8 ms·

Amazon is bringing palm-scanning payment system to Whole Foods stores

31 points by jbredeche 5y ago

trhway 5y ago
will it also tell the future - i mean with access to you payment and buying and viewing history and with a bit of AI thrown on top they can do it very well :) Those behemoth "total awareness" companies would soon be able not only predict your future, they would be able to actually implement whatever future they decide for you.
DannyB2 5y ago
What about the major problem with biometrics? You can change your credit card. Change your bank. Change your name. And for the sheep who are so inclined, even change your underwear. But you can't change your biometric data. Now suppose some bad guy cuts off your hand at the wrist. They can then produce that bloody item at the POS terminal and use it to pay for goods. At this point you have just become the victim of a serious crime because you are now responsible for payment.
- JoshTko 5y ago
  I think owing $50 for groceries is not what someone is going to be worrying about the most here...
- justicezyx 5y ago
  Let's be real. Changing your name does not change your credit history. Losing an illusory value you have never owned by adopting a new technology, that's not a real problem.
- frumper 5y ago
  Maybe a less dramatic situation than your hand being removed, what if a bad guy figures out the ability to copy your palm print.
  - JumpCrisscross 5y ago
    > what if a bad guy figures out the ability to copy your palm print Then you would dispute the charge and have your own geolocation data or the store's video footage to substantiate your claim. This is a grocery store, not a diamond merchant.
    - frumper 5y ago
      The problem isn't this one transaction. Of course you could dispute it, but you're in for a life of disputing charges as you can't tell the merchant to not accept your hand print and use a newly issued one like a card number when it is compromised
      - NovemberWhiskey 5y ago
        The article says that you have to register the palm print vs a credit card. A common-sense approach would suggest that if you cancel the credit card, then registration also lapses. If you happen to have attracted the attention of this master counterfeiter who has duplicated your palm you would simply have the option of not registering your new card with the system. If this happens on a large scale, yes, the whole project is doomed.
        pavel_lishin 5y ago
        What happens when you register with the next credit card? It's not like your palm print will change.
        NovemberWhiskey 5y ago
        Don't do that then. If you find that someone has (somehow) managed to duplicate your palm print then you probably do not want to enroll with that option for payments in the future.
        pavel_lishin 5y ago
- renewiltord 5y ago
  I feel like the crime of hand-cutting is way worse than the crime of using a stolen credit card. Like, it feels like the worst way to buy groceries. The cases in Malaysia with the cut off thumbs to start a Mercedes make sense but for groceries the concept is outlandish.
  - tyingq 5y ago
    I think the idea is that Amazon is big enough to make palm prints a strong precedent that eventually ends up in things like expensive cars.
    - throwawayboise 5y ago
      An employer of mine used biometrics (palm scan) to control entry. They dropped it and went back to NFC cards and PIN. Never explained why.
  - olyjohn 5y ago
    Do you think they're only using this for groceries and that it will never be expanded to other retail? In the article it says they are already in talks with other vendors. This means your hand does more than just buy groceries, it will work anywhere there is a palm scanning terminal. It will work at WalMart or Best Buy to buy thousands of dollars of electronics, or maybe even one day to buy a car. Maybe your phone will even be able to read palm prints, and you can buy and sell private goods, or illegal goods using it. That's a lot more than a bunch of groceries.
    - renewiltord 5y ago
      Sure but if you're walking into a store you can use my contactless card. Using my hand is kind of...unnecessary. At that point, you're just cutting off my hand for the sake of it.
    - NovemberWhiskey 5y ago
      If people are willing to go to these extents then the biometrics aspect is just a red herring. They kidnap your spouse/child/parent and threaten to murder them unless you go through with the transaction. They hold a gun to your head while you transfer the contents of your bitcoin wallet to them. They beat you with a rubber hose until you give them your safe combination.
- RandallBrown 5y ago
  You wouldn't be responsible for the payment just like you aren't responsible for the payment with a stolen credit card. I also wouldn't be surprised if these terminals had a pulse detector that would stop a severed hand from working at all. You'd probably even have an easier time proving your hand was stolen it since your hand is missing. It's still a problem that if someone compromises your biometric data they'll have full access forever. In practice that isn't a huge problem because it's still really hard to do.
- notatoad 5y ago
  >They can then produce that bloody item at the POS terminal given the general attitudes towards privacy and biometric data here on HN, i honestly can't tell if people trying to pay for groceries with bloody severed limbs is a concern you legitimately have or if this is satire.
  - DannyB2 5y ago
    Shirley being responsible for payment wouldn't be the first serious crime that one would have been the victim of if their hand were severed.
  - cheschire 5y ago
    Well maybe it's intended to be tongue-in-cheek, like "prepare for the zombie apocalypse, and you prepare for all catastrophic events."
  - evanextreme 5y ago
