Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys(cnet.com)
cnet.com
Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys
https://www.cnet.com/news/child-uses-sleeping-moms-fingerprints-to-buy-pokemon-gifts/
140 comments
The most fascinating part for me is that 6 year old managed to find a way to circumvent biometric security without hacking off someone's finger: authenticate while the user is asleep.
Necessity is truly the mother of innovation.
Necessity is truly the mother of innovation.
And I thought me using a keylogger as a teen to access my mom's AOL account was impressive. Clever 6 year old.
I wish my tech arms race with my parents had been simple...I had to socially engineer my dad into logging into the router on my desktop(no keylogger, just firefox password saving) so I could bypass whatever he was doing to cut me off at midnight.
In some ways mine wasn't as simple as it seems. My primary source of consistent access to the internet was a 1 hour time-limited, content-restricted AOL account. I had to learn and acquire anything I needed within those confines. Even Google was blocked...I had to use some weird, generic search engine. And I couldn't escape to do these things at school because their computers were even more locked down/monitored. After I got busted for using the keylogger (less than 24 hours later), I discovered the wonderful world of using fake info to get unlimited juno trial accounts (x hours for free!!)
I rewired our telephone lines so that I could switch off the downstairs phone from my bedroom while using my modem. It took my Dad about two days to figure out what was up and find the switch under my desk.
Many friends of mine disabled that feature right after the story about someone's wife unlocked it while he was asleep. That can be orders of magnitude more expensive than $250, in one touch.
Seriously, how many people have things on their phone that they are desperatly trying to keep hidden from their SO (and still don't DELETE THE STUFF)?
if you are hiding stuff from your spouse you have larger issues that you should acknowledge and address. With regards to the article parents needs to disable in app purchases on any device a child can reasonably be expected to get access too
You could hide stuff from your spouse for many good and bad reasons. Maybe you are preparing a surprise gift and you took photos. Maybe your spouse has a bad spending habit and will ruin the both of you, so you hide the other bank account. Maybe your spouse is abusive and is threatening to leave you at any moment, so you hide money to get ready for that day. Maybe your spouse parents are calling you regularly to see how they are doing. Maybe, maybe, maybe.
maybe you're questioning sexuality and aren't sure how to discuss it with your super born again religious wife.
(I saw this come up in a Facebook group a few months ago)
(I saw this come up in a Facebook group a few months ago)
[Posting sort of anonymously] My spouse and I will probably never see eye to eye on porn. I agree that it's a bigger issue, but do I need to address it?
Definitely a much bigger debate (and off-topic)
For me it was a matter of porn not being as important to me as she was so the porn had to go. Plus for some people, porn does affect their own interactions with their partner negatively (reduces sexual drive, reduced sexual interest in their partner since s/he isn't like what they see in porn, etc.). Some people also view their spouses' watching porn as a sign that the one who doesn't like porn is inadequate - which leads to all sorts of insecurities coming out.
As usual, different strokes for different folks. Whether you _need_ to address it is entirely up to you and what you want from your relationship.
(I do know couples who both were into porn and that didn't cause an issue)
For me it was a matter of porn not being as important to me as she was so the porn had to go. Plus for some people, porn does affect their own interactions with their partner negatively (reduces sexual drive, reduced sexual interest in their partner since s/he isn't like what they see in porn, etc.). Some people also view their spouses' watching porn as a sign that the one who doesn't like porn is inadequate - which leads to all sorts of insecurities coming out.
As usual, different strokes for different folks. Whether you _need_ to address it is entirely up to you and what you want from your relationship.
(I do know couples who both were into porn and that didn't cause an issue)
Neither my primary partner or I are particularly into porn - it's just really not our thing. That being said, I think a sense of solo sexuality is a really important part to any intimate relationship but that's just, like, my opinion, man.
Anyone for whom this is a concern should probably consider divorce.
And... why? Which profit do you get from divorce that covers all economic and moral expenses (let's consider family with children)?
When your first thought in terms of your marriage is economic and moral expenses, you have a bigger issue within your marriage than whatever may be on your phone.
You think the problem in that marriage would stop with iPhone purchases?
Seriously, agree.
> Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )
Yes you can. In fact, it's a lot easier for you to do so involuntarily.
EDIT: And, it should be noted, once it has been "divulged" or otherwise compromised, it's a lot more painful to change your thumbprint than a PIN or other non-biometric password.
Yes you can. In fact, it's a lot easier for you to do so involuntarily.
EDIT: And, it should be noted, once it has been "divulged" or otherwise compromised, it's a lot more painful to change your thumbprint than a PIN or other non-biometric password.
Yeah, plus you stamp it in oil on everything you touch. For the billionth time, fingerprints are usernames, not passwords. If you model it as such, you get a much more realistic idea of where it is and isn't appropriate to use.
Dont fall for the myth of biometrics. It wasn't a thumbprint protecting this phone. It was a digital representation of a print. That representation was then compared against data from the thumbprint reader. The match need not be exact as no two scans are ever identical. Know the general shape of the print, know the boundaries that are acceptable to the comparison machine, and you can substitute digital data for a physical thumb. It's just easier in most situations to manufacture a thumb. Germany's Angela Mirkle's (sp, on a mobile) thumbprint was receantly duplicated from photographs taken during a press event. While we cannot change or withdraw our biometrics, hackers can certainly steal and copy them. So they are a non-startee imho and i never recommend them to clients. (Also, lesser legal protections.)
