13 ms·
Child uses sleeping mom's thumbprint to buy $250 worth of Pokémon toys
- nfriedly 10y ago> ordered 13 Pokemon gifts [...] was only allowed to return four of the items What's up with that? Isn't there a law that limits liability for unauthorized purchases to $50? (And don't most banks and credit cards just make it $0?)
- dangrossman 10y agoUnder the FCBA your liability for purchases made with a lost or stolen credit card is limited if you report the use to your card issuer in a timely manner. There's no requirement that Amazon voluntarily refund all your kids' purchases, and I'm not sure that unauthorized use of an Amazon account counts as theft of the physical credit card in this case anyway.
- IanCal 10y agoStrange. In the UK at least this would have been covered under existing regulation: http://www.which.co.uk/consumer-rights/advice/i-want-to-return-something-bought-online http://www.which.co.uk/consumer-rights/advice/i-want-to-retu...
- manarth 10y agoI'd guess that some of the products were from Amazon whilst others were from third-party vendors. As for the question of liability, there's usually a proviso for taking legal/criminal action against the perpetrator. Even if the parent wanted to take action against their child, being below the age of criminal responsibility, the parents may be legally responsible in any case.
- greglindahl 10y agoHere's an example of a lawsuit compelling refunds of in-app purchases made by minors: http://www.reuters.com/article/us-apps-kids-idUSBREA2U0M920140331 http://www.reuters.com/article/us-apps-kids-idUSBREA2U0M9201...
- datpuz 10y agoA true hacker.
- deleted 10y ago[deleted]
- jenamety 10y agoi'm seeing two (obvious) bigger picture trends here that this story reinforces. 1. Digital authentication for purchasing is moving towards non-transferable biometrics ( i cant divulge my thumbprint like i can my pin ) 2. Goods of all kinds are being delivered faster The scary thing for me is that thieves love goods delivered quickly, so they can turn them quickly, and cut down on their ability to get intercepted. So what does the 'mugging' or identity theft of tomorrow look like? Am I taken at my doorstep and forced to make purchases from my phone with my thumb, while a drone arrives 10 minutes later with 10 iPads OR do I have my phone stolen and thumb lopped off with tree clippers so the fraudster has more time? What happens as retinal scanning becomes more common? What if it is my blood that unlocks my finances & credit? edit: i've heard thumbs are available for purchase
- jcadam 10y agoI had to disable touch ID on my iPhone out of frustration. It works for me maybe 1 out of 10 times no matter which finger I try to use (my wife has no problem with hers). But I've always had trouble with fingerprint readers. At the DMV, govt ID card office (back when I was in the Army), etc. "Place your finger on the scanner. Nope, try again.. press harder. No, harder." I have no idea what's wrong with my fingers :|
- pc86 10y agoSounds like low ridges that mess with the scanners.
- ehnto 10y agoI have scarring across my fingerprints that changes fairly frequently (serious injuries when younger coupled with powerlifting regularly now, unnoticable but definitely not static) I am an edge case but surprisingly only had infrequent issues. I don't use thumb scanners anymore though as inevitably my finger will change! It definitely isn't for everyone.
- lostlogin 10y agoHave you tried registering the same finger 5x?
- aaron695 10y ago"used her mother's thumb to unlock a phone and open the Amazon app as mom napped on the couch" Or she made it up.....
- cosmie 10y agoThe mom? I have a small child that's been coming up to me with my phone and trying to nonchalantly guide my finger to unlock it since she was 4. She's never done it in my sleep (that I know of), but I don't for a second doubt she'd be able to do it if she was motivated to.
- Waterluvian 10y agoAs an upcoming parent, these are the things that scare me. Where my kids start exhibiting what look disturbingly like addictive behaviours. Is this just how kids naturally are, or are screens just so compelling? I remember loving the TV as a kid but recall that somehow, magically, my parents kept me off it outside TV hours without use of a password. I need to figure out that secret before its too late!
- weavie 10y agoYes. Parent of 6 year old here. Screens are the modern day crack cocaine of childhood.
- dvdhnt 10y agoParent here, of a toddler and a 1st grader, and based on my experience it's all about context. For example, if any of the following are true, the TV exists: TV is on or the children are inside and sedentary. Conversely, from the children's perspective, they tend to forget the TV exists or is an option if otherwise preoccupied indoors by activities like painting, reading, playing pretend, etc., or are in fact outdoors. TL;DR - If kids can't see it, it doesn't exist.
- Waterluvian 10y agoThat seems very intuitive. I wonder how it translates to mobile devices. I suspect the same applies, so long as I apply the same discipline to providing access to the tablet. If they're inside and sedentary, they'll want it. If it's not tablet time, keep them busy.
- dexwiz 10y agoSo is the 21st century version of stealing cash from your mom's purse?
- Waterluvian 10y agoYup. In my opinion, this isn't a problem that needs solving. I bet with thumbprint security, money is more secure from house hooligans than it was when held in a wallet.
- icebraining 10y agoMaybe, but on the other hand, most people don't keep $250 in their wallets. Having an extra verification mechanism for expensive purchases seems appropriate.
- Waterluvian 10y agoDepends how likely this scenario is. Adding security to a high risk, low occurence event can be seen as wasteful. Also before this technology, people kept credit cards in their wallet, which suffered the same fate from house hooligans. And before credit, people did keep $250 in their wallet.
