Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys • Hacker News Board

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#111

Post by darpa_escapee » Wed, Dec 28, 2016, 9:07 PM UTC

dragonwriter wrote: post #33

saosebastiao wrote: post #7

I get relatively annoyed about the facile pedantry of this argument, but this is exactly the poster case for it, so here goes: fingerprints are usernames, not passwords.

Fingerprints are neither really suitable as usernames (because you can neither guarantee that users have them or that thhey don't change outside of your and the user's control or, really, even that they are unique, though they are conventionally assumed to be so) nor passwords (because they aren't secret, can't be changed if compromised, etc.)

Even if prints were unique, the heuristics upon which we match them to a given input isn't perfect. It is an guesstimation.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#112

Post by jcoffland » Wed, Dec 28, 2016, 9:10 PM UTC

toxican wrote: post #64

Clubber wrote: post #37

Earlier quoted context omitted.

The most fascinating part for me is that 6 year old managed to find a way to circumvent biometric security without hacking off someone's finger: authenticate while the user is asleep. Necessity is truly the mother of innovation.

And I thought me using a keylogger as a teen to access my mom's AOL account was impressive. Clever 6 year old.

I rewired our telephone lines so that I could switch off the downstairs phone from my bedroom while using my modem. It took my Dad about two days to figure out what was up and find the switch under my desk.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#113

Post by Declanomous » Wed, Dec 28, 2016, 9:11 PM UTC

mb0 wrote: post #96

jcadam wrote: post #58

Earlier quoted context omitted.

I had to disable touch ID on my iPhone out of frustration. It works for me maybe 1 out of 10 times no matter which finger I try to use (my wife has no problem with hers). But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder." I have no idea what's wrong with my fingers :|

I've heard that people with hyperhydrosis have a lot of trouble with biometrics devices as well as smart phones. If your skin is too moist it just kinda gums up the works.

I have a lot of problems with touch screens. Some screens refuse to register my touch, and other screens register my touch before I even make contact with the screen. If you turn on developer tools in android and look at the "touches", you can see them registering all over if I have my fingers a cm or so above the screen.

I have really moist skin, so I wouldn't be surprised if this was the issue. I had a fingerprint reader on my gen 1 Motorola Atrix and that worked just fine though. I think the company that built that authentication system was purchased by Apple and used in the iPhones. I wonder if his wife would have the same issues with his phone, it might be that his fingerprint scanner is less sensitive.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#114

Post by Spooky23 » Wed, Dec 28, 2016, 9:12 PM UTC

dvdhnt wrote: post #49

jenamety wrote: post #24

i'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So…

> 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. Fo…

That's a feature of something you have auth.

We had a business problem several years ago where a population of users who didn't need individual access control needed controlled access to a system based on where they were and if they were assigned a specific task.

The solution was an RSA token mapped to a device specific user account. The single auth factor was the rotating code.

The upside of this is that we got to control access to a system potentially available to the public in an environment with high turnover and other operational challenges. The downside is that whomever possessed the token (picture an old style bathroom key tied to a big stick) could access the system.

Your thumb is that token. If you need more identity assurance, you need more factors or a protected secret. iPhone offers the latter. If your opponent is someone with subpoena power, you need to think about what and why you're doing stuff on your phone.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#115

Post by jvvw » Wed, Dec 28, 2016, 9:14 PM UTC

Latty wrote: post #46

Waterluvian wrote: post #9

Earlier quoted context omitted.

As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!

Kids are not addicted in most cases, they are exploring. They don't know what options there are, or how far these things go, they just want to try it. If you present a child with lots of options, they won't stay with one all the time, for sure. My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with f…

Hmm, some games are definitely addictive. We didn't have too many issues with our kids (3 and 6) and screens until recently when our six year old discovered a particular game (slither.io) which I can definitely say he got addicted to. We finally had to resort to putting time limits on his tablet use as he would scarcely talk or think about anything else and wouldn't come for meals, want to go out anywhere etc.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#116

Post by lostgame » Wed, Dec 28, 2016, 9:32 PM UTC

Infinitesimus wrote: post #105

sortofanon wrote: post #97

Earlier quoted context omitted.

[Posting sort of anonymously] My spouse and I will probably never see eye to eye on porn. I agree that it's a bigger issue, but do I need to address it?

Definitely a much bigger debate (and off-topic) For me it was a matter of porn not being as important to me as she was so the porn had to go. Plus for some people, porn does affect their own interactions with their partner negatively (reduces sexual drive, reduced sexual interest in their partner since s/he isn't like what they see in porn, etc.). Some people also view their spouses' watching porn as a sign that the…

Neither my primary partner or I are particularly into porn - it's just really not our thing. That being said, I think a sense of solo sexuality is a really important part to any intimate relationship but that's just, like, my opinion, man.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#117

Post by gaius » Wed, Dec 28, 2016, 9:38 PM UTC

Latty wrote: post #46

Waterluvian wrote: post #9

Earlier quoted context omitted.

As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!

Kids are not addicted in most cases, they are exploring. They don't know what options there are, or how far these things go, they just want to try it. If you present a child with lots of options, they won't stay with one all the time, for sure. My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with f…

Kids are not addicted in most cases, they are exploring

Large teams of adults are exploiting every trick in the book to get them addicted tho'...

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#118

Post by DKnoll » Wed, Dec 28, 2016, 9:46 PM UTC

goda90 wrote: post #77

toxican wrote: post #64

Earlier quoted context omitted.

And I thought me using a keylogger as a teen to access my mom's AOL account was impressive. Clever 6 year old.

I wish my tech arms race with my parents had been simple...I had to socially engineer my dad into logging into the router on my desktop(no keylogger, just firefox password saving) so I could bypass whatever he was doing to cut me off at midnight.

My solution was much more elegant: spoof his MAC address.

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#119

Post by sdegutis » Wed, Dec 28, 2016, 9:46 PM UTC

exlurker wrote: post #86

sdegutis wrote: post #34

Earlier quoted context omitted.

Chopping off your thumb is only in movies, where logic barely exists. In real life, you can cancel your funds and reverse their fraudulent transactions.

How're you gonna do that without thumbs?

Use your pinky to dial your bank on your landline ;)

Re: Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys

#120

Post by taude » Wed, Dec 28, 2016, 9:49 PM UTC

swift wrote: post #110

wruza wrote: post #89

Earlier quoted context omitted.

Many friends of mine disabled that feature right after the story about someone's wife unlocked it while he was asleep. That can be orders of magnitude more expensive than $250, in one touch.

Anyone for whom this is a concern should probably consider divorce.

Seriously, agree.