There's a cool dystopian-ey youtube video briefly looking into that topic, among other things: https://www.youtube.com/watch?v=YJg02ivYzSs
very cool, thanks
I had to disable touch ID on my iPhone out of frustration. It works for me maybe 1 out of 10 times no matter which finger I try to use (my wife has no problem with hers).
But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder."
I have no idea what's wrong with my fingers :|
But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder."
I have no idea what's wrong with my fingers :|
Have you tried registering the same finger 5x?
I've heard that people with hyperhydrosis have a lot of trouble with biometrics devices as well as smart phones. If your skin is too moist it just kinda gums up the works.
Makes sense, my biggest annoyance with the fingerprint reader is that it doesn't work reliably if your finger is at all wet (like while cooking).
I have a lot of problems with touch screens. Some screens refuse to register my touch, and other screens register my touch before I even make contact with the screen. If you turn on developer tools in android and look at the "touches", you can see them registering all over if I have my fingers a cm or so above the screen.
I have really moist skin, so I wouldn't be surprised if this was the issue. I had a fingerprint reader on my gen 1 Motorola Atrix and that worked just fine though. I think the company that built that authentication system was purchased by Apple and used in the iPhones. I wonder if his wife would have the same issues with his phone, it might be that his fingerprint scanner is less sensitive.
I have really moist skin, so I wouldn't be surprised if this was the issue. I had a fingerprint reader on my gen 1 Motorola Atrix and that worked just fine though. I think the company that built that authentication system was purchased by Apple and used in the iPhones. I wonder if his wife would have the same issues with his phone, it might be that his fingerprint scanner is less sensitive.
Sounds like low ridges that mess with the scanners.
I have scarring across my fingerprints that changes fairly frequently (serious injuries when younger coupled with powerlifting regularly now, unnoticable but definitely not static) I am an edge case but surprisingly only had infrequent issues.
I don't use thumb scanners anymore though as inevitably my finger will change! It definitely isn't for everyone.
I don't use thumb scanners anymore though as inevitably my finger will change! It definitely isn't for everyone.
"i'm seeing two (obvious) bigger picture trends here that this story reinforces.
1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )"
Unfortunately, your thumb print can be replicated and used. Check out this news story - police actually 3d printed a murder victim's finger to unlock their phone - http://www.theverge.com/2016/7/21/12247370/police-fingerprin...
1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )"
Unfortunately, your thumb print can be replicated and used. Check out this news story - police actually 3d printed a murder victim's finger to unlock their phone - http://www.theverge.com/2016/7/21/12247370/police-fingerprin...
> 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )
It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. For example, what if authorities compel accused individuals to store their thumbprint rather than use it directly? Is that possible? And how will it be protected?
It's an interesting topic as we've seen in recent news coverage that authorities can compel the accused to provide a thumbprint to give investigators access. While this may be in accordance to something like password authentication, I'm still concerned about the ramifications. For example, what if authorities compel accused individuals to store their thumbprint rather than use it directly? Is that possible? And how will it be protected?
That's a feature of something you have auth.
We had a business problem several years ago where a population of users who didn't need individual access control needed controlled access to a system based on where they were and if they were assigned a specific task.
The solution was an RSA token mapped to a device specific user account. The single auth factor was the rotating code.
The upside of this is that we got to control access to a system potentially available to the public in an environment with high turnover and other operational challenges. The downside is that whomever possessed the token (picture an old style bathroom key tied to a big stick) could access the system.
Your thumb is that token. If you need more identity assurance, you need more factors or a protected secret. iPhone offers the latter. If your opponent is someone with subpoena power, you need to think about what and why you're doing stuff on your phone.
We had a business problem several years ago where a population of users who didn't need individual access control needed controlled access to a system based on where they were and if they were assigned a specific task.
The solution was an RSA token mapped to a device specific user account. The single auth factor was the rotating code.
The upside of this is that we got to control access to a system potentially available to the public in an environment with high turnover and other operational challenges. The downside is that whomever possessed the token (picture an old style bathroom key tied to a big stick) could access the system.
Your thumb is that token. If you need more identity assurance, you need more factors or a protected secret. iPhone offers the latter. If your opponent is someone with subpoena power, you need to think about what and why you're doing stuff on your phone.
In Mexico, you need to let the government to scan ALL your fingerprints (and iris) in order to obtain an Electronic Signature.
The scary part of that trend is that biometrics should not be replacing passwords. User ID, fine, but finger prints are something you have, not something you know.
Rather than calling it "something you know", it should be called "something you can forget if needed."
Even for id's, we need to be careful. They can't be the end-all solution, because they aren't permanent (I know people who have accidentally lost their thumbprints through burning, for instance). Phones today get around that by making you also set a pattern or pin to get in.
Well, a common type of robbery in Brazil is what's called "lightning kidnapping" due to this reason. Assailants take people by force in order to make them withdraw money from ATMs using biometric security.
To be fair, 'sequestros relâmpagos' (lightining kidnappings) were around long before biometric security in ATMs, and are still used today even with non-biometric security (PINs).
They'd need your whole hand, since any finger can be used for a smartphone biometric scanner.
Truthfully, lots of different scannable areas will unlock a phone. I've successfully and reliably configured my toes, the knuckles on my hands, and the tip of my nose. All of them work pretty good.
