Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×

Pay By Touch Goes Online 85

Posted by ScuttleMonkey from the sort-of dept.
Max Fomitchev writes to tell us that Pay By Touch, the biometric identification service, has announced an online version of their service. While currently the only implementation of this service is in the brick-and-mortar storefront of Star Markets grocery stores, the company hopes that online vendors will start signing up soon.
This discussion has been archived. No new comments can be posted.

Pay By Touch Goes Online More

Pay By Touch Goes Online

Comments Filter:

  • Finally! (Score:5, Funny)

    by Corbets ( 169101 ) on Sunday August 20, 2006 @07:21AM (#15943610) Homepage
    Finally, the world of "Back to the Future" is coming to us! Now if I can just get that hoverboard I've always wanted....

    • Re:Finally! (Score:5, Funny)

      by sugapablo ( 600023 ) on Sunday August 20, 2006 @07:25AM (#15943615) Homepage
      Back to the Future? What kind of /. nerd are you? First thing that came to my mind is Quark handing me a data pad for my thumbprint.

      Now if I can just get into one of his holosuites and take a spin at "Vulcan Love Slave 2: The Revenge"!
    • I'm thinking more of a movie like Gattaca, where the guy goes as far as glueing fake fingerprints of another person on his to pretend to be another person. Not sure how hard that really is, but I'm sure it can't be too out of the question, specially if some con artists wants to pull it off that badly. Of course you have to get a good copy of the originals to make the fakes to begin with.

      • Re:Finally! (Score:5, Interesting)

        by JanneM ( 7445 ) on Sunday August 20, 2006 @09:58AM (#15943913) Homepage
        Not sure how hard that really is, but I'm sure it can't be too out of the question, specially if some con artists wants to pull it off that badly.

        Fingerprints are not hard at all; it's been done, and done well already. You can google for detailed instructions.

        Basically, you scan the fingerprint by any means you have (it depends on how and where you could lift it). Print it on transparent OH film, then use it to etch a negative print on circuit board - this just requires standard stuff you can get in any electronics store of course. Use that negative as the mold for a latex positive; in the simplest case, just dab a solid layer of latex on your fingertip and press on the mold until the latex hardens.

        The beauty, if that's what you want to call it, is that once you have one scanned print, you can trivially duplicate and send it as a black and white image to anybody, anywhere who wants to use your print.

        Fingerprints very seriously suck for identification nowadays.

        • Re: (Score:3, Insightful)

          by b0s0z0ku ( 752509 )
          Basically, you scan the fingerprint by any means you have (it depends on how and where you could lift it). Print it on transparent OH film, then use it to etch a negative print on circuit board

          Why bother? Just steal the hash data that is generated by the scanner and use a hacked driver to inject it into a browser or whatever. Passwords can be changed. Fingerprints can't be (painlessly). Let's hope that this system is using both fingerprints and passwords/keys. And let's hope it won't become ubiquitou

    • Re: (Score:1)

      by WeeBit ( 961530 )
      Back off! that hoverboard is mine! All mine!

  • Grocery Stores? (Score:4, Funny)

    by JonathanR ( 852748 ) on Sunday August 20, 2006 @07:26AM (#15943616)
    What about strip clubs?

    • Re: (Score:3, Funny)

      by tomhudson ( 43916 )

      "What about strip clubs?"

      Sorry, but its only in Soviet Strip Clubs that you're allowed to pay for touching yourself!

      I can see someone might want to substitute "pay-by-touch" in such situations, though:

      An anglo from Toronto, a Quebecer, and a newfie from Newfoundland go to a strip club in Montreal (yes, this is a Kanuckistani joke)
      The Quebecer gets a lap dance, and slips $10.00 in the strippers' panties.
      The Torontonian gets a lap dance, and, not to be outdone, slips $20.00 in the strippers' pantie

  • dinger? (Score:5, Insightful)

    by adam ( 1231 ) * on Sunday August 20, 2006 @07:28AM (#15943620)
    FTFA: "allows making online purchases with a slide of a dinger across the scanner" (emphasis mine)

    really.. a dinger..? you don't say...

