Name: Exposing Your Face Isn't a More Hygienic Way to Pay
Brand: eff.org
SKU: eff-org-257
Availability: OnlineOnly

critic

Exposing Your Face Isn't a More Hygienic Way to Pay

preview

Email updates on news, actions,and events in your area.DEEPLINKS BLOGShare ItA company called has created an identity-management system that uses face recognition. Their first use case is as a system for in-store, point of sale payments using face recognition as authorization for payment.They are promoting it as a tool for restaurants, .Nonetheless, the PopID payment system is less secure than alternatives, unfriendly to privacy, and is likely riskier than other payment alternatives for anyone concerned about catching COVID-19. On top of these issues, PopID is pitching it as a screening tool for COVID-19 infection, another task that it's completely unsuited for.It's important that payment systems not disadvantage cash payments, which have the best social equity. Many people are under-banked and in hard times such as these, many people use cash as a way to help them manage their budgets and spending. Cash is also the most privacy-friendly way to pay. As convenient as other systems are, and despite cash not being contactless, we need to protect people's ability to use cash.PopID is a charge-up-and-spend system. To lower their costs, PopID has its users charge up an account wn ith them using a credit card or debit card, and payments are deducted from that. Charge-and-spend systems are good for the store, and less good for the person using them; they amount to an interest-free loan that the consumer gives the merchant. This is no small thing: . This further disadvantages people with budgets, as it requires them to give PopID money before it is spent and keep a balance in their system in anticipation of spending it.PopID also requires their customers to have a smartphone for enrollment-by-selfie, which disadvantages those who don't have one.To be fair, these issues are largely fixable. PopID could allow someone to enroll without a phone at any payment station. They could allow charge-up with cash, and they could allow direct charge. But for now, the company does not offer these easy solutions.Looking beyond its potentially fixable perpetuation of systematic inequalities, it's important that a system actually do what it's intended to do. PopID is pitching it as a pandemic-friendly system, providing both contactless payments and as a . Neither of these is a good idea.PopID promotes their system as a temperature scanning device for and customers alike. Temperature screening itself has limited benefit, as around half the people who have COVID-19 are asymptomatic.Moreover, accurate temperature screening is expensive and hard. . In reality, the cheap camera in a point-of-sale terminal is both inaccurate and intrusive as Jay Stanley of the ACLU .There's a wide range in the accuracy of temperature-scanning cameras, in normal human body temperature across a population, and even an individual's temperature based on time of day and their physical activities. Even the best cameras are finicky, not working accurately if people are wearing hats, glasses, or masks, and require the camera to view only one subject at a time.Speeding up a sandwich shop line does help prevent COVID-19, because . But, temperature scanning along with payment doesn't help people space themselves out or have shorter contact.PopID pitches their system as good during the pandemic because it is contactless. Yet it is worse than payment alternatives.PopID's web site shows a picture of a payment terminal, with options to use contactless payment systems such as Apple Pay, Google Pay, and Samsung Pay. Presumably, any contactless credit card could be used. Additionally, a barcode system like the one Starbucks uses is contactless.PopID's point of sale terminalAny of these contactless payment alternatives are much better than PopID from a public health standpoint because they don't require someone to remove their mask. The LA Times article comments parenthetically, "(The software struggles at recognizing faces with masks.)"Indeed, any contactless payment system has less contact than using cash, yet even cash is low-risk. Almost all COVID-19 transmission is through breathing in virus particles in droplets or aerosols, not from that we touch. Moreover, cash is easy to wash in soapy water.This is a big deal for a supposedly pandemic-friendly system. The most recent restaurant-based superspreading event in the is particularly relevant. A person in South Korea sat for two hours in a coffee shop under the air conditioning, and spread the disease to twenty-seven other people, who in turn spread it to twenty-nine other people, for a total of fifty-six people. And yet, none of the mask-wearing employees got the virus.This is particularly relevant to PopID; a contactless system that makes someone take off a mask endangers the other customers. Ironically, if a customer sees a store using PopID, they better be wearing a mask because PopID is requiring them to come off momentarily. Or they could just shop somewhere else.PopID brings in new security risks that do not exist in other systems. They have the user's payment information (for charging up the payment store), their phone number (it's part of registration), name, and of course the selfie that's used for face recognition. There's no reason to suppose they're any worse than the cloud services that inevitably lose people information, but no reason to think they're better. Thus, we should assume that eventually a hacker's going to get all that information.However, being a payment system, there is the obvious additional risk of fraud. PopID says, "" yet that can't possibly be so.Face recognition systems are well-known to be inaccurate , particularly with Black, Indigenous, Asian and other People of Color, women, and also Trans or nonbinary people. False positives are common and in a payment system, a false positive means a false charge. PopID says they will confirm any match