Was intrigued to read in the latest Fintech š§ Food that @Plaid has launched a beta product called My Plaid (http://my.plaid.com) that allows users to see which companies they are sharing their financial data with š§
Naturally, I wanted to take it out for a spin…
š JP Morgan and Plaid
š¤ Just months after Jamie Dimon accused Plaid of "irresponsibility with data", this investment š¤ Plaid's partnership approach with banks is smart š¤ They're well-positioned to become an identity broker in a world with too much identity theft (unpacked)
For now, it doesn't seem to have the capability to see which companies have access to data. You can only add accounts, like any personal finance app out there, and see an aggregated view of accounts.
So, nothing *too* differentiated for now š¤·š½āāļø
Where it breaks down potentially is that this will likely only work where the origin/destination of financial data uses Plaid APIs.
1. It goes beyond the scope of what data is available under Open Banking (mostly current accounts & credit cards)
2. It doesn't rely on a single, proprietary vendor like Plaid to work
In a way, I'm glad Plaid is doing this now because it demonstrates clear product-market fit and demand for digital identity services, that we *can* solve in a more efficient and privacy-preserving fashion @cheqd_io šš½
For starters, itās an imbalance on whether it entices certain demographics to give up personal biometric data in return for $10.
This kind of asymmetric power *needs* to be looked at closely, on how that data is used in the future.
āAmazon stores biometrics in the cloudā
What is often not appreciated in this is that biometrics are often stored as mathematical templates; equivalent to āhashesā. A biometric hash CANNOT be used to reconstitute the original hand, fingerprint, or palm print. This is low risk.
If you think of traditional methods of storing passwords, they are often āsaltedā (add some random data) and then āhashedā.
This is also often how biometric templates are stored. ā
If thereās a data breach, the templates are useless to a hacker in reusing at a different place.
ā ļø However, this is ONLY secure and private if the company registering biometrics ONLY stores this as a biometric template. It should NOT store the original image/picture of the hand or palm print. š
The analogy here is similar to passwords, where best practice is to never store the original plaintext password, and to only ever store it as a salted and hashed version of the password. ā
So even if Amazon or any other system stores biometric templates in the cloud, the risk is the same as losing securely stored password hashes: they are useless to a hacker.
Itās all the OTHER data with personal information thatās more useful to hackers.
How does Amazon One compare to on-device biometrics like Apple Touch ID or Face ID? š¤
The main difference is Touch/Face ID can ONLY be used for 1:1 matching with a single person.
Something like Amazon One which is a central system can be used for 1:1 matching (āgive me access to my own accountā)
But it can also be used for 1:many matching (ādoes this palm ā print belong to a known fraudster?ā)
(How and who decides who is a āknown fraudsterā?)
Then thereās how Amazon One works, or most biometrics in general.
As a biometrics operator, you want to prevent fraudsters from taking a picture and showing it to a scanner.
āļø This is a risk with finger and palm printsā¦if someone is targeting a specific individual.
As a fraudster though, youād want to maximise returns and minimise the effort.
Lifting physical finger or palm prints at large scale is *hard* to do.
Amazon uses vein prints, which also can check for something called ālivenessā: itās not just a static image, but can also see if thereās realistic motion that would happen with blood flowing through an actual humanās palm.
This makes it very hard to spoof by a fraudster.
Even if someone had my fingerprints or palm prints, thatās not the same kind of data as my vein patterns.
And even if they had pictures of my vein patterns, itās hard to spoof the motion associated with vein prints.
TL;DR: the way Amazon One uses vein prints from a palm āis secure and follows best practices.
SHOULD they be doing this and whether itās creepy is a different question that comes down to whatās acceptable in this context by society and users.
(E.g., people donāt mind doing this for passports or border control. They also have no choice in that scenario, whereas Amazon One biometrics is an opt-in programme)
If youāve stuck by this far (thank you šš½), would YOU register and give your biometrics to Amazon for entering their grocery stores?
