mickey's RFID said:
Walt Disney World fingerprints visitors
Disney is now fingerprinting visitors to Walt Disney World as part of its ticket-fraud prevention scheme. They're not being very transparent about it, either: there are no signs posted about the data collection or retention, and Disney's official line is that they're not collecting fingerprints, just mathematical representations of same.
But those mathematical representations are exactly what you need if you want to join up two fingerprint databases, like Disney's and the NSA's -- while the NSA may store photos of fingerprints, they work with hashes of them, using those mathematical representations to compare and sort prints. Saying that you only store the mathematical representations of a fingerprint is like saying that you only store the mathematical representations of a JPEG, not the actual paint, canvas and frame that it depicts. It's true, but it sure doesn't mean that you haven't captured something important.
...
Disney appears to be claiming that what they store is only a tiny fraction of the mathematical information in a fingerprint, so that it cannot even come close to reconstructing the fingerprint or identifying an individual.
So what good is it? Heres an example of my own design that might help understand the issue:
SUPPOSE that to get into a park you had to enter your SSN on a keypad. (A bad idea but this is just an example.) Does Disney have your SSN in their database? No, they say, all they store is the sum of the digits. So if your SSN is 123-45-6789, they store 45 connected to your ticket. When you enter your SSN, they add together the digits you entered, and if its 45, you pass.
Since you have roughly a 3% chance of matching the digit sum with the wrong SSN, they will catch nearly anyone who tries to use the ticket without the proper SSN. On the other hand you have given away relatively little information about your SSN.
The system that Disney is presumably using is mathematically better because there is no way to duplicate the information of the original ticket owner when using someone elses ticket, and you would be giving away far less information about your fingerprints than you did about your SSN in the example.
But there are two questions:
(1) Will the technology work well enough to make it practical?
(2) Can we trust Disney when they say they are not actually recording fingerprints?
I am tempted say (1) must be "yes" or they wouldn't be implementing it. No point in changing from what they currently have unless the new system works better!
As for (2), given all the numbskulls out there who keep putting SSNs and credit card numbers into laptops and not-sufficiently-secure databases, this would seem to be the least our worries. And yes I trust them.