Unless observed using biometric security in a specific manner, an adversary might have a hard time deducing what kind of print will provide access.
Even if they've determined that the phone contains biometric scans tied to security, how would they know it's yours, and not someone else's, or even a specially printed 3D key ring fob or something?
Then again, criminals don't always think deeply about such details during a crime. They might just chop off both hands, grab the phone, and figure out the rest on the run.
Truthfully, lots of different scannable areas will unlock a phone. I've successfully and reliably configured my toes, the knuckles on my hands, and the tip of my nose. All of them work pretty good.
Unless observed using biometric security in a specific manner, an adversary might have a hard time deducing what kind of print will provide access.
Even if they've determined that the phone contains biometric scans tied to security, how would they know it's yours, and not someone else's, or even a specially printed 3D key ring fob or something?
Then again, criminals don't always think deeply about such details during a crime. They might just chop off both hands, grab the phone, and figure out the rest on the run.
If you're robbing an iPhone user, you'd probably be safe hacking off a thumb. Can't imagine many people give up the convenience of using their thumbs to unlock.
With me they'd have to take my index fingers because I've got a phone with the reader on the back of the device (which, imo, is the best place to put it, as far as convenience goes.)
With me they'd have to take my index fingers because I've got a phone with the reader on the back of the device (which, imo, is the best place to put it, as far as convenience goes.)
> If you're robbing an iPhone user, you'd probably be safe hacking off a thumb. Can't imagine many people give up the convenience of using their thumbs to unlock.
Anecdotal, but I know people who have configured only the index finger to unlock the phone because they prefer it to the thumb.
Anecdotal, but I know people who have configured only the index finger to unlock the phone because they prefer it to the thumb.
If you wanna know something and he won't tell you, cut off one of his fingers. The little one. Then tell him his thumb's next. After that he'll tell you if he wears ladies underwear.
Chopping off your thumb is only in movies, where logic barely exists. In real life, you can cancel your funds and reverse their fraudulent transactions.
My gym offers a premium membership that, among other things, gives you access to a secondary locke room with private lockers, laundry services, etc. Members access this room through the regular locker room. There's a frosted glass door in back, past the "regular" lockers --in quotes because at $150 a month there's nothing regular about standard membership. To the left of the glass door one finds a retinal scanner.
Yup, these morons are giving a gym more money and their retinal scan to have private lockers and laundry services. I'm sure they feel James Bond-ish by unlocking a door by staring into the little device on the wall.
No thanks, I'll keep my "regular" membership.
Yup, these morons are giving a gym more money and their retinal scan to have private lockers and laundry services. I'm sure they feel James Bond-ish by unlocking a door by staring into the little device on the wall.
No thanks, I'll keep my "regular" membership.
> i cant divulge my thumbprint like i can my pin
You divulge your thumb print when you grab ahold of a glass at a restaurant or a door handle in a public space.
You divulge your thumb print when you grab ahold of a glass at a restaurant or a door handle in a public space.
I suspect they meant divest. They can't get rid of the thumbprint like they can an insecure pin/etc.
[deleted]
So is the 21st century version of stealing cash from your mom's purse?
Yup. In my opinion, this isn't a problem that needs solving. I bet with thumbprint security, money is more secure from house hooligans than it was when held in a wallet.
Maybe, but on the other hand, most people don't keep $250 in their wallets. Having an extra verification mechanism for expensive purchases seems appropriate.
Depends how likely this scenario is. Adding security to a high risk, low occurence event can be seen as wasteful.
Also before this technology, people kept credit cards in their wallet, which suffered the same fate from house hooligans. And before credit, people did keep $250 in their wallet.
Also before this technology, people kept credit cards in their wallet, which suffered the same fate from house hooligans. And before credit, people did keep $250 in their wallet.
Well, the security could just be to ask for one's password again.
I guess the credit card part is true; around here most people have debit cards with PINs, and which can't be used remotely, so it's unlikely a six-year-old could use it without their parent's consent. Then again, around here those parents would have the legal right to return all those purchases.
I guess the credit card part is true; around here most people have debit cards with PINs, and which can't be used remotely, so it's unlikely a six-year-old could use it without their parent's consent. Then again, around here those parents would have the legal right to return all those purchases.
Yeah I think there should be a limit (which you can override with a password) on how much money you can spend in a certain time period. Make it $10/day or something as default and let the user change it. Works well enough for mobile contracts to prevent over spend IMHO.
Small cash theft can be done over and over. An online theft leaves a paper trail, normally with email confirmation. I would be surprised if a child got away with it twice and the total harm would be much more trackable.
They do keep credit cards in their wallet, though.
Wallets hold a small amount of money compared to the potential life savings accessible with a phone and thumbprint.
Getting robbed turns from "Give me your wallet or I'll shoot/stab you" to "Give me your phone and access or I'll shoot/stab you."
Getting robbed turns from "Give me your wallet or I'll shoot/stab you" to "Give me your phone and access or I'll shoot/stab you."
>life savings
Unlikely given anti-fraud systems.
And ordered physical goods can almost often be returned. Digital purchases canceled. I don't doubt one can come up with a corner case somewhere but major financial transactions do tend to have checks built in.
Unlikely given anti-fraud systems.
And ordered physical goods can almost often be returned. Digital purchases canceled. I don't doubt one can come up with a corner case somewhere but major financial transactions do tend to have checks built in.
