Umm, if this is true, how are you identifying the person then?
But my guess is, your face could be identified wether or not you are using this particular system. But your palm only works after the system does the scan of you so you have to specifically opt in to use it.
> Q: What is the device actually scanning when it creates my unique palm signature? > > A: the technology evaluates multiple aspects of your palm
Ok then.
On an iPhone, biometric is being treated as a password where the expectation is that no one but you could open it. For Amazon go, it is just an identifier to a user
Plus a data dump of uuids and palms might not be useful information. Maybe there is a effectively a way to hash the raw palm data since this is just effectively a user look up
This is pure speculation
The proper solution would be a safe hardware key mechanism.
Irreversibly tying accounts to biometric identities is a very powerful thing which can easily be abused. Think of Salman Rushdi, the Iranian writer which became target of a religios fatwa and was basically advertised to be murdered. He somehow managed to disappear. But that was years ago. In todays world with Facebook everywhere and your social graph being a different kind of fingerprint, you'd need to axe-murder your whole family and friends to get rid of that social graph which identifies you, whatever name and picture you use. AS no normal human being will do that, it has become basically impossible to disappear. And, having lived in Colombia, South America, I've known many decent and nice people who just had to disappear only in order to protect their life. This is dangerous technology.
It's a permanent mental illness and cannot be 'cured' or 'overcome'
If you walk into your bank and want to withdraw a large sum from your account, someone at the counter looks at your face and a shitty small photo taken from you either on their system or on your passport to determine if there is a "face match".
A proper technological solution to the current more insecure human verification process of your biometric is only an improvement, not a horrible idea as you suggest.
We tell users not to re-use their passwords, but the same goes for fingerprints too.
You can already enter these stores using your phone.
It's very troubling.
- The privacy and security implications are huge.
- Its tied to commerce, not some airport entry thing. Commerce has legs.
- On top of that its scary because Amazon can push this all over the world and give their tech for free to businesses.
- Other companies will provide this "feature" too.
The one door I was hoping will never be opened is opened now.
there are laws against facial recognition (https://www.msn.com/en-us/news/us/portland-becomes-the-first...)
how is palm recognition different from facial, aside from scanner proximity?
I.e. you choose to hand over your palm to be read, you do not make the same choice in Facial Recognition scenarios.
> If I decide I don’t want to use Amazon One any more after signing up, can I delete my biometric data?
> Yes, you can request to delete data associated with Amazon One through the device itself or via the online customer portal at one.amazon.com. We believe customers should always be in complete control of when and where they use the service, and we designed Amazon One with this in mind.
Maybe I'm paranoid, but that FAQ feels like it was worded by Orwellian doublespeak experts:
- you can "request" (thank you for granting us permission to make a request of you)
- data associated with Amazon one (all the data or only certain data? Do you keep data that's not associated with an account but maybe still associated with my identity?)
With Face/TouchId it’s authentication, not identification (as there’s only one identity associated with the device).
What’s the fallback here for “twin palms”?
I guess those unlucky people will have to swipe in using traditional methods?
Social media also used to be underestimated in the damage they can do. Privacy information brokers are like an Hydra, you cut one head, 3 new ones grow... and before you know it, your biometrics, bed time conversations, source of news, children habits... are up for sell because someone thought “it’s just X“ and underestimated what someone else can do with all the data they collected.
I believe we need to change our optimistic attitude when it comes to individual privacy as we are nothing if not seeding the world of tomorrow, the world of the generations to come.
I'm sure the main one was that people associate fingerprints with being arrested, but maybe they could trick people into volunteering to be constantly fingerprinted by a private company if they just used a different part of the hand.
"We selected palm recognition for a few important reasons. One reason was that palm recognition is considered more private than some biometric alternatives because you can’t determine a person’s identity by looking at an image of their palm."
I read that part of their statement as a comparison of data privacy (not invasiveness) with face recognition. I think the contactless part was about invasiveness.
> When you hold your palm over the Amazon One device, the technology evaluates multiple aspects of your palm. No two palms are alike, so we analyze all these aspects with our vision technology and select the most distinct identifiers on your palm to create your palm signature.
Can someone ELI5 this to me? Is there some biological thing I am missing here or is it just as simple as, unlike fingerprints which are commonplace, other organisations tend not to have images of your palms?
I expect they were trying to contrast with face recognition, though.
That's how I understand it too, I think this is just UX, by the time you check out they know who you are and what did you pick up, so I think the palm is just a gesture to confirm, maybe confirming by walking away the store with item or with a face was a weird user experience, and they are trying confirmation "by hand". Or I'm curious what happen to the, "you just walk away with your items" experience?
You're waving your hand and walking through now, no more scanning, no more opening up an app, no more tinkering with your phone. By chipping away at each of these friction points, no manner how minor, their moat grows and customers will notice a difference between an Amazon retail store vs. a competitor's.
Having a slice of every point of sale could be huge; imagine how much better this is than having to use FaceID during a pandemic. (Tap tap, pin, pin, tap is a LOT more friction than “hover.”)
