this post was submitted on 04 Aug 2023
359 points (97.1% liked)

Privacy

32120 readers
990 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

I can only see this going into a very dystopian path. Based on their actions, I don't trust these companies, their security practices, nor their privacy policies. Why would I give them my biometrics? And my full palm, at that!? Hell no!

top 50 comments
sorted by: hot top controversial new old
[–] frustbox@lemmy.ml 55 points 1 year ago (2 children)

One scar away from losing access to your ability to pay …

Biometrics can not really be changed. Except maybe through time or trauma (i.e. age or injury). They can be used to uniquely(?) identify a person - except maybe twins - at the expense of anonymity, which has it's own set of problems.

But because they can not easily be changed they're a terrible security feature. Once they leak, they're unusable and you're hosed. You can't issue a new palm print for your bank account like you could a new chip card and password.

Also, just because you waved your hand over a scanner does not mean that you approve and consent of the transaction. With tap to pay there were ideas of mobile point of sales devices just tapping on peoples backpacks in a crowded area. You don't even keep your biometrics markers in your pocket, they're just out in the open for anyone with a camera. This may be bordering on paranoia, but a few years back (2014) German hackers from Chaos Computer Club took iris scans from Angela Merkel (then Chancellor of Germany) and finger prints of Ursula von der Leyen (then Minister of defense) using nothing but press fotos. Cameras have only gotten better.

TL;DR: Biometrics can be used for identification but should never be used for authorisation.

[–] TWeaK@lemm.ee 10 points 1 year ago

Paying with your phone works on the presumption that your phone is locked and you accept responsibility for ensuring your phone wasn't breached. It uses contactless technology, but it's still effectively chip and pin as far as your bank is concerned.

Meanwhile, paying with a contactless card is processed as "cardholder not present" where the seller assumes de facto liability and must prove otherwise. Contactless payments were never a new type of card processing, it was a new method but is categorised the same as when mail/phone ordering from a catalogue. The same with online purchases. They were always a step below card & signature or chip & pin. Paying with your phone is the same as chip & pin though, where the onus is on you to ensure the transaction is secure.

Paying with your hand has all sorts of issues making it impractical. You would definitely need an additional confirmation eg PIN, but claiming that your hand is as secure as a traditional card doesn't lend well to pinning the liability on you. So banks are unlikely to use it.

[–] Blackmist@feddit.uk 9 points 1 year ago (1 children)

Biometrics also aren't great and uniqueness. At least where computers are concerned.

Recently we had one of our customers install fingerprint readers on their points of sale, the idea being any staff member can log in just by touching the pad. Even with only a few hundred staff registered, you get people logging in as each other.

load more comments (1 replies)
[–] dan@lemm.ee 48 points 1 year ago (2 children)

Shit no! You know what you can’t change if/when they inevitably leak your data? Your fucking hand.

[–] oldGregg@lemm.ee 8 points 1 year ago (1 children)

I've got a bucket of golf balls and a 12ft 2x4 that says otherwise

load more comments (1 replies)
[–] Jaamulberry@beehaw.org 4 points 1 year ago

Uhh. Have you seen men in black? /s

[–] ReakDuck@lemmy.ml 45 points 1 year ago (2 children)

I hope this tech stays where ever the fuck it is and never touches Europe

May it die the death of a thousand deaths

[–] Ghostalmedia@lemmy.world 4 points 1 year ago

This is Amazon One. Amazon is rolling it out pretty aggressively in their American grocery stores right now. Looks like it’s moved out of its pilot stage and is getting a national US rollout.

https://one.amazon.com

[–] Catsrules@lemmy.ml 36 points 1 year ago (1 children)

I didn't know paying in body parts was legal.

It's a brave new world, it seems

[–] Stabbywithsocks1@lemmy.ml 25 points 1 year ago (2 children)

Body parts aren't secure. They're removable.

[–] Kolanaki@yiffit.net 5 points 1 year ago (1 children)

Stop telling people their body is insecure. Everyone is beautiful!

load more comments (1 replies)
load more comments (1 replies)
[–] user224@lemmy.sdf.org 21 points 1 year ago (1 children)

Oh, that palm. I thought Palm introduced their own payment method for Palm phones or something.

That's would be better hahs

[–] ImFresh3x@sh.itjust.works 20 points 1 year ago (1 children)

I like to do this at Whole Foods in front of my anti vax friends and tell them about how cool it is to have a chip that lets me pay by waving my hand.

[–] perviouslyiner@lemm.ee 3 points 1 year ago (1 children)

Embedded RFID? How is it like living with one of those in you? Deviant talks about how convenient they can be for cloning things like your hotel room key.

load more comments (1 replies)
[–] Stoneykins@mander.xyz 19 points 1 year ago (1 children)

I still think the idea of tech implants are cool but I've also reached the point where I wouldn't get one unless I learned to build it myself and was in charge of every single aspect of it.

Considering I lack degrees in medicine and computer science, I don't think I'll have them done anytime soon lol

[–] MonkderZweite@feddit.ch 3 points 1 year ago

You don't need degrees to hack stuff.

[–] stevedidwhat_infosec@infosec.pub 16 points 1 year ago (3 children)

Forget about privacy, this is just fucking dumb

One point of failure that can’t be replaced if stolen?

