Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

cnet.com

Post reply on HN
Print view View original

61–70 of 141 posts

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#61

Post by alex- »

icebraining wrote: post #13
Waterluvian wrote: post #6

Earlier quoted context omitted.

Yup. In my opinion, this isn't a problem that needs solving. I bet with thumbprint security, money is more secure from house hooligans than it was when held in a wallet.

Maybe, but on the other hand, most people don't keep $250 in their wallets. Having an extra verification mechanism for expensive purchases seems appropriate.

Small cash theft can be done over and over. An online theft leaves a paper trail, normally with email confirmation. I would be surprised if a child got away with it twice and the total harm would be much more trackable.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#62

Post by Meegul »

icebraining wrote: post #13
Waterluvian wrote: post #6

Earlier quoted context omitted.

Yup. In my opinion, this isn't a problem that needs solving. I bet with thumbprint security, money is more secure from house hooligans than it was when held in a wallet.

Maybe, but on the other hand, most people don't keep $250 in their wallets. Having an extra verification mechanism for expensive purchases seems appropriate.

They do keep credit cards in their wallet, though.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#63

Post by cosmie »

Waterluvian wrote: post #9
cosmie wrote: post #3

Earlier quoted context omitted.

The mom? I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.

As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!

In the case of my kid, it's almost always to listen to music, not for screen time. I have several Chromecasts throughout my house, and she knows exactly how to connect to each of them with the Spotify and YouTube Kids apps. So she'll turn on music to the Chromecast in her room then play at her crafting table for a couple of hours while jamming out.

She does enjoy playing games as well, but those are timeboxed and she knows better than to try to pull something off like use my thumbprint to get around me telling her no. When she tries to "sneak" a thumbprint to unlock my iPhone, it's because she likes the self-sufficiency of turning on and choosing music herself (or because it's a song[1] I won't play for her anymore in an effort to maintain my sanity). And I really don't mind that self-sufficiency when she's up at the crack of dawn on a Saturday and is trying to be as non-intrusive as possible to let me lay in until a late 7am or so.

[1] https://youtu.be/KYlC5CXWHZI

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#64

Post by toxican »

Clubber wrote: post #37
jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

The most fascinating part for me is that 6 year old managed to find a way to circumvent biometric security without hacking off someone's finger: authenticate while the user is asleep. Necessity is truly the mother of innovation.

And I thought me using a keylogger as a teen to access my mom's AOL account was impressive. Clever 6 year old.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#65

Post by jasonkostempski »

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

The scary part of that trend is that biometrics should not be replacing passwords. User ID, fine, but finger prints are something you have, not something you know.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#66

Post by toxican »

allThumbs wrote: post #38
jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

They'd need your whole hand, since any finger can be used for a smartphone biometric scanner. Truthfully, lots of different scannable areas will unlock a phone. I've successfully and reliably configured my toes, the knuckles on my hands, and the tip of my nose. All of them work pretty good. Unless observed using biometric security in a specific manner, an adversary might have a hard time deducing what kind of print w…

If you're robbing an iPhone user, you'd probably be safe hacking off a thumb. Can't imagine many people give up the convenience of using their thumbs to unlock.

With me they'd have to take my index fingers because I've got a phone with the reader on the back of the device (which, imo, is the best place to put it, as far as convenience goes.)

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#67

Post by makecheck »

It seems like they could add a few less-predictable factors to improve the security of thumbprints without completely ruining their convenience.

For instance:

— Maybe you must use two or more particular fingerprints in sequence, selected by you in advance. This would require a “sleep attack” to at least try different combinations of your fingers (without knowing which to use first or how many fingers are required).

— Maybe you have to hold down your thumb in a pattern that you set in advance (e.g. at least 2 seconds on, followed by one second off and one second on).

— Maybe a 3-by-3 grid appears and you have to tap one of the squares that were set in advance by you before using your fingerprint. This is faster than having to enter a whole pass-code but slightly stronger than just tapping a finger.

Of course, each of these trades off time (convenience) for slightly better security.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#68

Post by jasonkostempski »

dexwiz wrote: post #4

So is the 21st century version of stealing cash from your mom's purse?

Except your mom's purse doesn't pretend to be secure so moms that know their kids might steel from them know to move the money out of their purse.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#69

Post by ehnto »

pc86 wrote: post #60
jcadam wrote: post #58

Earlier quoted context omitted.

I had to disable touch ID on my iPhone out of frustration. It works for me maybe 1 out of 10 times no matter which finger I try to use (my wife has no problem with hers). But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder." I have no idea what's wrong with my fingers :|

Sounds like low ridges that mess with the scanners.

I have scarring across my fingerprints that changes fairly frequently (serious injuries when younger coupled with powerlifting regularly now, unnoticable but definitely not static) I am an edge case but surprisingly only had infrequent issues.

I don't use thumb scanners anymore though as inevitably my finger will change! It definitely isn't for everyone.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#70

Post by edgarvaldes »

dvdhnt wrote: post #49
jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

> 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. Fo…

In Mexico, you need to let the government to scan ALL your fingerprints (and iris) in order to obtain an Electronic Signature.
Post reply on HN