through the verification process of asking someone their name. To be fair, this is not a bad secondary check but is hardly "ultra-secure." Moreover, it requires every PopID customer to tell the whole store their name (or use a PopID pseudonym).Lastly, PopID doesn't say how they'll permit someone to dispute charges, an important factor since the credit card industry is regulated with excellent consumer protection. In the event of fraud, it's much easier to be issued a new credit card than a new face.The end result is that PopID's pay-by-face is less secure than using a contactless card, and less secure than cash.PopID is an incipient privacy nightmare. The obvious privacy issues of an unregulated payment system that knows where your face has been is only the start of the problem. The LA Times writes:But [CEO of PopID, John] Miller’s vision for a face-based network goes beyond paying for lunch or checking in to work. After users register for the service, he wants to build a world where they can “use it for everything: at work in the morning to unlock the door, at a restaurant to pay for tacos, then use it to sign in at the gym, for your ticket at the Lakers game that night, and even use it to authenticate your age to buy beers after.”“You can imagine lots of things that you can do when you have a big database of faces that people trust,” Miller said.Nothing more needs to be said. PopID as a payment system is a stalking horse for a face-surveillance panopticon and salable database of trusted faces.PopID is less secure and less private than alternative forms of payment, contactless or not. It brings with it a lot of social equity issues that negatively impact marginalized communities. Moreover, any store using PopID and thus requiring other people to remove their masks to pay is exposing you to COVID-19 that you would not otherwise be exposed to.Most alarmingly, it is also an insecure for-profit surveillance system building a database of you, your face, your purchases, your movements, and your habits.This is a complex issue in that we all intuitively think of money as dirty, and in pandemic times, this is even more on everyone's mind. However, the evidence at this writing (September, 2020) is that exposure through touch is possible but not common, while transmission through breath is the way almost all transmission occurs.Yes, these potential fixes are in tension with each other. If someone using the system wants to be cash-only, they're going to have to have a pre-paid balance in the system. In the other direction, direct-charge system has higher costs to PopID, but that's their business issue, and not the customer's.Share ItIn the first weeks of the COVID-19 pandemic, a location data broker called Veraset offered officials in Washington, DC full access to its proprietary database of “highly sensitive” , collected from cell phones, for the entire DC metro area.The officials accepted the offer, according to ...Vaccine mandates are becoming increasingly urgent from public health officials and various governments. As they roll out, we must protect users of vaccine passports and those who do not want to use—or cannot use—a digitally scannable means to prove vaccination. We cannot let the tools used to fight for public...This post was updated on 6/29/21 to more accurately describe how New York is running its voluntary vaccine passport programThe State of California recently released what it calls a “.” It is part of that state’s of...The U.S. is distributing more vaccines and . Returning to regular means of activity and movement has become the main focus for many Americans who want to travel or see family. An increasingly common proposal to get there is digital proof-of-vaccination,...As the rollout of COVID-19 vaccines has begun across the U.S., there have been of people having trouble getting it—not just because of its limited availability, but also because some counties and states . This...We're excited to have yet another "At Home with the EFF" event coming up this , with panels making sense of all the online censorship issues emerging this year. From the takedown of Parler to Trump getting banned, we'll offer an insider look on how censorship decisions...Location tracking apps. Spyware to enforce quarantine. Immunity passports. Throughout 2020, governments around the world deployed invasive surveillance technologies to contain the COVID-19 outbreak.But heavy-handed tactics like these , precisely when trust is needed most. They also invade our privacy and...In a year that saw every facet of online life reshaped the coronavirus pandemic, online content moderation and platform censorship were no exception. After a successful to encourage large platforms to adopt best practices and endorse the , 2020...A COVID vaccine has been approved and . With them have come proposals of ways to prove you have been vaccinated, based on the presumption that vaccination renders a person immune and unable to spread the virus. The latter is ...Today California joined dozens of other states and countries in launching its COVID-19 exposure notification app, CA Notify, built on API. Google and Apple’s API is already used in , as well as countries , ...Share It

Email updates on news, actions,and events in your area.DEEPLINKS BLOGShare ItA company called has created an identity-management system that uses face recognition. Their first use case is as a system for in-store, point of sale payments using face recognition as authorization for payment.They are promoting it as a tool for restaurants, .Nonetheless, the PopID payment system is less secure than alternatives, unfriendly to privacy, and is likely riskier than other payment alternatives for anyone concerned about catching COVID-19. On top of these issues, PopID is pitching it as a screening...

public

Jon Callas

We're the Electronic Frontier Foundation. We defend your civil liberties in a digital world.

Exposing Your Face Isn't a More Hygienic Way to Pay

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS