Live data from Hacker News

Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

wired.com

161–170 of 407 posts

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#161

Earlier quoted context omitted.

FaceID is unique in the sense that it's supposed to be on-device only in the form of an ASIC coprocessor.

You can't tell with closed source. Anyway, what about "iCloud backup"?

> Apple doesn’t backup TouchID or FaceID data to the cloud

We only have Apple's word to go by.

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#162
post #144

Last paragraph of the article: "The new authentication scheme is the second in recent weeks that relies on photos. Earlier this month, Facebook asked users to upload nude photos to Facebook Messenger, as part of an effort to prevent revenge porn. Facebook said it would use the nude photos to create a digital fingerprint against which to compare future posts." Wait what? I had to check whether today was April 1st.

Can someone explain if / how this prevents someone from just changing a single pixel and thus circumventing the hash? Are they using some kind of probabilistic hashing? Or are they just relying on the offenders to not be so clever?

There are perceptual image hashes[0]. There even are databases that have "search by similar image" indexing[1]

[0] https://www.phash.org/ [1] http://www.lire-project.net/

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#163

>> “Please upload a photo of yourself that clearly shows your face. We’ll check it and then permanently delete it from our servers.” >> To determine if the account is authentic, Facebook looks at whether the photo is unique. I assume this means that the photo itself is deleted but a one-way hash of it created to test against later. However, if I change one pixel of a picture of my face, A, to produce a new picture of…

Tineye has been able to do this black magic for a while [1]. I understand what they're saying they do, but it's too high level for me to grasp what algorithms are being used.

[1] https://www.tineye.com/faq#how

EDIT: Part of the black magic. This doesn't explain how they'd stop someone from using a random picture of you on the net.

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#165

Earlier quoted context omitted.

Under the EU GDPR (eg https://www.eugdpr.org/ ) it appears that they'll need explicit consent to retain the data (all of it, anything related and traceable to the person) and users will both have a right to view it and to have it deleted.

That only applies to Europe. The question is whether the data is valuable enough to Facebook to spend the time to add `if (europe)` to their code.

Or indeed care about the law enough to bother before they're fined for doing it. After all you'll need to prove they didn't delete the data first!

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#166

Earlier quoted context omitted.

> yes, you're going to have to trust them with a copy of it. No. They could have you compute a fingerprint locally without uploading the image itself, preferably through some audited open source software, without auto-updates. They only don't do that because they want to guard their image hashing as corporate secrets.

No, Facebook's side needs to verify that the image is you, and that you're not just hashing a photo of the McDonald's logo.

they can verify that after they have found a match.

if there is no match you gave them no data of interest. if there is a match then they already have that image anyway and you didn't make your privacy situation worse, except maybe telling them that you claim that is you, now allowing them to associate more images was you, but that's probably an acceptable tradeoff if there is actual revenge porn of you out there.

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#167

Earlier quoted context omitted.

You can't tell with closed source. Anyway, what about "iCloud backup"?

> Apple doesn’t backup TouchID or FaceID data to the cloud We only have Apple's word to go by.

Well, that and the word of numerous security researchers whose job it is to make sure that Apple is true to their word.

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#168

Last paragraph of the article: "The new authentication scheme is the second in recent weeks that relies on photos. Earlier this month, Facebook asked users to upload nude photos to Facebook Messenger, as part of an effort to prevent revenge porn. Facebook said it would use the nude photos to create a digital fingerprint against which to compare future posts." Wait what? I had to check whether today was April 1st.

That's so ridiculous it could have been written by The Onion.

Facebook has absolutely no businesses to store nude pictures of their users.

Re: Facebook’s New Captcha Test: 'Upload a Clear Photo of Your Face'

#169

Earlier quoted context omitted.

Excuse me. The issue is biometrics. "We'll delete the picture" =/= "we'll delete the control points and features extracted from your pics".

What do you mean by "control points"?

I think he means features like the corners of your mouth and eyes, points along the shape of your chin, etc.
Post reply on HN