An anonymous reader writes:
Today I passed up a purchase because they *required* me to sign on their signature pad for a credit card purchase. For years now I have been bypassing this by signing on paper. Today, a retailer told me that they no longer allow customers to sign on paper, only the signature pad.
I have several problems with signing on an electronic signature pad (examples of these here: http://www.topazsystems.com/products/index.htm and here: http://www.ingenico-us.com/signature-capture_4.html?lg=US&categoryId=16).
First, I am told nothing whatsoever about what method is used to store my signature. Is it sitting on an unsecured *nix box with a nice fat pipeline to the internet? Is it "in back" where any employee can access it? Second, I am told nothing whatsoever about *if* any security is used and what type or strength of security is used. Is any encryption used with my data? Is my signature stored with my CC# in a .jpg file? If encrypted, is it a 64-bit key? 128 bit? This information is routinely given by my web browser on secured web pages. It should be available at point-of-sale as well. Third, I have much more faith in the physical security given to a piece of paper than I do the "virtual" security used by computers. To me, this is analogous to the Diebold / voting snafu. The retailer will protect the paper inside his store. It will probably be kept with cash and given the same security considerations cash is (i.e. kept in a safe at night, kept locked in a cash drawer most of the day, etc.). The retailer probably has no idea how to keep virtual files safe (i.e. don't connect the box to the internet...). And even if the retailer *does* know how, what is their motivation to do so? With the physical paper, it's kept with the cash so nothing special is required. With virtual files, there's a good chance no one even realizes they exist.
Given some of the recent failures on the part of retailers to protect their customers CC data (Marshalls/TJ Maxx, etc.), I have little faith that they are doing any real due diligence with their customers' data. It would not surprise me at all if there were *NO* security/encryption and this data is being stored on a box "in back" that has a WAP connected and a fat physical pipe to the internet.
Is there anyone that works/worked with these systems that can (unofficially) address my three points? I don't want the company line; I want someone who knows to tell me what they really think. I'm also curious how many others out there have given any thought to the security / Identity Theft issues with these security pads. Do you sign them? Do you feel secure doing so? Did you ever think about it? Thanks to all! (Posting /. as AC since before the .com boom).