    The whole fingerprint-for-payment-at-the-store thing has been debated here plenty before, so i'll steer clear of it.. but TFA (well, TFblogpost) is centered around Pay By Touch launching a service that lets you scan your fingerprint at home and autopay at various online websites with a simple swipe of your finger. I don't know who steered them down this path, but they should be fired.. promptly.

    I can recall several dotbombs that had this same business model (an e-wallet that had all your info in it already so all you needed to do was purchase from participating vendors and a username/password/whatever was all you'd need to make each purchase), and they all failed miserably. Anyone remember flooz [com.com]? Maybe i'm just a cynic and these guys will have a fresh new approach that will catch on like wildfire.. but it seems a nonstarter to me, since none of the failed dotcoms so much as required you to have a biometric scanner in your home.
    • I figure it to be a biological dongle

    • Re: (Score:2)

      by Bastian ( 66383 )
      I can recall several dotbombs that had this same business model (an e-wallet that had all your info in it already so all you needed to do was purchase from participating vendors and a username/password/whatever was all you'd need to make each purchase), and they all failed miserably.


      Except, of course, for PayPal, which is wildly successful to the point of being the only payment option for many (possibly most) small-time storefronts I see on the Web.
      • WorldPay, backed by the Royal Bank of Scotland, is gaining ground on PayPal (in the UK at least)and it's fairly easy to use except that unlike PayPal it refuses to store card details so you have to go to the bother of fishing your cc out of your wallet every time.

  • Privacy Concerns ? (Score:5, Insightful)

    by Davemania ( 580154 ) on Sunday August 20, 2006 @07:30AM (#15943623) Journal
    Inevitably, this issue will come up. Traditionally, if your credit card or bank card is compromised, you can simply cancel it and acquire a new one but what about biomatric data used for identification ?

    • Re: (Score:2)

      by Xugumad ( 39311 )
      Hey, stop asking awkward questions about problems security experts have known for years! Bad consumer! No biscuit!
    • Simple. Chop of the fingers and attach new ones. Why do you think there is this research on atrifical limbs and skin regrowth? To make you a good consumer! It also increases security, as each of the 10 fingers can have a different password since new fingerprints can be put on each.

      So, don't ever ask to have your password reset. You have been warned!!!!

    • Re: (Score:2)

      by smchris ( 464899 )
      Let's follow the steps:

      1. We are in a nation of, by and for the corporations.
      2. With the new bankruptcy laws, corporations do not have a problem with your lifelong responsibility and if a method can be agreed upon whereby the incurred obligations "more clearly point to you" all the better for the corporations.
      3. So the nation does not have a problem. Any squawking is just the sound of poultry caught in the machinery of the system.

      The general public could prove to be too inteligent to make wide adoption
      • Consider the guy who successfully argued that the bank shouldn't have let him use so simple a password.

        Did something like this actually happen and did someone win a court case against a bank? Whatever happened to personal responsiblity and taking the blame for one's own (erroneous) actions?

    • The answer here is called "anti-spoof," or more appropriately "live finger detection."

      Quite a lot of research has gone into how the fingerprint scanners themselves can distinguish live human skin from other materials, or even dead human skin. There has been much success in this area to date, and you should expect to see this new technology in products before too long.

      What this equates to is you having to be physically present at the time of authentication, as it will be impossible for someone to spoof

      • what if someone chops off your finger and uses it? huh! huh!! huh!!!

        UP Next: How Muggers cut away their victims fingers and make sure it lives long enough to make a withdrawal.
      • What this equates to is you having to be physically present at the time of authentication, as it will be impossible for someone to spoof your finger, even if they were successful at lifting a latent print from off of something you touched.

        Only good if the scanner is being watched all the time. With a scanner on a computer and on-line purchases, you could just spoof the datastream coming from the sensor and feed it into a hacked driver. Mark my words: the protocols *will* be cracked. And this will be go

        • you could just spoof the datastream coming from the sensor and feed it into a hacked driver.

          Hacking this protocol would mean hacking the PKI security it is wrapped in, at which point you would be breaking the equivalent to SSL and stealing someone's banking information. Good luck.

          The data coming off of the sensor is not going to be usable by anyone without the private key of the hosting system; and if you can get this key, the problem is no longer specific to the biometric system being used.

