about it.
  16. Biometrics are human traficking by Anonymous Coward · · Score: 0

    organs and entities. Banking on biometrics instead of a receipt credential exposes life itself to counterfeiting. Criminal Complaints must be filed as soon as possible on felony statutes. Twitter CEO is a felon.

  17. whats..twitter? by Anonymous Coward · · Score: 0

    oh right that shitstorm place where all the fucking fruits fairy's and there friends chat on and some president and dumbocrats ...cause us intellect is devoid of reason

  18. Break them up by WCMI92 · · Score: 1

    Twitter
    Google
    Facebook
    Apple

    ALL must be broken up into several companies.

    --
    Corporatism != Free Market
    1. Re:Break them up by pauljlucas · · Score: 1

      Since this article is about Twitter, I willl stick to that. How could Twitter be broken up? They only do one thing. Please enumerate what each of the 6 or so companies would do if Twitter were broken up into them.

      --
      If you reply, do so only to what I explicitly wrote. If I didn't write it, don't assume or infer it.
  19. Mastodon solves the "Twitter" problem by Anonymous Coward · · Score: 0

    It is better, not American, more configurable, can run off your own server and still connect you with EVERYONE.

  20. It's not biometrics, it's having an Apple device by misnohmer · · Score: 1

    Creating computer generated realistic bio-metrics is not that hard. See link below filled with very real looking computer generated faces.

    https://youtu.be/kSLJriaOumA

    What Dorsey is saying is that they want to move to authentication based on whether you own a recent Apple device. Still not that hard to beat by a bot, but sure, will filter out low cost bots (and 80% of the smartphone market with it).

  21. User information is more valuable with ID by joe_frisch · · Score: 1

    A company wants verifiable identities on the people who use their site, which will increase the value of the data that company sells to their customers.

    Convincing the users (product) to go along is just marketing.

  22. Translation: by Anonymous Coward · · Score: 0

    Jack Dorsey: 'It won't do anything about bots or fake accounts, but we want your biometric data, too.'

    Anyone that gives it to them is a moron.

  23. Biometrics implies ePassport identities by ezdiy · · Score: 2

    The thing on your phone will happily say gummy bear or a sausage is "human". New identities there those can be also trivially conjured by the simplest of generative models, with no tissue or hardware to scan it. See, real, bot-proof biometrics means government authenticated biometrics. A fingerprint scan digitally signed on your ePassport is a pretty decent proof that you're alive somewhere, and probably paying taxes. And our social network overlords are itching to get hands on that data.

    That is, until someone dumps a public torrent full of scans of a whole country of real people, along with the CA private key, and hilarity ensues. Reminder that privacy preserving biometric schemes (PIR) exists to avoid catastrophic failures like this, but so far no government has been competent enough to be bothered. Why prevent identity theft, when you can just outlaw it?

  24. Oh Jack by nospam007 · · Score: 1

    Try first with simple, easy biometric steps, no orange people allowed.

  25. logic by sad_ · · Score: 1

    you can use a fake name to allow free expression, but you must use real biometrics.

    --
    On a long enough timeline, the survival rate for everyone drops to zero.
  26. Uh Huh by Anonymous Coward · · Score: 0

    They're trying to lay the groundwork for having police kick in your door for posting wrongthink.

  27. Who the heck cares? by Anonymous Coward · · Score: 0

    Jack Dorsey- noted idiot - says idiot things in an idiotic way. What a surprise.
    I'll believe it when I see it.
    Idiot's gonna idiot.