Sam Altman Is Battling with Governments over Your Eyes | Hacker News Reader

Sam Altman Is Battling with Governments over Your Eyes

wsj.com

Hopefully Altman loses. Even though we've already normalized so much data collection, this is an unacceptable intrusion on human privacy.

https://archive.is/jDjg9

From a purely technical perspective, I’m not really sure what extra security biometrics are supposed to offer compared to, say, a public/private keypair notarized by one or more institutional authorities. In fact, biometrics as an identifier seems fraught with extra risk, since if anyone is ever able to capture your info (high res photo -> spoofing device, attacker-controlled scanner -> captured digital representation, etc etc) you can’t revoke it. In my mind biometrics are more of a convenience than a security tool, and worryingly seem much more useful for surveillance than as the basis for a secure identification system. Additionally I have no idea how this stuff is supposed to have anything to do with human verification, data is data after all.

I’m not sure how much of this scheme is a genuine attempt to solve a possible “human verification” problem vs a naked power/money play, but considering sama’s attempts to pull up the ladder wrt LLM & other AI tech via fearmongering in Washington my personal cynicism is leading me towards the latter conclusion. Considering his new fed-laden board composition, my conspiracy theories run wild.

We do need better digital ID systems, but I’d rather pursue a scheme that doesn’t require trust in a single arbitrary central authority but instead gives strong control to the identity-bearer and identity-verifiers. My aforementioned scheme seems better suited for this purpose than a cryptocurrency eyeball scanner.

Yeah, biometrics are at best a username, never a password.

And you've gotta have a policy for when someone's username is somehow "already taken".

i would go further, and treat biometrics as a sort of "remember me" tick box, rather than a username. The first time you authenticate, you have to have an alternative method rather than biometrics, and only afterwards, do you record biometrics as a shortcut (like the "remember me" login tickbox).

That may deter someone from using stolen biometrics to open a new account in your name, it wouldn't stop them stealing your life savings from an account that already exists.

> an account that already exists.

yes, but only if you don't have two factor authentication turned on.

I still maintain that using biometrics as a quick login is the way to go, and if the service that is being logged into is sensitive, there needs to be two factor.

It sounds like you're suggesting someone can log in just using (A) biometrics and (B) a 2FA time-code generator.

The problem there is that it's doubling up on "thing you have"[1], and there's no longer a "something you know" condition. A mugger could knock you out from behind while you're using your phone and then empty your bank account or whatever.

[1] That said, fingers/irises/etc. aren't strong in the category of an un-copyable object either, since many scanners are fooled by fake fingers etc.

> A mugger could knock you out from behind while you're using your phone and then empty your bank account or whatever.

that's true, but they could also just point a gun at your head and tell you to empty your account.

There's a balance of convenience and security. A lot of processes disregard convenience as a factor, but i argue that a laymen considers convenience a large factor, and would be willing to skip security for convenience.

Reply on news.ycombinator.com