I’d pay for it if I ran a retail store. I wonder if Amazon will ever compete with Visa or other payment providers.
"But AWS etc etc.." Trust me, the retail landscape is very different. Source: I work in it
According to the source article, your prediction is on point. Here are the relevant quotes:
>"Do you have any third-party customers who plan to use Amazon One?"
>We’re excited to see Amazon One in more retail environments and are in active discussions with several potential customers, but beyond that, we’ll have to ask you to stay tuned.
this helps streamline a process. one of the annoyances at go stores was waiting for someone to pull out their phone, open the app, and scan. I was like if you dont have your phone out already, step aside until you do, but at least this solves part of that issue.
also the dinning hall situation was probably a simpler environment with not as many negative consequences if a person got accepted into the hall.
All these new biometrics share one common theme:
Better privacy for a user. FaceID has the problem that I can't hide it. As soon as I walk somewhere cameras can capture and match my face against their own records, however if I never registered my face ID with Amazon then they will know that I am possibly a recurring customer, but not know who I am. Palm IDs, VeinIDs, etc. are biometrics which I can easily hold back from disclosing. Only when I actively insert or present my finger/hand/palm I allow another device to scan my hand and do a match analysis. This means that I as a user am in better control of when and to whom I want to disclose my identity.
When I go to the grocery shop and I buy alcohol then I have to wait at the self checkout till until a member of staff comes to verify my age before I can pay for my shopping basket. That involves me showing them an ID (e.g. my driving license) and them having to verify my biometric (face) by looking at me and then looking at my driving license. This is time consuming and requires additional staff at self checkout tills, making them less "self checkouty".
On the other hand (or palm should I say :P) I could age verify myself only once at an Amazon One kiosk and then have my legal age linked to my verified palm. Now I can go and buy alcohol and when I present my palm then the checkout till knows that it's me (because unlike a driving license or credit card or phone I can't hand my palm to someone else). It knows that I'm of legal age to buy alcohol and therefore was able to do three things in one go: age verify, pay and reward points all via a single hand gesture. That is a win for the consumer and the shop as they don't need that extra staff anymore and there's less of a human bottle neck, leading to faster checkouts.
If my age verification was tied to my palm, I'd have to cut off my hand to let a teenager buy booze with it.
But I still don't feel this is a compelling argument.
However, one advantage of something external to your body is that if it ever does get compromised it is a lot easier to deprecate that thing and replace it with a new one.
No doubt there are 3D scanners (to map the elevation of your palms, the depth of the lines, etc.), infrared imaging and a slew of other minor sensors. To make this fast, they need to effectively correlate enough of the data to identify you without relying solely on a single thing.
There aren't a bunch of other sensors available.. probably some heat/temperature just to make sure it's a real palm but that's not for uniqueness.
Wow. Never thought of that. But is it easy to reconstruct veins?
"Yes, you can request to delete data associated with Amazon One through the device itself or via the online customer portal at one.amazon.com. We believe customers should always be in complete control of when and where they use the service, and we designed Amazon One with this in mind."
Perhaps, as the sibling comment suggests, this was an architectural decision made based on the requirements for operating in the EU.
You also have the right to request that a decision to not be made solely using automated means. This is a good introductory article
https://www.which.co.uk/consumer-rights/advice/how-do-i-make...
Too bad most of these companies operate based on the US legislation which doesn't grant the same consumer rights.
Anything you're allowed to share?
Another reason is for cookie management. This way your cookies aren't sent to the marketing site.
I'm not sure why Amazon does it though, as I think they're big enough to run their own CMS and therefore the cookie thing isn't really an issue.
Another reason is for branding. Using aboutamazon.com for PR fluff keeps amazon.com reserved for their actual consumer products.
Good ol’ days.
1) A new innovation ok. People have been doing that for more than a decade, my group included.
2) Given the sensors look, it's almost certainly near infrared (NIR) camera, probably 850nm illumination and the dark surface is a NIR filter.
3) It certainly capture a mix between palm veins (850nm quite absorbed by de-oxygenated hemoglobin) and palm skin ridges.
"Rather, the images are encrypted and sent to a highly secure area we custom-built in the cloud where we create your palm signature."
4) Weird approach to biometric template security to send palm picture to a server...
5) Curious how anti-spoofing is implemented, if at all.
edit: less agressive
I have done three years research on that topic: yes there are out there! Do they work: to some extent yes. Can it be bypassed: like any system yes.
More seriously, how successful do you think people will be at holding their palm above the device at a close enough distance for an accurate reading?
But good try
I might consider cutting an artificial hand off a silicone doll and registering its hand print.
Carrying a necklace of dismembered hands might creep out the store attendees & shoppers though.
https://www.fujitsu.com/ro/solutions/business-technology/sec...
Isn’t this what the whole product is about, tying palm prints to identity? Maybe they are saying nobody else collects palm prints so others can’t tie to identity?