    • Re: (Score:2)

      by symbolic ( 11752 )

      If your fingerprint is compromised, they'll just ask for your password.

      • Re: (Score:2)

        by VENONA ( 902751 )
        I'm betting on on them asking for the last four digits of my social security number. Wow, how did I get that cynical?
    • Don't forget the fact that most (all?) cards provide some sort of fraud insurance (typically you're only on the hook for the first $50). What kind of insurance is this vendor offering?

  • Dumbasses. (Score:5, Interesting)

    by wfberg ( 24378 ) on Sunday August 20, 2006 @07:44AM (#15943642)
    They say: "Your finger is unique to you, which means only you can access your financial accounts. The Pay By Touch service helps protect you from physical or identity theft. Because there's nothing to carry, there's nothing to be lost or stolen."

    Really?

    What about the fingerprint information you're evidently (there's nothing to carry) sending over the wire? No way to intercept that huh? How about the fingerprints you leave on just about everything you touch? No way to lift those off of that surface and to use them on a scanner, in the case of on-line purchases, a scanner that's right there beside you without anyone looking over your shoulder to see you're actually using your own finger and not some copy made out of gummy bears.

    • Re: (Score:2)

      by Bozdune ( 68800 )
      You win for best comment in this thread. Gummy bears. Loved it.

    • Re:Dumbasses. (Score:4, Interesting)

      by Rich0 ( 548339 ) on Sunday August 20, 2006 @08:28AM (#15943732) Homepage
      Agreed - a biometric authentication needs to run on trusted hardware. I could use one safely to let people into my computer. However, I wouldn't tell my fileserver to serve up my files to any computer that claims I stuck my finger onto their scanner.

      The reason is simple - whoever controls the hardware can tell the scanner to report whatever it wants, mount data replay attacks, etc.

      Even if the scanner this company is using is ultra-strong and can tell fingers apart from gummy-bears, who is to say I'll even use their scanner. All I need to do is take one apart, figure out how it works, remove any embedded encryption keys, and then create my own "virtual" scanner that reports whatever finger-prints I want it to. As the parent mentioned, there is a ready supply of fingerprints - I might start with my mailman who leaves his on my front porch every day.

      And even strong biometric systems have problems (inability to change compromised credentials for one). This system isn't even remotely strong from the start.

      Here is an idea for a payment system that would work. Credit card with no mag stripe - just a smart-card interface, a small LCD display, a small PIN entry pad, and a small acoustic modem (possibly an external device that the card can be attached to easily), and a tiny USB interface. Card contains SSL key known to nobody, but the cert is signed by the bank issuing the card (with CRL available). I walk up to a check-out counter, and insert my card, and then remove it. The card displays the transaction amount on the display, and I enter my PIN on the card. I re-insert the card, and the transaction is complete. Transactions are time-stamped and cannot be replayed (unless the transaction is a subscription which would be noted on the display). PINs are entered on the card itself - so no capturing these unless you have a camera overhead. SSL key never leaves the card, so without physical card presence you can't make transactions. Acoustic modem / USB can be used for online or phone transactions - again with full security.

      This would resist just about every form of fraud that is common today. Without the card and the PIN you can't make a transaction. Sure, you could steal the card and force somebody to enter a PIN at gunpoint, but this is not a significant source of fraud (and while we're at it we could have a 2nd call-police PIN that still makes transactions appear to work). The only downside is the implementation cost - but I wonder if it wouldn't pay for itself pretty quickly...

      • You're almost describing the EMV (Europay MasterCard VISA) standard for smart cards, implemented in the UK as Chip & PIN [chipandpin.co.uk]. The chip on the smart card is used during the encryption process and cardholder presense verified by a PIN, which is encrypted on the numberpad, before it gets any further (thus providing two factor authentication.

        It has drawbacks, direct and indirect observation of the PIN plus it doesn't stop card cloning, as the mag strip still exists. Indeed specially rigged readers [bbc.co.uk] were used th

        • The system has a few drawbacks:

          1. The merchant can charge you for more than the authorized amount. They need only modify the PIN-pad device to display one amount and charge a different one. The charge should be displayed on hardware controlled by the cardholder/bank.

