Did I Forget to Mention That I Don’t Live in New York City?

For a moment I’m going to veer away from finger, face, iris, voice, and DNA and veer toward geolocation.

I don’t live in New York City.

Technically I don’t live in the Mojave Desert either.

But Ontario, California is closer, both in geography and in climate, to the High Desert than to the Eastern Seaboard.

I guess California knows how to party by walking around with self promotion signs.

Biometric product marketing expert.

And if my biometric product marketing expertise can help your firm, let’s talk.

Reference Material for the Day: Barry’s Borderpoints

Writers need constant access to reference information from credible sources. Generative AI responses and even Wikipedia articles are sometimes not credible enough (although my buddy Bredebot heavily uses the former).

If you need to understand the borders of a particular country, once resource I’ve run across is Barry’s Borderpoints. Interested readers can not only learn about the borders themselves, but also about the identification of the borderpoints, as well as the “tripoints” (places where three countries come together).

Some of you may have interest in Ukraine’s borders with friend and foe. Barry’s article on Ukraine is here.

From Barry’s Borderpoints Ukraine page.

Kalshi, Polymarket, DraftKings, FanDuel, and Gambling Legality

(Bredebot helped write small parts of this post.)

Is it only smartphone game app users who are inundated with an unrelenting barrage of Kalshi ads?

If nothing else, the barrage inspired me to research Designated Contract Markets (DCMs). A DCM is a status granted and regulated by the Commodity Futures Trading Commission (CFTC), a federal agency. As such, Kalshi argues that it is exempt from state gaming regulations because it’s not hosting gambling. It’s hosting futures trading.

Gemini.

But Kalshi and similar apps such as Polymarket are opposed by DraftKings, FanDuel, and other sports betting apps. They make no pretense of “trading futures,” but comply with state-level gambling regulations, and use geolocation to prohibit mobile sports betting in states such as California where it is illegal.

And both are opposed by Native American casinos governed by the Indian Gaming Regulatory Act (IGRA) of 1988, which allows sovereign tribal nations to host traditional Indian games.

And they are opposed by other card houses, racetracks, bingo games, and state sponsored lotteries.

And all are opposed by the traditional Las Vegas casinos…except when they themselves host mobile apps and strike licensing deals with Native American casinos.

But the mobile app variants not only deal with geolocation, but also digital identity verification and age verification. 

And employment verification or non-verification to ensure that football players aren’t betting on football games.

Gemini.

Plus authentication to open the app and ensure Little Jimmy doesn’t open it.

Gemini.

There are all sorts of gaming identity stories…and Bredemarket can help identity/biometric marketers tell them.

“Somewhat You Why” and Geolocation Stalkerware

Geolocation and “somewhat you why” (my proposed sixth factor of identity verification and authentication) can not only be used to identify and authenticate people.

They can also be used to learn things about people already authenticated, via the objects they might have in their possession.

Stalkerware

404 Media recently wrote an article about “stalkerware” geolocation tools that vendors claim can secretly determine if your partner is cheating on you.

Before you get excited about them, 404 Media reveals that many of these tools are NOT secret.

“Immediately notifies anyone traveling with it.” (From a review)

Three use cases for geolocation tracking

But let’s get back to the tool, and the intent. Because I maintain that intent makes all the difference. Look at these three use cases for geolocation tracking of objects:

  • Tracking an iPhone (held by a person). Many years ago, an iPhone user had to take a long walk from one location to another after dark. This iPhone user asked me to track their whereabouts while on that walk. Both of us consented to the arrangement.
  • Tracking luggage. Recently, passengers have placed AirTags in their luggage before boarding a flight. This lets the passengers know where their luggage is at any given time. But some airlines were not fans of the practice:

“Lufthansa created all sorts of unnecessary confusion after it initially banned AirTags out of concern that they are powered by a lithium battery and could emit radio signals and potentially interfere with aircraft navigation.

“The FAA put an end to those baseless concerns saying, “Luggage tracking devices powered by lithium metal cells that have 0.3 grams or less of lithium can be used on checked baggage”.   The Apple AirTag battery is a third of that size and poses no risk to aircraft operation.”

  • Tracking an automobile. And then there’s the third case, raised by the 404 Media article. 404 Media found countless TikTok advertisements for geolocation trackers with pitches such as “men with cheating wives, you might wanna get one of these.” As mentioned above, the trackers claim to be undetectable, which reinforces the fact that the person whose car is being tracked did NOT consent.

From consent to stalkerware, and the privacy implications

Geolocation technologies are used in every instance. But in one case it’s perfectly acceptable, while it’s less acceptable in the other two cases.

