Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys • Hacker News Board

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#41

Post by mysterydip » Wed, Dec 28, 2016, 5:34 PM UTC

dvdhnt wrote: post #14

Waterluvian wrote: post #9

Earlier quoted context omitted.

As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!

Parent here, of a toddler and a 1st grader, and based on my experience it's all about context. For example, if any of the following are true, the TV exists: TV is on or the children are inside and sedentary. Conversely, from the children's perspective, they tend to forget the TV exists or is an option if otherwise preoccupied indoors by activities like painting, reading, playing pretend, etc., or are in fact outdoors…

To add to this (as the parent of a toddler), your usage patterns may have to change as well. I love taking videos of my daughter and she loves watching them. So when I pull out my phone to check email or a text, if she sees me do it, suddenly it exists in her world and she wants to watch videos asap.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#42

Post by manarth » Wed, Dec 28, 2016, 5:34 PM UTC

nfriedly wrote: post #15

> ordered 13 Pokemon gifts [...] was only allowed to return four of the items What's up with that? Isn't there a law that limits liability for unauthorized purchases to $50? (And don't most banks and credit cards just make it $0?)

I'd guess that some of the products were from Amazon whilst others were from third-party vendors.

As for the question of liability, there's usually a proviso for taking legal/criminal action against the perpetrator. Even if the parent wanted to take action against their child, being below the age of criminal responsibility, the parents may be legally responsible in any case.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#43

Post by satysin » Wed, Dec 28, 2016, 5:34 PM UTC

icebraining wrote: post #13

Waterluvian wrote: post #6

Earlier quoted context omitted.

Yup. In my opinion, this isn't a problem that needs solving. I bet with thumbprint security, money is more secure from house hooligans than it was when held in a wallet.

Maybe, but on the other hand, most people don't keep $250 in their wallets. Having an extra verification mechanism for expensive purchases seems appropriate.

Yeah I think there should be a limit (which you can override with a password) on how much money you can spend in a certain time period. Make it $10/day or something as default and let the user change it. Works well enough for mobile contracts to prevent over spend IMHO.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#44

Post by scrollaway » Wed, Dec 28, 2016, 5:39 PM UTC

sbuttgereit wrote: post #8

aaron695 wrote: post #2

"used her mother's thumb to unlock a phone and open the Amazon app as mom napped on the couch" Or she made it up.....

This is the problem with "news" stories like this... and why I hate them. We would have no way of knowing if this happened or not. It's plausible, but plausible isn't the same as "it happened". One could say at best its value is as a cautionary tale to other parents, but I'm willing to bet that if you're a parent you've probably seen the potential for this sort of thing develop in your child already... of course that…

> It's plausible, but plausible isn't the same as "it happened".

I don't entirely disagree but really, in the context of a fairly trivial matter for anyone who isn't the person in question, what's the difference?

For example, I found a 20 euro bill on the ground at the ATM the other day. It makes no difference to you whether that's true - it only makes a difference to me and the person that lost the bill. At best it serves as a cautionary tale to those that don't pay attention to their money at the ATM.

If the story is plausible (that is, possible and not unlikely) and isn't particularly exceptional (such as, "click here to find out about obama's secret slave trading circle"), what's the difference?

That is, what is the concrete difference, to you and anyone commenting here, whether that child really did that or not? It's not unlikely enough that it would not occur. And we've seen a lot of very real stories about children stealing credit cards to spend hundreds or thousands on mobile games. And if you don't believe those either I can give you a personal account: When I was a kid I repeatedly broke the parental phone lock to call expensive numbers on the TV.

This is an iteration of the same thing.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#45

Post by justinkramp » Wed, Dec 28, 2016, 5:42 PM UTC

saosebastiao wrote: post #28

Waterluvian wrote: post #11

Earlier quoted context omitted.

I disagree. Fingerprints are privacy locks, not security locks. The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter". A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.

I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords. A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password…

Identity Authentication Authority

I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc.

On a phone, it's an interesting shift because with a PIN, we essentially bypassed the need for identity and used only a password; regardless of who you are, you can get in if you have the right key.

With the move to identity being sufficient to unlock a device, we're saying that just on the basis of identity, the authority that used to come with a password (sans identity) can be granted. It's a 180 degree turn.

I don't see a way on my iPhone 6s to require both Touch ID and PIN; it's one or the other. Very few interactions require both, i.e. after a restart it requires the PIN before Touch ID will work.

edit: to clarify the difference

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#46

Post by Latty » Wed, Dec 28, 2016, 5:43 PM UTC

Waterluvian wrote: post #9

cosmie wrote: post #3

Earlier quoted context omitted.

The mom? I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.

As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!

Kids are not addicted in most cases, they are exploring. They don't know what options there are, or how far these things go, they just want to try it. If you present a child with lots of options, they won't stay with one all the time, for sure.

My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with friends, or playing football, or swimming, etc...

Children find things they like and explore them. Yes, as a parent your job is to get them to try a wider range of things and open them up to other stuff, but it's not 'screens' that are suddenly a new danger.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#47

Post by dvdhnt » Wed, Dec 28, 2016, 5:45 PM UTC

Waterluvian wrote: post #19

dvdhnt wrote: post #14

Earlier quoted context omitted.

Parent here, of a toddler and a 1st grader, and based on my experience it's all about context. For example, if any of the following are true, the TV exists: TV is on or the children are inside and sedentary. Conversely, from the children's perspective, they tend to forget the TV exists or is an option if otherwise preoccupied indoors by activities like painting, reading, playing pretend, etc., or are in fact outdoors…

That seems very intuitive. I wonder how it translates to mobile devices. I suspect the same applies, so long as I apply the same discipline to providing access to the tablet. If they're inside and sedentary, they'll want it. If it's not tablet time, keep them busy.

You're spot on about your own discipline. Building on what mysterydip said above, your habits transfer almost entirely IMO. For example, if I'm working from home or answering an email, and my wife is using her phone, my daughter will often ask if she can stop whatever it is she is doing, like coloring, and instead play with her tablet.

It really does encourage you as a parent to have discipline with not only their screen time but your own as well.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#48

Post by jenamety » Wed, Dec 28, 2016, 5:47 PM UTC

loarake wrote: post #36

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

There's a cool dystopian-ey youtube video briefly looking into that topic, among other things: https://www.youtube.com/watch?v=YJg02ivYzSs

very cool, thanks

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#49

Post by dvdhnt » Wed, Dec 28, 2016, 5:50 PM UTC

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

> 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )

It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. For example, what if authorities compel accused individuals to store their thumbprint rather than use it directly? Is that possible? And how will it be protected?

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#50

Post by sogen » Wed, Dec 28, 2016, 5:51 PM UTC

sdegutis wrote: post #34

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

Chopping off your thumb is only in movies, where logic barely exists. In real life, you can cancel your funds and reverse their fraudulent transactions.

Only in movies? Lol