          2. Not sure if the device is using SSL certs and signed transactions. If it is just a static account number with a PIN it could easily be cloned.

          3. If criminals are using rigged readers they wouldn't even need to clone the cards. They cou

    • Re: (Score:2)

      by Duncan3 ( 10537 )
      Exactly, it's been shown over and over and over again that fingerprints are trivial to fake.

      And ANYTHING done remotely is insecure unless you control the hardware, and you can't.

      Rather amusing that people still try this crap.

      .
    • Now instead of handing the a mugger my debit card or whatever, they'll be demanding a finger. Thanks a lot ye pushers of unnecessary technology.
  • I mean how do we know that fingerprints are 100% unique? And what if someone finds a way to abuse the system? I think this will just be to open unecessary doors for abuse.

    • Re: (Score:2)

      by sbaker ( 47485 ) *
      Fingerprints certainly aren't that unique. They are unique in the sense that in very fine detail there are no two alike - but they most certainly aren't unique when it comes to the resolution that these scanners work at.

      A typical fingerprint scanner has to allow for rotational and translational differences and differences in pressure and pad and finger cleanliness between applications of the finger to the pad.

      Then it has to cope with image recognition matters - it has to pull out features from the print an
    • I mean how do we know that fingerprints are 100% unique?

      Passwords and crypto keys aren't 100% unique either, most likely, especially with the weak passwords many people tend to use.

      -b.

  • I've often criticized that anyone that would have a feasible success with a system for purchasing using biometeric identification will be one of the major credit card companies. Also, what I find discouraging, is that the system offers no apparent form of biometeric confirmation. A fingerprint and pin number would be far more desirable than simply a biometeric reading. What happens in the event of a false positive? Fraud? Lifting fingerprints is easily done, and the technology exists for even hobbyists to f

    • Re: (Score:1, Interesting)

      by Noxal ( 816780 )
      Actually, there is a PIN that you have to put in after you scan your finger. They call it a "search number" and recommend that you make it your phone number...crappy, but you can still set it to whatever you want.

  • Incidently.. (Score:4, Funny)

    by Propagandhi ( 570791 ) on Sunday August 20, 2006 @08:20AM (#15943720) Journal
    This isn't directly related to the topic at hand, but my collection of people's fingers also goes 'online' today.

    I needed a hobby and a little more cash, this should solve both of those problems.
  • finger prints are quite cool in real life, cos they can produce random numbers but with common features that can be identified. They also have a prescence-thats a bit hard to explain, but imagine going into a shop, approaching the cashier and saying you've left your cc at home.. its ok tho, cos u remember the number and they can just type it into the till manually.

    go on, try it :)

    When we're transmitting over the web, it becomes just a number we're sending, a number which can be intercepted, saved, sto
    • imagine going into a shop, approaching the cashier and saying you've left your cc at home.. its ok tho, cos u remember the number and they can just type it into the till manually.

      I dont have to imagine that since Ive done it... works great! No more or less secure than paying by CC over the phone. Also my wife using my CC even though she's not technically authorized. A clerk that wants to make a sale is going to do whatever it takes to get the charge through. Once I called my bank and had them give me my

  • Not the only stores (Score:4, Informative)

    by WhiteWolf666 ( 145211 ) <{sherwin} {at} {amiran.us}> on Sunday August 20, 2006 @09:39AM (#15943857) Homepage Journal
    Star Markets may be the only stores in the U.K., but in the U.S. the cub foods and Jewel/Osco chains both have deployed Pay By Touch. That's a fairly significant foot print, at least near Chicago.
    • Yeah, I saw one at a Cub Foods outside Chicago. I only go there for banking and the only one I saw was near the cigarette booth. Wasn't that long ago they went through some construction to put up those self-checkout aisles. I probably only bought deodorant and pack of chewing gum or something, but that (self-checkout) was quite expedient. Might be a bit quicker, but is fingerprint ID much safer?
    • A small, family-owned grocery store in Upstate New York started a "pay by touch" system. They took it further by adding individualized rewards. The database will remember what each customer purchases, and offers them customized coupons, promotions and rewards. http://www.paybytouch.com/news/pr_10-18-05.html [paybytouch.com]
    • Piggly Wiggly, a fairly big regional chain here in the Southeast, has offered Pay By Touch for well over a year.