Except your mom's purse doesn't pretend to be secure so moms that know their kids might steel from them know to move the money out of their purse.
It seems like they could add a few less-predictable factors to improve the security of thumbprints without completely ruining their convenience.
For instance:
— Maybe you must use two or more particular fingerprints in sequence, selected by you in advance. This would require a “sleep attack” to at least try different combinations of your fingers (without knowing which to use first or how many fingers are required).
— Maybe you have to hold down your thumb in a pattern that you set in advance (e.g. at least 2 seconds on, followed by one second off and one second on).
— Maybe a 3-by-3 grid appears and you have to tap one of the squares that were set in advance by you before using your fingerprint. This is faster than having to enter a whole pass-code but slightly stronger than just tapping a finger.
Of course, each of these trades off time (convenience) for slightly better security.
For instance:
— Maybe you must use two or more particular fingerprints in sequence, selected by you in advance. This would require a “sleep attack” to at least try different combinations of your fingers (without knowing which to use first or how many fingers are required).
— Maybe you have to hold down your thumb in a pattern that you set in advance (e.g. at least 2 seconds on, followed by one second off and one second on).
— Maybe a 3-by-3 grid appears and you have to tap one of the squares that were set in advance by you before using your fingerprint. This is faster than having to enter a whole pass-code but slightly stronger than just tapping a finger.
Of course, each of these trades off time (convenience) for slightly better security.
I'm just imagining the court case where they can force the defendant to put their finger to the reader, but they can't force them to say what order it has to be in, so they'll slowly make the defendant try all the combinations.
Then that's just back to the situation today with passwords/passcodes. The answer is rate limiting.
This will only end in nano-blood-draws with genotypic personalization built into my online refrigerator all over LDAP.
Of course both the blood drawer and the genotype analytics service will both be operating on two different clouds. Don't forget to pay your Internet bill if you don't want to starve.
Does thumbprint + access code/grid/what-have-you exist on any phone?
This is the one feature I've been dying for.
This is the one feature I've been dying for.
I get relatively annoyed about the facile pedantry of this argument, but this is exactly the poster case for it, so here goes: fingerprints are usernames, not passwords.
I disagree. Fingerprints are privacy locks, not security locks.
The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter".
A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.
The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter".
A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.
I mostly cringe at the argument I quoted because it is often misapplied due to how we have historically misapplied passwords.
A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password is more authorization than authentication: requiring a password is appropriate when you need a conscious decision, not mere identification. Such as for paying for Pokémon toys.
So essentially what I'm saying is that I agree with you.
A username is an identity. Historically due to the difficulty of verifying identities online, we have used passwords as a way to do so. And when all we need to do is verify an identity or control basic access levels (the bathroom lock!), a fingerprint is absolutely good enough. But a password is more authorization than authentication: requiring a password is appropriate when you need a conscious decision, not mere identification. Such as for paying for Pokémon toys.
So essentially what I'm saying is that I agree with you.
Identity <> Authentication <> Authority
I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc.
On a phone, it's an interesting shift because with a PIN, we essentially bypassed the need for identity and used only a password; regardless of who you are, you can get in if you have the right key.
With the move to identity being sufficient to unlock a device, we're saying that just on the basis of identity, the authority that used to come with a password (sans identity) can be granted. It's a 180 degree turn.
I don't see a way on my iPhone 6s to require both Touch ID and PIN; it's one or the other. Very few interactions require both, i.e. after a restart it requires the PIN before Touch ID will work.
edit: to clarify the difference
I deal with this in my industry (telecommunications). Just because you've provided proof of identity (eg your phone number, account number), there are still things you're not allowed to do until you've authenticated your identity--and the system determines your authority, to perform an action. This is accomplished through a password, a PIN, etc.
On a phone, it's an interesting shift because with a PIN, we essentially bypassed the need for identity and used only a password; regardless of who you are, you can get in if you have the right key.
With the move to identity being sufficient to unlock a device, we're saying that just on the basis of identity, the authority that used to come with a password (sans identity) can be granted. It's a 180 degree turn.
I don't see a way on my iPhone 6s to require both Touch ID and PIN; it's one or the other. Very few interactions require both, i.e. after a restart it requires the PIN before Touch ID will work.
edit: to clarify the difference
Here's my take on the authentication vs authorization distinction. Authentication is the verification of identity. Authorization is the verification of permission (authority) to perform an action. The two are often related, but need not be.
For example, most phone manufacturers think that the owner of a phone should always have permission to perform any action on the phone, so as long as they can authenticate the person holding the phone, they can authorize them to do anything. In this case, authentication => authorization.
Contrast this with OAuth, which it seems most people don't understand well. OAuth is a mechanism for authorizing people other than yourself to perform actions on your behalf, e.g. a third party application to post on your Facebook wall. In this case, authorization !=> authentication.
However, sometimes third-party applications don't care about performing actions on your behalf. They work on the assumption that only the owner of the account could authorize an OAuth token to give back to them, so they use other OAuth providers as authentication, e.g. login via Facebook. So in this case, authorization => authentication.
Another example is accessing secret files at a company. A person might be authorized to view the files but only from a secure device. In this case, authentication is required but not sufficient for authorization. In this case, authentication !=> authorization.