    The cutting off a hand thing might be satire, but the threat of biometric data being replicated and used if its the only measure of authentication isn't. If we have the ability to read and scan palm prints, than the technology to replicate those prints into maybe a faux glove and trick this system isnt that far off i'd assume, right? Comparing this system to, for instance a chip card reader, the palm print is significantly less secure because it uses a single factor (something you are) versus a chip which requires the customer to both have the card with the chip present for payment, and to know the PIN in order to authenticate. Or your phone for example, if someone steals your fingerprint (or even models your face), they still need to have your physical phone to unlock it. With this palm scanning tech, all you need is the palm and you can pay for anything anywhere because there's no secondary confirmation
- maxk42 5y ago
  Serious response to your non-serious question: There are numerous reports of people being locked out of their biometric accounts after an injury. If you burn yourself cooking and have a blister on your hand you may not be able to go buy first aid supplies at Whole Foods afterward. Alternatives are required.
- AndrewMock 5y ago
  Biometrics are immutable! I don't think anybody's going to cut your arm off to steal a television with. However, extremely secure environments certainly avoid biometrics as a "single factor" for this reason. https://arstechnica.com/information-technology/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/ https://arstechnica.com/information-technology/2014/12/polit...
smashem 5y ago
Much better than using facial-recognition tech.
judge2020 5y ago
Disney already required fingerprints for their check-in terminals (and that only stopped with the pandemic; in Disney World, they’re covered up for now). People seem to think accessing Disney is worth it, but I’m not as certain they will for Whole Foods.
- gamegoblin 5y ago
  A key difference is that this is an optional add-on, rather than a requirement. I imagine many people will do this for the convenience.
- crooked-v 5y ago
  The Disney World fingerprint thing (assuming they reinstate they reinstate it) is also a bit different in that they only store a given fingerprint scan for the lifetime of that specific ticket, then discard it.
  - easton 5y ago
    And, interestingly enough, it doesn't actually record the print, but the shape of the fingertip. If you know someone with a close enough fingertip shape, they can use your ticket.
kstrauser 5y ago
This is a terrible idea. I do not believe this, but I was raised around a lot of people who sincerely, devoutly, believe that in the "end times" of the world, a literally Satanic commerce system will require people to buy and sell goods with imprints on their the foreheads or the palms of their hands.[0] If you think we've faced some goofy religion-driven complaints about stuff in the past, wait until that crowd finds out Jeff Bezos wants them to buy his stuff with the Mark of the Beast (which is how they'll describe it). People will lose their minds about this. I am completely serious. Even if the idea of the payment system itself has merit, I predict a terribly chilly cultural reception to the idea. [0]https://biblehub.com/revelation/13-16.htm https://biblehub.com/revelation/13-16.htm
- JumpCrisscross 5y ago
  > a lot of people who sincerely, devoutly, believe that in the "end times" of the world, a literally Satanic commerce system will require people to buy and sell goods with imprints on their the foreheads or the palms of their hands I imagine the overlap between Whole Foods customers and this lot is sparse. If anything, it sounds like a great opportunity for free marketing.
  - kstrauser 5y ago
    Well, if this fully launches, I'd expect them to become completely disjoint sets. But don't for a second believe that the "Satan is coming for us any moment now" crowd doesn't have an awful lot of money and power. I'm not describing a tiny pocket of people who eschew physical possessions, but a rather large portion of the US.
  - king_magic 5y ago
    > If anything, it sounds like a great opportunity for free marketing. Right? I'd shop at Satan's grocery store.
- wrinkl3 5y ago
  Is there a huge overlap between the types of people who worry about this and Whole Foods customers?
tyingq 5y ago
Doesn't say much about how it works. Palm prints? Or depth/shape of veins in your palm? Edit: There's a patent from AMZN: http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=/netahtml/PTO/srchnum.html&r=1&f=G&l=50&s1=20190392189.PGNR.&OS=&RS= http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...
akomtu 5y ago
In an alternative universe, the US AG has filed a lawsuit against Amazon and the House has prepared a law to ban collection and use of biometrics by non-gov entities.
deleted 5y ago
[deleted]
0xCMP 5y ago
I don't see the purpose of this. A phone which authenticates me based on my face or fingerprint and provides a signed request to the terminal is far superior in privacy and security. I never see the point in moving biometric authentication beyond the user device. Even in the event that the signing keys are compromised and are used without the biometric check you can have a chance to rotate those keys and etc. Devices with known problems with their biometric verification could be prevented from registering a new key. Never should a company like amazon have access to the biometric data itself.
- adkadskhj 5y ago
  > Never should a company like amazon have access to the biometric data itself. Perhaps that's exactly the purpose.
ortusdux 5y ago
Finger/palm prints are user names, not passwords.
tssva 5y ago
Can they first just integrate payment through the Amazon app with Whole Foods in store purchasing. If I'm scanning a barcode in the app to get Prime discounts anyways it sure would be nice to have that also process my payment. It would also allow the use of Amazon gift cards for Whole Foods in store purchases. If I order Whole Foods same day grocery delivery or pickup through the Amazon app I can already do this so why not in store?

