You are here: Home / Online Identity / Idea #4: Protect your biometric data

Idea #4: Protect your biometric data

November 4, 2006 By Jason Kolb 6 Comments

Here in the Chicago area we have a supermarket called Jewel-Osco which lets you pay by touch with your fingerprint.  I think this is one of the worst ideas I’ve ever seen.

Fingerprint_1

I will NEVER give my fingerprint to ANYONE.  Why?  Because Jewel-Osco has to keep a record of your fingerprint on a server somewhere, and that server can be compromised.  What happens if the backup tape that has your fingerprint on it falls off the back of a truck?  It’s pretty hard to reset your fingerprint.

Protect your biometric data like it’s pure gold.  You only have one body, you can’t reset it or send for a replacement.

Part of the 60 Ideas in 60 Days series.

Share and Enjoy:
  • Print
  • Digg
  • Facebook
  • Google Bookmarks
  • HackerNews
  • Reddit
Filed Under: Online Identity
  • http://xmlhacker.com M. David Peterson

    >> It's pretty hard to reset your fingerprint. <<

    WOW!!! I totally hadn't even considered this until you pointed this out (not the fact that you couldn't reset your fingerprint, but the fact that if it ever were to be compromised, thats it… game over.)

    Thanks for the wake-up call!

  • http://www.60ideas.com/story/15/ Anonymous

    Protect your biometric data

    I will NEVER give my fingerprint to ANYONE. Why? Because Jewel-Osco has to keep a record of your fingerprint on a server somewhere, and that server can be compromised. What happens if the backup tape that has your fingerprint on it falls off the bac…

  • Sean

    Do they keep a record of your fingerprint? In the clear? Do they have to?

    You've got ten finger-prints. Can you reset to another finger-print?

  • Robert Schechter
  • http://www.paybytouch.com/ Larry Hollowood, Chief Security Officer, Pay By Touch

    Jewel-Osco does not keep a record of the fingerprint. As a matter of fact, no merchant that uses the Pay By Touch payment system has access to any biometric information. All biometric data is securely encrypted at the point of sale and is transmitted encrypted to Pay By Touch for authentication purposes. Pay By Touch does backup its database for recovery purposes, but biometric data is never stored on a tape or other physically transportable media.

  • http://www.jasonkolb.com Jason Kolb

    Thanks for the feedback Larry, most helpful. Do you store the fingerprint via a reversible encryption algorithm or a one-way hash? If it's secured via a one-way hash at the point of sale I'd definitely be much more receptive to the idea.