  • Repudiation? (Score:5, Insightful)

    by Indy Media Watch ( 823624 ) on Sunday August 20, 2006 @09:44AM (#15943875) Homepage
    If there is a fraudulent transaction, and someone can argue (albeit wrongly) "the only way the transaction could have happened is with your fingerprint" - won't this make it harder to dispute a charge?

    • Come on! We are all nerds here! Why hasn't anyone here gotten it? Its really simple. Biometric payment schemes are all just fancy passwords, the only problem here is that the password that is the weakest to break is one that never changes and which may be read by those in public. Your fingerprints never change and they can be read in public. Worse yet they also can be conterfitted easily by very simple technology. They also can be obeserved quietly and without intrusion as was noted by a few other poste

      • Re: (Score:1)

        by Rubzo ( 965943 )
        We could all just take a leaf out of Michael Jackson and constantly wear a glove on our ID-finger hand, only taking the glove off to make a transaction. Hell, we could have gloves with zipper-fingertips. I bet glove companies are drooling at the thought of all this.

    • Re: (Score:3, Insightful)

      by RexRhino ( 769423 )
      Absolutly!!! As we have learned from the Slashdot story on car anti-theft systems, and insurance companies denying claims against people with anti-theft systems ("there is no way anyone could have stolen your car, you must be trying to scam us!!!")... this kind of system makes things less secure, because no-one is going to believe you if you have money stolen.

      And not only that, if you try to dispute a charge, not only will they deny that - You will be under investigation for fraud!

      So long as I am only liabl

  • First! (Score:2, Insightful)

    by anicca ( 819551 )
    First it starts as a convenience somewhere, catches on with all the dumb lazy citizens, then becomes ubiquitous, then it becomes mandatory!
    • First it starts as a convenience somewhere, catches on with all the dumb lazy citizens, then becomes ubiquitous, then it becomes mandatory!

      Credit cards already provide a viable tracking mechanism, and they haven't become mandatory in lieu of cash. I think the first politico to force through a law to make this mandatory would end up strung up from the nearest lamppost courtesy of the more extreme xtians that we have in the US. And rightly so - I'd even help tie the noose.

      -b.

      • Re: (Score:1)

        by anicca ( 819551 )
        Yes but not everyone has a credit card or the money to pay for one. Won't matter with the chips, everyone can power one of those for the same cost to big brother. However, I hope you are correct but doubt the people will awaken to their peril before it is too late... like the ongoing drug war that PROVIDES the profits for the ruthless, the 'terrorists' RELY upon drug prohibition to wreak havoc but I bet the average US citizen would just think "I dont want my kids strung out on drugs" so keep the drums beati
        • If the people can be made to believe that the drug war is good, they can be made to believe subdermal implants are good too. Manufactured consent by emotional manipulation.

          I hope that it won't work. As I said, though I'm not one, Christian zealots do have their uses. And politicians who pass harebrained and unconstitutional schemes to track and further erode people's rights deserve no less deportation to some place where their ideals are agreeable. North Korea or Libya would be a good start. Maybe the

          • Re: (Score:1)

            by anicca ( 819551 )
            "I hope that it won't work. " Amen to that! :) "As I said, though I'm not one, Christian zealots do have their uses." Like promoting atheism? ;)
  • One thing that worries me is at what point are you rich enough for somone to cut your finger off? What I don't like is that it's kind of like assimilating your financial standing with your physical body.

    That seems wrong on plenty of levels, the simplest of which is that when someone mugs you, conventional wisdom says that unless you're far more prepared than they are, you give them everything you have. When 'everything you have' begins to include your right index finger, then mugging is way easier in a cr
  • Everyone seems to be trying to find the obvious flaws in a system like that. Truth is, it really is easy to get around some system that just checks the print for itself. However, there's a lot more to check than just the print. The easiest would be warmth, then electrical current, although they're also easy to bypass. Put some more checks in and bypassing it feels a lot more difficult, for instance, pulsation and oxygenation.
    • Really? And just how would you get your personal scanner to check for all that?