- icebraining 10y agoWell, the security could just be to ask for one's password again. I guess the credit card part is true; around here most people have debit cards with PINs, and which can't be used remotely, so it's unlikely a six-year-old could use it without their parent's consent. Then again, around here those parents would have the legal right to return all those purchases.
- alex- 10y agoSmall cash theft can be done over and over. An online theft leaves a paper trail, normally with email confirmation. I would be surprised if a child got away with it twice and the total harm would be much more trackable.
- saosebastiao 10y agoI get relatively annoyed about the facile pedantry of this argument, but this is exactly the poster case for it, so here goes: fingerprints are usernames, not passwords.
- dragonwriter 10y agoFingerprints are neither really suitable as usernames (because you can neither guarantee that users have them or that thhey don't change outside of your and the user's control or, really, even that they are unique, though they are conventionally assumed to be so) nor passwords (because they aren't secret, can't be changed if compromised, etc.)
- darpa_escapee 10y agoEven if prints were unique, the heuristics upon which we match them to a given input isn't perfect. It is an guesstimation.
- dvdhnt 10y agoHuh, I've actually never looked at them from that perspective, but it makes total sense.
- cheald 10y agoJust make sure to use a fingerprint manager and rotate your fingerprints on a regular basis.
- Waterluvian 10y agoI disagree. Fingerprints are privacy locks, not security locks. The lock in your bathroom isn't meant to secure the bathroom. It's just a way to ensure that people get the message, "please don't enter". A fingerprint on a phone is a way of saying the same thing. This phone isn't meant for common use, please don't enter.
- yellowapple 10y ago
- andrewclunn 10y agoSounds like an excellent potential recruit for Team Rocket!
- bryanmgreen 10y agoThere's not a way to combine both Touch ID and PIN for iOS access, but some apps do provide a PIN or passcode setting. For me, with the banking apps on my phone for example, I use my fingerprint to get into my phone and then manually type in the password. Seems like the best combo to me for mobile security. (Not that I'm worried about it, I'm just security minded.)
- soneil 10y agoIt'd seem fairly trivial for, e.g. Amazon (as in this case) to ask for your Amazon password if you go over a certain dollar-spend - or even weigh the risk of various product categories (e.g., you commonly overnight items from household goods, so we'll trust your thumbprint; but you've never ordered 5 TVs before, you're gonna need your password for that one).
- bryanmgreen 10y agoSmart authentication/authorization is really interesting and I think a good middle ground for most people.
- makecheck 10y agoIt seems like they could add a few less-predictable factors to improve the security of thumbprints without completely ruining their convenience. For instance: — Maybe you must use two or more particular fingerprints in sequence, selected by you in advance. This would require a “sleep attack” to at least try different combinations of your fingers (without knowing which to use first or how many fingers are required). — Maybe you have to hold down your thumb in a pattern that you set in advance (e.g. at least 2 seconds on, followed by one second off and one second on). — Maybe a 3-by-3 grid appears and you have to tap one of the squares that were set in advance by you before using your fingerprint. This is faster than having to enter a whole pass-code but slightly stronger than just tapping a finger. Of course, each of these trades off time (convenience) for slightly better security.
- goda90 10y agoI'm just imagining the court case where they can force the defendant to put their finger to the reader, but they can't force them to say what order it has to be in, so they'll slowly make the defendant try all the combinations.
- spacehome 10y agoThen that's just back to the situation today with passwords/passcodes. The answer is rate limiting.
- backtoyoujim 10y agoThis will only end in nano-blood-draws with genotypic personalization built into my online refrigerator all over LDAP.
- TeMPOraL 10y agoOf course both the blood drawer and the genotype analytics service will both be operating on two different clouds. Don't forget to pay your Internet bill if you don't want to starve.
- darpa_escapee 10y ago
- crististm 10y agoFingerprints are not passwords. They are more like (but not exactly) usernames. People seem to numb out when they hear this in person. I don't understand why...
- 234dd57d2c8db 10y agoBiometrics are _not_ passwords! You can never change them. You know, if everyone starts spreading their biometrics around willy-nilly, one day one of those databases WILL be hacked. And then what? Oops all the biometric data leaked and now every service that uses them as a password just got pwned. I will never be providing any biometrics to a service that uses them as a password if I have the power to do so. Biometrics work great as a _username_, not passwords!
- distantsounds 10y agoA fingerprint is /who you are/, i.e. a username. A password is /what you know/, i.e. a phrase or string of characters. Confirming you're the correct person is only half of the equation.
- darpa_escapee 10y agoIn before "where were the parents??"
- sova 10y agothis kid will undoubtedly read hn in the future
- intopieces 10y agoI disabled the iPhone feature that unlocks my phone with my thumbprint and changed it to an alphanumeric password of 20 characters. That feature has always been hit or miss for me anyway. Now it's harder for me to unlock my phone, which has a bonus side-effect of making me use it less often.
- anotherevan 10y agoDo the fingerprint readers on phones check if there is a pulse? I believe that most biometric readers for security (e.g., offices and such) look for a pulse or other indicator so using a severed body-part would not work. Always annoys me when I see that done in movies. (One office I worked in had fingerprint access. The bathrooms were outside the secured area, and I soon got into the habit of rubbing my hands together after washing to warm them up, as a cold finger wouldn't read.)
- maverick_iceman 10y agoTalk about a Midas touch.