In the case of payment via phone, you need authorization. Authentication can be one factor in the authorization process, but clearly its not sufficient because the authorizing party could be asleep and therefore unaware of the transaction. Phone manufacturers might want to look at risk-based escalation -- requiring more factors for some applications, or as the sum of money increases, or perhaps even based on time of day.
For example, most phone manufacturers think that the owner of a phone should always have permission to perform any action on the phone, so as long as they can authenticate the person holding the phone, they can authorize them to do anything. In this case, authentication => authorization.
Contrast this with OAuth, which it seems most people don't understand well. OAuth is a mechanism for authorizing people other than yourself to perform actions on your behalf, e.g. a third party application to post on your Facebook wall. In this case, authorization !=> authentication.
However, sometimes third-party applications don't care about performing actions on your behalf. They work on the assumption that only the owner of the account could authorize an OAuth token to give back to them, so they use other OAuth providers as authentication, e.g. login via Facebook. So in this case, authorization => authentication.
Another example is accessing secret files at a company. A person might be authorized to view the files but only from a secure device. In this case, authentication is required but not sufficient for authorization. In this case, authentication !=> authorization.
In the case of payment via phone, you need authorization. Authentication can be one factor in the authorization process, but clearly its not sufficient because the authorizing party could be asleep and therefore unaware of the transaction. Phone manufacturers might want to look at risk-based escalation -- requiring more factors for some applications, or as the sum of money increases, or perhaps even based on time of day.
You're demonstrating the difference between authentication and authorization, not the difference between identity and authentication. Notice you use the word authority, which has the same root word as authorization. Authentication is merely the confirmation of identity...it is not the same thing as authorization.
In the case of a single-user phone, is there a difference? The phone's owner has authorization to do anything, including spend funds they've previously enrolled into the phone's wallet systems, etc., so it's kind of a moot point for the purposes of this incident.
You seem to be suggesting we add extra layers here so that merely authenticating as the device's owner is insufficient authorization to conduct some actions, and re-authenticating as the owner by using something they know (secret token like PIN/password) instead of something they possess (finger) will re-grant authorization, but users find this constant re-auth very annoying.
Most would probably prefer device makers to allow them to trust the people whom they sleep around rather than input another authentication method all the time. Personal responsibility has to enter into the equation somewhere.
My advice to this parent would be to keep their phone and/or body inaccessible while unconscious.
You seem to be suggesting we add extra layers here so that merely authenticating as the device's owner is insufficient authorization to conduct some actions, and re-authenticating as the owner by using something they know (secret token like PIN/password) instead of something they possess (finger) will re-grant authorization, but users find this constant re-auth very annoying.
Most would probably prefer device makers to allow them to trust the people whom they sleep around rather than input another authentication method all the time. Personal responsibility has to enter into the equation somewhere.
My advice to this parent would be to keep their phone and/or body inaccessible while unconscious.
[deleted]
The "deliberateness" or "conciencousness" of a lock is an interesting dimension.
A laser cutter I used to work with had two switches, one of which was a safety switch (like [1]) to prevent accidental activation. The goal here isn't security. It's a design decision to prevent accidents. It's almost a kind of intentional inconvenience.
[1] Safety switch with cap prevent accidental switching: http://acuteelectrical.com.au/safety-switch/
A laser cutter I used to work with had two switches, one of which was a safety switch (like [1]) to prevent accidental activation. The goal here isn't security. It's a design decision to prevent accidents. It's almost a kind of intentional inconvenience.
[1] Safety switch with cap prevent accidental switching: http://acuteelectrical.com.au/safety-switch/
I bet legal experts could speak to this very well. At what point is someone breaking in?
Yes, absolutely. :)
That's a really nice distinction.
It feels like there's a bit of a spectrum, though. The lock on a houses door won't prevent a determined criminal, but it sends a very strong signal and is inconvenient to break.
Perhaps we should thing of there as being multiple dimensions to locks, such as security, signaling, effort to circumvent, and convenience? (Perhaps also conscientiousness in disabling, in relation to @saosebastiao's point.)
It feels like there's a bit of a spectrum, though. The lock on a houses door won't prevent a determined criminal, but it sends a very strong signal and is inconvenient to break.
Perhaps we should thing of there as being multiple dimensions to locks, such as security, signaling, effort to circumvent, and convenience? (Perhaps also conscientiousness in disabling, in relation to @saosebastiao's point.)
Definitely a spectrum. Bike locks are for security, but mainly just to make your bike less convenient than another one nearby.
If someone wants into YOUR phone, they'll get it. If someone wants into A phone, a thumbprint may be plenty.
If someone wants into YOUR phone, they'll get it. If someone wants into A phone, a thumbprint may be plenty.
Being widespread is a double-edged sword though. The more people have such an inconvenience-based security, the better they are, but if everyone has bike locks, the thieves simply start carrying bolt cutters with them. We're maybe two or three years before majority of smartphones in use have fingerprint scanners...
I have a very contrary intuition from literature on crime policy, where the presence of detectable security did not lower home robbery rates for the region, but rather shifted it to unprotected homes and neighborhoods, whereas increases in non-visible security systems lowered crime rates for the region, but didn't provide benefits for the home in question.
I recall a similar article on gun ownership in homes, and it noted that gun ownership did not protect any specific home, but rather it decreased home robbery rates for a region.
I recall a similar article on gun ownership in homes, and it noted that gun ownership did not protect any specific home, but rather it decreased home robbery rates for a region.
