wizardbeard comments on Persona, Discords "Age Verification" Service, creates a profile of you, sends it to the US Feds and deems you suspicious based on your appearance, exposed by Hackers

[–] wizardbeard@lemmy.dbzer0.com 5 points 8 months ago (1 child)

My assumption is that they are recorded locally, then hashed, then the hash is sent to Azure (Microsoft cloud) as Windows Hello leverages some cloud features. Some things in Azure have warnings about taking up to 24 hours to take effect.

Hashing locally and sending the hash to a server is the same way all passwords for online services and systems work, so nothing nefarious there.

There's probably perceptual hashing so they can count 95% similarity as a match without having to check against the source material every time.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Monument@lemmy.sdf.org 9 points 8 months ago

I could accept that it has to do with azure propagation delays, but the verbiage was explicit about our computers syncing to the tenant. (Vs. data propagating across it.)

I sort of reject the idea that there’s nothing nefarious going on. The misdirect is weird.

Unless they’re salting the hashed data with information they can’t access, they’re just creating a database of faces and fingerprints.
Sure, maybe if their cryptography is good the DB cannot be reversed but they can still use an unsalted database to give match/no match info on scans of faces and fingerprints submitted to it.
But also, I firmly don’t trust Microsoft. They’ve violated our ELA several times - mostly around applying analytics tools to our data without consulting us first. (Like rolling out MS Viva without telling us.)

permalink

fedilink

source

parent