      PCs have been going down the wrong road ever since the first one came out. The only really 100% reliably secure payment scheme would require absolutely closed PCs, ones that didn't allow third-party software to run, as well as a rigidly-policed network. Any person/company that wanted to write software would have to be federally licensed and would be under extreme 24/7 monitoring. Anyone else would be locked out of the system usin

      • PCs have been going down the wrong road ever since the first one came out. The only really 100% reliably secure payment scheme would require absolutely closed PCs, ones that didn't allow third-party software to run, as well as a rigidly-policed network.

        And you thing this is a *good* thing? Maybe in Trollville, but not in a free and democratic society. Besides, it would probably strangle innovation completely - some of the best ideas in computing, including the PC itself have come from hobbyists.

        We alr

        • You must be a programmer. I can understand your point-of-view. Really I can. "Information must be free, the best programs are open-source, etc." And you're right. But I was speaking from the point-of-view of a developer of a secure worldwide identity/financial system. This is a much different and more limited situation than commercial software creation. In this scenario, a lot of innovation and creativity is exactly what you don't want. What you want is a system that works, is 100% error-free and fills all
          • You must be a programmer. I can understand your point-of-view. Really I can. "Information must be free, the best programs are open-source, etc." And you're right. But I was speaking from the point-of-view of a developer of a secure worldwide identity/financial system.

            Guess what? I wouldn't *want* a secure identity system on the Internet. Anonymity = good. Financial? Just take the same approach as credit cards and make good any "shrinkage" that occurs. It's not that information wants to be free - it's t

      • Most people/companies find it acceptable to give up some security so that software development isn't greatly stagnated. What you're proposing would essentially kill open-source, which is a tremendous source of creativity. If we'd taken this road, our world would likely be less computerized than it is now. Less programs means less reasons to have a computer.
        • Please read my reply above.

          Open-source software development and creativity aren't the issue here, security is. Any workable identity/financial system must be kept completely separate from other types of systems, all the way down to the hardware on individual computers. What good is financial software if it can be easily hacked? And "easily" is a relative term here - if the rewards are great enough then it won't be long before someone somewhere applies whatever amount of money is necessary to break it. Remem

  • Pay By Touch

    Great name !

    the biometric identification service,

    Yeah... it sounded to kinky to be true....
  • I think I'm much more likely to trust a non-net version fingerprint reader, like the ones that are shipping with many laptops now.

    Many of those have "password managers" that will get you into your money/email/Windows/whatever by swiping your finger, and the fingerprint information never goes across the internet. Plus it has the added bonus of working with a lot more than just these guys' proprietary system.
  • So what happens when a corrupt CIA/NSA programmer decides that he needs some extra money, spends a couple seconds to write an app to feed data from the CIA fingerprint database, and proceeds to embezzle millions of dollars? It'd be laughably easy to do, as the CIA database probably contains more datapoints/fingerprint than a system a commercial endevour is going to use.

    Biometrics are a bad idea if they are the only form of confirmation, the same way the PIN numbers or signatures are laughably weak on their
  • Green Hills [greenhills.com], a Syracuse NY grocery store also uses Pay By Touch. It's one store only, not a chain. They like to brag about Inc. Magazine naming them the best little grocery store in America.

    Not sure how long they've had it. It's part of their "SmartShop" program that also creates custom discounts and shopping lists personalized based on your previous purchases. They seem very advanced in that type of stuff, and it has helped them create a very loyal customer base.

    -Pete
  • You can pay-by-touch at Jewel grocery stores too.
    • Cub Foods in Minnesota also has pay-by-touch set up in many of their locations.

      So fie on you, summary.
  • Just to make the machine seem more appealing, why not make it say things like "Ooooo baby, I love the way that feels.", "Oh yes! Right there, God that feels good!", "No, not there, just a little lower. A little lower."

    Contrarly, and with much humor, the opposite should also be stated: "What? You are just going to leave me like that?", "You're in love with the other machine in 12-items or less! You bastard!", "Sure you'll commit to buying that 12-pack of beer. It's just too bad you'll never commit to our

Slashdot Top Deals

"Here's something to think about: How come you never see a headline like `Psychic Wins Lottery.'" -- Comedian Jay Leno

Close