To expand on your analogy: a username says pretty much the same thing, except instead of a locked door, you have one of those "Do Not Disturb" signs on your door handle.
Fingerprints are neither really suitable as usernames (because you can neither guarantee that users have them or that thhey don't change outside of your and the user's control or, really, even that they are unique, though they are conventionally assumed to be so) nor passwords (because they aren't secret, can't be changed if compromised, etc.)
Even if prints were unique, the heuristics upon which we match them to a given input isn't perfect. It is an guesstimation.
My passport is the username, my face matching the photo is the password.
> ordered 13 Pokemon gifts [...] was only allowed to return four of the items
What's up with that? Isn't there a law that limits liability for unauthorized purchases to $50? (And don't most banks and credit cards just make it $0?)
What's up with that? Isn't there a law that limits liability for unauthorized purchases to $50? (And don't most banks and credit cards just make it $0?)
Under the FCBA your liability for purchases made with a lost or stolen credit card is limited if you report the use to your card issuer in a timely manner. There's no requirement that Amazon voluntarily refund all your kids' purchases, and I'm not sure that unauthorized use of an Amazon account counts as theft of the physical credit card in this case anyway.
Strange. In the UK at least this would have been covered under existing regulation:
http://www.which.co.uk/consumer-rights/advice/i-want-to-retu...
http://www.which.co.uk/consumer-rights/advice/i-want-to-retu...
I'd guess that some of the products were from Amazon whilst others were from third-party vendors.
As for the question of liability, there's usually a proviso for taking legal/criminal action against the perpetrator. Even if the parent wanted to take action against their child, being below the age of criminal responsibility, the parents may be legally responsible in any case.
As for the question of liability, there's usually a proviso for taking legal/criminal action against the perpetrator. Even if the parent wanted to take action against their child, being below the age of criminal responsibility, the parents may be legally responsible in any case.
Here's an example of a lawsuit compelling refunds of in-app purchases made by minors:
http://www.reuters.com/article/us-apps-kids-idUSBREA2U0M9201...
http://www.reuters.com/article/us-apps-kids-idUSBREA2U0M9201...
A fingerprint is /who you are/, i.e. a username.
A password is /what you know/, i.e. a phrase or string of characters.
Confirming you're the correct person is only half of the equation.
Confirming you're the correct person is only half of the equation.
Do the fingerprint readers on phones check if there is a pulse?
I believe that most biometric readers for security (e.g., offices and such) look for a pulse or other indicator so using a severed body-part would not work. Always annoys me when I see that done in movies.
(One office I worked in had fingerprint access. The bathrooms were outside the secured area, and I soon got into the habit of rubbing my hands together after washing to warm them up, as a cold finger wouldn't read.)
I believe that most biometric readers for security (e.g., offices and such) look for a pulse or other indicator so using a severed body-part would not work. Always annoys me when I see that done in movies.
(One office I worked in had fingerprint access. The bathrooms were outside the secured area, and I soon got into the habit of rubbing my hands together after washing to warm them up, as a cold finger wouldn't read.)
Fingerprints are not passwords. They are more like (but not exactly) usernames.
People seem to numb out when they hear this in person. I don't understand why...
People seem to numb out when they hear this in person. I don't understand why...
There's not a way to combine both Touch ID and PIN for iOS access, but some apps do provide a PIN or passcode setting.
For me, with the banking apps on my phone for example, I use my fingerprint to get into my phone and then manually type in the password. Seems like the best combo to me for mobile security. (Not that I'm worried about it, I'm just security minded.)
For me, with the banking apps on my phone for example, I use my fingerprint to get into my phone and then manually type in the password. Seems like the best combo to me for mobile security. (Not that I'm worried about it, I'm just security minded.)
It'd seem fairly trivial for, e.g. Amazon (as in this case) to ask for your Amazon password if you go over a certain dollar-spend - or even weigh the risk of various product categories (e.g., you commonly overnight items from household goods, so we'll trust your thumbprint; but you've never ordered 5 TVs before, you're gonna need your password for that one).
Smart authentication/authorization is really interesting and I think a good middle ground for most people.
I disabled the iPhone feature that unlocks my phone with my thumbprint and changed it to an alphanumeric password of 20 characters. That feature has always been hit or miss for me anyway. Now it's harder for me to unlock my phone, which has a bonus side-effect of making me use it less often.
Talk about a Midas touch.
A true hacker.
this kid will undoubtedly read hn in the future
[deleted]
Sounds like an excellent potential recruit for Team Rocket!
"used her mother's thumb to unlock a phone and open the Amazon app as mom napped on the couch"
Or she made it up.....
Or she made it up.....
The mom?
I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.
I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.
As an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling?
I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!
I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!
Kids are not addicted in most cases, they are exploring. They don't know what options there are, or how far these things go, they just want to try it. If you present a child with lots of options, they won't stay with one all the time, for sure.
My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with friends, or playing football, or swimming, etc...
Children find things they like and explore them. Yes, as a parent your job is to get them to try a wider range of things and open them up to other stuff, but it's not 'screens' that are suddenly a new danger.
My parents were worried because I spent too much time reading, I've known people who's parents were worried because they spent too much time with music, or painting, or with friends, or playing football, or swimming, etc...
Children find things they like and explore them. Yes, as a parent your job is to get them to try a wider range of things and open them up to other stuff, but it's not 'screens' that are suddenly a new danger.
