OPINION: Apple Goes Face-to-Face with Bitcoin on Privacy
Apple’s plans to offer a facial recognition system has one downside for cryptocurrency users – it will lift the veil of anonymity that is a bedrock of the ecosystem.
Apple showcased the latest updates to its iPhone lines on Tuesday with a live event at the new Steve Jobs Theater in Cupertino, part of Apple’s reconstructed space-age campus.
As expected, Apple unveiled the iPhone 8, iPhone 8 Plus, and a new iPhone X. Apple CEO Tim Cook told the live audience that Jobs “would be proud” of the product line, which showcased facial recognition and wireless charging as its two big developments.
Unlike many predecessor devices and Android phones, the iPhone 8 ships with iOS 11. This version of Apple’s operating system is immune to the recently discovered Bluetooth vulnerability “Blueborne,” making it a much more secure device for bitcoin and other digital currency wallet apps.
However, by tying its Apple Pay system to its facial recognition, Apple lifted an important protection. While the company claimed that it is protecting personal information and doesn’t collect any transaction information that can be tied back to the users, Apple simply has to collect identifying information in order to relay it to the bank or other funding provider.
That means your fingerprint, facial scan, possibly your password, and all the personal information Apple has on you from your app usage is, at least for a time, all in a single place.
Whatever they may say about security or privacy, they’ve created a single point of failure where an exploit could prove far more damaging than the recent hack of Equifax. Note that Equifax didn’t even realize the exploit was being used for WEEKS before they even began trying to patch their systems.
By tying Apple Pay to the hardware systems, the anonymity cherished by cryptocurrency users starts to melt away.
THE SLIPPERY SLOPE
Bitcoin is pseudo-anonymous. Anyone can view the records in the blockchain that match some wallet address, and you can trace the transaction history of that address all the way to the first time it was used. But all that appears are addresses – long alphanumeric strings.
If someone wanted to discern your identity from such a transaction history, they would have to find a transaction conducted non-anonymously, for example a purchase through an exchange, which will have your info on file for compliance purposes. Or from a bitcoin ATM, the operator of which will have your phone number and possibly a picture of you making the transaction.
You have to go through a lot of hoops to derive identity from this data. Even when you find that one or several transactions, you have to get the identifying information from the other party to that transaction – meaning you have to get a subpoena, hack an exchange, or find an ATM operator that doesn’t care about security or privacy.
In contrast, Monero is truly anonymous. Everything is encrypted. All encryption can be broken, but the encryption currently used and the processing power available today means it would take an exceedingly long time to break. We’re talking longer than a human lifespan. Improbable exploit: if somebody figures out how to build a quantum computer that can perform trillions of calculations concurrently and in a split second, the encryption could be broken. But we don’t yet have quantum computers that can handle an 8 bit number, let alone 256 or more bits. It will be a very long time before such a machine could be built at all, let alone made available to people intent on hacking your money.
Cash is similarly anonymous. Unless you make a transaction within sight of a video camera or somebody immediately pulls your fingerprints off the bill, no one will ever know that you used that $20, let alone what you bought with it.
Apple Pay and services seeking to emulate its model represent a slippery slope kind of privacy threat. The more personally identifying data about individual people, the greater the incentive for a bad actor to hack it. More and more people using any such service increases the hacking incentive exponentially. We are no strangers to successful hacks of financial information – these kinds of things appear in the news with alarming frequency. With these, they can only get your name, Social Security number, credit card info, and the like.
Imagine if they could also get your fingerprints, biometrics that can reliably identify you, the possibly incriminating instant messages you don’t want your spouse to see, your internet browsing behavior, your exact location at the time, the names and phone numbers of all your contacts, and how skilled you are at Candy Crush.
If Apple move forward with its plan to tie Apple Pay to its hardware platform, others will follow. That means there will be a strict line drawn between identity money and non-identity money.
It’s ironic that a company that once advertised a new product with an homage to George Orwell’s 1984 has now taken this step. Perhaps it doesn’t fully understand the ramifications of its payment system. Or worse, perhaps it does. 