Banning geolocation tracking technology would be heavy-handed since it would prevent legitimate, consent-based uses of the technology.

So how do we set up the business and technical solutions that ensure that any tracking is authorized by all parties?

Does your firm offer a solution that promotes privacy? Do you need Bredemarket’s help to tell prospects about your solution? Contact me.

Geolocation, Privacy…and Abuse

(Imagen 4)

I’ve frequently talked about geolocation as a factor of authentication, and have also mentioned the privacy concerns that rise with the use of geolocation for identification.

But sometimes it’s not just an issue of privacy, but something more sinister.

Authentic Living Therapy is a counselor specializing in trauma, abuse, emotional abuse, anxiety, depression, self-harm, parenting, and relationship difficulties. The page recently shared an image post on Facebook with the title

“Tracking someone’s location isn’t always about care. Sometimes, it’s about control.”

I encourage you to read the entire post here.

As with many other privacy-related issues, it all resolves around consent.

  • If Agnes wants Bob to track her location to ensure she is safe, it is fine if Agnes freely consents for Bob to track it.
  • If Bob wants to track Agnes’ location, you need to ensure that Agnes is not being forced to consent.
  • If Bob wants to track Agnes’ location but refuses to let Agnes track Bob’s location, there are many red flags.
By Denelson83 – Own work, Public Domain, https://commons.wikimedia.org/w/index.php?curid=498580.

If you are a tech marketer and want to share how your identity solution protects individual privacy, I can help you write the necessary content. Let’s meet. Before your competition shares ITS story and steals your prospects and revenue.

Tech marketers, are you afraid?

GeoComply, Geolocation, and First-Party Fraud

(Imagen 4)

As you may know, I am a fan of including geolocation as a factor of identity verification and authentication.

So I was delighted to learn that last Wednesday’s Liminal’s Demo Day on First-Party Fraud started with a demonstration from GeoComply.

How does GeoComply use geolocation to reduce first-party fraud?

1. Collect data from a user’s device: GPS, GSM, WiFi, plus IP addresses.

2. Verify location accuracy. Our rules engine runs hundreds of location data, device integrity, and identity fraud checks on every geolocation transaction to detect suspicious activity.

3. Combine real-time and historical data to detect and flag patterns of location fraud. Our models are constantly updated with the use of machine learning and human intelligence.

In his demonstration, Matthew Boland showed an example of someone who had filed numerous chargeback requests in a short period. That’s a red flag in itself.

But when Boland combined the real-time and historical data to analyze the geolocations of the chargeback requests, he found that many of the requests were filed from the same location as the person’s mailing address. So at least that was legit, and the chargeback requests weren’t being filed from China.

In addition to first-party fraud, GeoComply handles geofencing for gambling operations. To see an example of Super Bowl 2024 attempted gambling transactions in Kansas (good) and Missouri (bad), watch this video.

Kansas City (KS, MO) activity on Super Bowl Sunday.

How Many Authentication Factor Types Are There?

(Imagen 4)

An authentication factor is a discrete method of authenticating yourself. Each factor is a distinct category.

For example, authenticating with fingerprint biometrics and authenticating with facial image biometrics are both the same factor type, because they both involve “something you are.”

But how many factors are there?

Three factors of authentication

There are some people who argue that there are only really three authentication factors:

  • Something you know, such as a password, or a personal identification number (PIN), or your mother’s maiden name.
  • Something you have, such as a driver’s license, passport, or hardware or software token.
  • Something you are, such as the aforementioned fingerprint and facial image, plus others such as iris, voice, vein, DNA, and behavioral biometrics such as gait.

Five factors of authentication, not three

I argue that there are more than three.

  • Something you do, such as super-secret swiping patterns to unlock a device.
  • Somewhere you are, or geolocation.

For some of us, these are the five standard authentication factors. And they can also function for identity verification.

Six factors of authentication, not five

But I’ve postulated that there is one more.

  • Somewhat you why, or a measure of intent and reasonableness.

For example, take a person with a particular password, ID card, biometric, action, and geolocation (the five factors). Sometimes this person may deserve access, sometimes they may not.

  • The person may deserve access if they are an employee and arrive at the location during working hours.
  • That same person may deserve access if they were fired and are returning a company computer. (But wouldn’t their ID card and biometric access have already been revoked if they were fired? Sometimes…sometimes not.)
  • That same person may NOT deserve access if they were fired and they’re heading straight for their former boss’ personal HR file.

Or maybe just five factors of authentication

Now not everyone agrees that this sixth factor of authentication is truly a factor. If “not everyone” means no one, and I’m the only person blabbering about it.

So while I still work on evangelizing the sixth factor, use the partially accepted notion that there are five factors.