Hmm, some games are definitely addictive. We didn't have too many issues with our kids (3 and 6) and screens until recently when our six year old discovered a particular game (slither.io) which I can definitely say he got addicted to. We finally had to resort to putting time limits on his tablet use as he would scarcely talk or think about anything else and wouldn't come for meals, want to go out anywhere etc.
Sure - if other options are rejected in favour of doing one thing (truly one thing - using one device isn't necessarily one thing, although clearly there are limits to the range of activities on a single device, but worth noting), then there could be an issue.
I'd argue that's relatively rare though - it usually comes down to a lack of better options or a temporary indulgence.
Not saying children can't become hyperfocused on one thing, just that parents tend to claim it's the issue when they aren't giving other options or after what isn't really an excessive amount of time with a thing.
I'd argue that's relatively rare though - it usually comes down to a lack of better options or a temporary indulgence.
Not saying children can't become hyperfocused on one thing, just that parents tend to claim it's the issue when they aren't giving other options or after what isn't really an excessive amount of time with a thing.
Kids are not addicted in most cases, they are exploring
Large teams of adults are exploiting every trick in the book to get them addicted tho'...
Large teams of adults are exploiting every trick in the book to get them addicted tho'...
Parent here, of a toddler and a 1st grader, and based on my experience it's all about context. For example, if any of the following are true, the TV exists: TV is on or the children are inside and sedentary. Conversely, from the children's perspective, they tend to forget the TV exists or is an option if otherwise preoccupied indoors by activities like painting, reading, playing pretend, etc., or are in fact outdoors.
TL;DR - If kids can't see it, it doesn't exist.
TL;DR - If kids can't see it, it doesn't exist.
That seems very intuitive. I wonder how it translates to mobile devices. I suspect the same applies, so long as I apply the same discipline to providing access to the tablet. If they're inside and sedentary, they'll want it. If it's not tablet time, keep them busy.
You're spot on about your own discipline. Building on what mysterydip said above, your habits transfer almost entirely IMO. For example, if I'm working from home or answering an email, and my wife is using her phone, my daughter will often ask if she can stop whatever it is she is doing, like coloring, and instead play with her tablet.
It really does encourage you as a parent to have discipline with not only their screen time but your own as well.
It really does encourage you as a parent to have discipline with not only their screen time but your own as well.
To add to this (as the parent of a toddler), your usage patterns may have to change as well. I love taking videos of my daughter and she loves watching them. So when I pull out my phone to check email or a text, if she sees me do it, suddenly it exists in her world and she wants to watch videos asap.
In the case of my kid, it's almost always to listen to music, not for screen time. I have several Chromecasts throughout my house, and she knows exactly how to connect to each of them with the Spotify and YouTube Kids apps. So she'll turn on music to the Chromecast in her room then play at her crafting table for a couple of hours while jamming out.
She does enjoy playing games as well, but those are timeboxed and she knows better than to try to pull something off like use my thumbprint to get around me telling her no. When she tries to "sneak" a thumbprint to unlock my iPhone, it's because she likes the self-sufficiency of turning on and choosing music herself (or because it's a song[1] I won't play for her anymore in an effort to maintain my sanity). And I really don't mind that self-sufficiency when she's up at the crack of dawn on a Saturday and is trying to be as non-intrusive as possible to let me lay in until a late 7am or so.
[1] https://youtu.be/KYlC5CXWHZI
She does enjoy playing games as well, but those are timeboxed and she knows better than to try to pull something off like use my thumbprint to get around me telling her no. When she tries to "sneak" a thumbprint to unlock my iPhone, it's because she likes the self-sufficiency of turning on and choosing music herself (or because it's a song[1] I won't play for her anymore in an effort to maintain my sanity). And I really don't mind that self-sufficiency when she's up at the crack of dawn on a Saturday and is trying to be as non-intrusive as possible to let me lay in until a late 7am or so.
[1] https://youtu.be/KYlC5CXWHZI
Not a parent, and I don't play one on TV, but here's an idea I just had. Why not just get a device with horrible battery life, and tell the kids you can't use it while it charges? I know kids compare how restrictive their parents are all the time ("my dad lets me do x", "my mom only lets me use the tablet for an hour!") but I don't think they compare battery life of devices. And I really doubt any kid would think their parents are secretly controlling the battery life either. Suddenly, you're on their side, and the conversation shifts.
Before: "Daddy, give me the tablet! Now!"
After: "Daddy, the tablet's out of batteries, what should we do?" "Oh, let's go outside and play together!
Before: "Daddy, give me the tablet! Now!"
After: "Daddy, the tablet's out of batteries, what should we do?" "Oh, let's go outside and play together!
On the one hand you are setting a boundary for the kid. On the other hand you are declining to do so in favor of building the boundary into the situation. Both approaches have merit, but you have to find ways to handle the first one eventually anyway.
Yes. Parent of 6 year old here. Screens are the modern day crack cocaine of childhood.
This is one of those stories where even if it is partially or entirely fabricated, the probability of something like it happening somewhere is nearly 100%. The odd thing about the story may be that this is the one that happened to get to the news, given how many times such things have probably happened.
(Similarly for the DailyWTF stories that people often claim can't be real. Well, even if the story you're looking at is made up, it's still happened a dozen times in the last week. Count yourself lucky that you can react in disbelief to these sorts of stories.)