This won’t ever take off, and will most definitely die out quickly in favor of literally any other technique including just embedding an nfc chip and battery to your palm surgically. Which I probably still wouldn’t be thrilled about but

[–] 01189998819991197253@infosec.pub 5 points 1 year ago* (last edited 1 year ago) (3 children)

I've see where you can pay with your fingerprint at some venders. It's a similar concept, in terms of single point of failure. Regardless, I hope you're right.

E: **mostly right. I won't embed anything in my skin for payments. CC or cash or phone NFC (and I don't like that one for it's security implications). That's it.

[–] argv_minus_one@beehaw.org 3 points 1 year ago (2 children)

I won't even use phone NFC for payments. Card, cash, or I'm taking my business elsewhere.

load more comments (1 replies)
load more comments (2 replies)
load more comments (2 replies)
[–] JoeBidet@lemmy.ml 15 points 1 year ago (1 children)

Oh no! I trashed my faithful Palm Pilot (tm) years ago :/

load more comments (1 replies)
[–] Eyeuhnluuung@lemmy.world 11 points 1 year ago

Saw this at Whole Foods the other day for the first time and commented to the cashier that it was kind of creepy and her response was “I know right”.

[–] JoYo@lemmy.ml 9 points 1 year ago* (last edited 1 year ago) (1 children)

bro, come back to me when most stores accept touch emv payments. lol, like each fucking store is gonna know what to do with a fucking palm scan when emv is fucking forbidden magic.

[–] 01189998819991197253@infosec.pub 3 points 1 year ago (1 children)

Haha! Good point. It's been "mandated" a couple years ago, right? It's barely anywhere

[–] ramenbellic@midwest.social 3 points 1 year ago (1 children)

Interesting regional differences. It's incredibly rare that I find a store that doesn't support tap-to-pay

load more comments (1 replies)
[–] Lucidlethargy@sh.itjust.works 8 points 1 year ago (1 children)

I don't understand what this solves... We can use a card faster than this (a mere tap), and if we forget our card, it's programmed into our phones and even our watches as a backup.

[–] float@waveform.social 8 points 1 year ago

Its meant to save you a step. Before at whole foods you had to get out your phone, open the amazon app, scan your prime QR code, then get a card and pay. This just does all that with an enrolled palm.

I still don't trust it. I laughed at it when I saw it and even the clerk admitted it was dumb.

[–] wegettosss@lemmy.world 8 points 1 year ago* (last edited 1 year ago) (1 children)

My dad who lives in a small village (around 5k people) has his account in a local bank. Nothing really differs this bank from big companies. Theyre just local. So my dad has this axcount and we are in a city nearby and want to do some shopping, spend some money on gear etc. But he looks for cash and its not in car. Then, ofc, he looks for his wallet with all his cards and he hasnt it too. So we are kinda fucked up and going back home and to shops would take an hour. (We were low on gas too.) So he withdraws cash with his fucking hand. Fucking hand. Pretty useful tbh but rather not safe.

[–] phase@lemmy.8th.world 10 points 1 year ago (1 children)

And you trust the ower of the establishment, of the softwares, of the Internet, and the bank to not steal your data. Right. I wish you to be correctly assured. At least by your bank.

And don't forget, in case of data breach, change your palm.

[–] wegettosss@lemmy.world 3 points 1 year ago (1 children)

I didnt say I trust them. Actually, i literally wrote "rather not safe". Aside from that, i validate ur opiniom

[–] phase@lemmy.8th.world 3 points 1 year ago

I understand the basic reaction. I don't see the safety problem. It would have been sad to have to drive back. I perceive the risk way too high in comparison to the damage.

[–] phase@lemmy.8th.world 8 points 1 year ago

Someone took the novel "The Java Script Café" from "Stealing the network: How to own an identity" (page 141) and made a business model for it.

[–] Sharpiemarker@feddit.de 7 points 1 year ago* (last edited 1 year ago) (2 children)

Someone has 100% put their dick on that palm reader. Guaranteed.

"payment unrecognized. Object too small or too far away. Try again"

[–] Narrrz@kbin.social 4 points 1 year ago (2 children)

a lot more people will have touched themselves, then the palm reader, without first washing their hands

[–] Ghostalmedia@lemmy.world 3 points 1 year ago

You don’t hold your hand directly on the reader. The camera requires your hand to be about 2-3 inches away to work.

load more comments (1 replies)
[–] TiredSpider@slrpnk.net 5 points 1 year ago

All this trouble and they didn't even make the scanner shaped like a hand so you can high five it. Waste of potential.

[–] Jmr@lemmy.world 5 points 1 year ago (1 children)

LG did this on a phone. It didn't really work, at all

Theirs was camera. This one is camera and thermal. Creepypasta for sure!

[–] cygnus@lemmy.ca 4 points 1 year ago

Damn, based on the post title I thought Palm Pilots were going to become useful again.

[–] ArmokGoB@lemmy.world 4 points 1 year ago (1 children)

These types of things never work for me because my skin changes so much 💀

It measures your blood flow and veins using thermal and maybe infrared (?), so your exterior skin doesn't come into play.

load more comments
view more: next ›