(Similarly for the DailyWTF stories that people often claim can't be real. Well, even if the story you're looking at is made up, it's still happened a dozen times in the last week. Count yourself lucky that you can react in disbelief to these sorts of stories.)
I actually heard a similar story within my family very recently. My sister had left her young (~1 yrl) daughter with a phone to amuse itself .. and later received an email from eBay letting her know she'd been outbid - on a car.
I must admit, however, my first thought wasn't about authentication - but on the wisdom of using phones as babysitters.
(Of course, I should say I have no idea whether this actually happened either, or if my sister just realised she hadn't reminded us she's a mother for 20 minutes. I didn't ask, it's drama I could live without.)
I must admit, however, my first thought wasn't about authentication - but on the wisdom of using phones as babysitters.
(Of course, I should say I have no idea whether this actually happened either, or if my sister just realised she hadn't reminded us she's a mother for 20 minutes. I didn't ask, it's drama I could live without.)
This is the problem with "news" stories like this... and why I hate them. We would have no way of knowing if this happened or not. It's plausible, but plausible isn't the same as "it happened". One could say at best its value is as a cautionary tale to other parents, but I'm willing to bet that if you're a parent you've probably seen the potential for this sort of thing develop in your child already... of course that's speculation, too :-)
(As an aside... who the hell decided that autoplay video/audio was legit?! Yeah, I'm an old guy... and once upon a time that sort of thing was avoided... but really.)
(As an aside... who the hell decided that autoplay video/audio was legit?! Yeah, I'm an old guy... and once upon a time that sort of thing was avoided... but really.)
> It's plausible, but plausible isn't the same as "it happened".
I don't entirely disagree but really, in the context of a fairly trivial matter for anyone who isn't the person in question, what's the difference?
For example, I found a 20 euro bill on the ground at the ATM the other day. It makes no difference to you whether that's true - it only makes a difference to me and the person that lost the bill. At best it serves as a cautionary tale to those that don't pay attention to their money at the ATM.
If the story is plausible (that is, possible and not unlikely) and isn't particularly exceptional (such as, "click here to find out about obama's secret slave trading circle"), what's the difference?
That is, what is the concrete difference, to you and anyone commenting here, whether that child really did that or not? It's not unlikely enough that it would not occur. And we've seen a lot of very real stories about children stealing credit cards to spend hundreds or thousands on mobile games. And if you don't believe those either I can give you a personal account: When I was a kid I repeatedly broke the parental phone lock to call expensive numbers on the TV.
This is an iteration of the same thing.
I don't entirely disagree but really, in the context of a fairly trivial matter for anyone who isn't the person in question, what's the difference?
For example, I found a 20 euro bill on the ground at the ATM the other day. It makes no difference to you whether that's true - it only makes a difference to me and the person that lost the bill. At best it serves as a cautionary tale to those that don't pay attention to their money at the ATM.
If the story is plausible (that is, possible and not unlikely) and isn't particularly exceptional (such as, "click here to find out about obama's secret slave trading circle"), what's the difference?
That is, what is the concrete difference, to you and anyone commenting here, whether that child really did that or not? It's not unlikely enough that it would not occur. And we've seen a lot of very real stories about children stealing credit cards to spend hundreds or thousands on mobile games. And if you don't believe those either I can give you a personal account: When I was a kid I repeatedly broke the parental phone lock to call expensive numbers on the TV.
This is an iteration of the same thing.
Relevant (a statistical look at internet stories): http://slatestarcodex.com/2016/12/12/might-people-on-the-int...
(Autoplay is the scourge of the internet and sites that autoplay audio or video should be treated the same as, say, sites that use the blink tag)
(Autoplay is the scourge of the internet and sites that autoplay audio or video should be treated the same as, say, sites that use the blink tag)
> sites that autoplay audio or video should be treated the same as, say, sites that use the blink tag
At least <blink> didn't cause my browser to spontaneously start making noises.
At least <blink> didn't cause my browser to spontaneously start making noises.
"and once upon a time that sort of thing [autoplay video/audio] was avoided"
It was? I remember websites showing off their ability to make your browser automatically play background music as early as the late 90's / early 00's.
It was? I remember websites showing off their ability to make your browser automatically play background music as early as the late 90's / early 00's.
I'm not suggesting that it didn't ever happen at all; it certainly did on things like personal/vanity sites, some artsy-fartsy sites, but not on the more professional/commercial sites.
Professionally, I remember being in design meetings ~'96/'97 where someone would say, "hey, we could...[blast audio/video]" and the more in the know people would down the idea as being bad form [without regard to the bandwidth issues at the time]. That's the attitude I miss.
Professionally, I remember being in design meetings ~'96/'97 where someone would say, "hey, we could...[blast audio/video]" and the more in the know people would down the idea as being bad form [without regard to the bandwidth issues at the time]. That's the attitude I miss.
1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin )
2. Goods of all kinds are being delivered faster
The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted.
So what does the 'mugging' or identity theft of tomorrow look like? Am I taken at my doorstep and forced to make purchases from my phone with my thumb, while a drone arrives 10 minutes later with 10 iPads OR do I have my phone stolen and thumb lopped off with tree clippers so the fraudster has more time? What happens as retinal scanning becomes more common? What if it is my blood that unlocks my finances & credit?
edit: i've heard thumbs are available for purchase