31 points by jbredeche 5y ago

will it also tell the future - i mean with access to you payment and buying and viewing history and with a bit of AI thrown on top they can do it very well :) Those behemoth "total awareness" companies would soon be able not only predict your future, they would be able to actually implement whatever future they decide for you.

DannyB2 5y ago

What about the major problem with biometrics? You can change your credit card. Change your bank. Change your name. And for the sheep who are so inclined, even change your underwear. But you can't change your biometric data. Now suppose some bad guy cuts off your hand at the wrist. They can then produce that bloody item at the POS terminal and use it to pay for goods. At this point you have just become the victim of a serious crime because you are now responsible for payment.

JoshTko 5y ago
I think owing $50 for groceries is not what someone is going to be worrying about the most here...
justicezyx 5y ago
Let's be real. Changing your name does not change your credit history. Losing an illusory value you have never owned by adopting a new technology, that's not a real problem.
frumper 5y ago
Maybe a less dramatic situation than your hand being removed, what if a bad guy figures out the ability to copy your palm print.
- JumpCrisscross 5y ago
  > what if a bad guy figures out the ability to copy your palm print Then you would dispute the charge and have your own geolocation data or the store's video footage to substantiate your claim. This is a grocery store, not a diamond merchant.
  - frumper 5y ago
    The problem isn't this one transaction. Of course you could dispute it, but you're in for a life of disputing charges as you can't tell the merchant to not accept your hand print and use a newly issued one like a card number when it is compromised
    - NovemberWhiskey 5y ago
      The article says that you have to register the palm print vs a credit card. A common-sense approach would suggest that if you cancel the credit card, then registration also lapses. If you happen to have attracted the attention of this master counterfeiter who has duplicated your palm you would simply have the option of not registering your new card with the system. If this happens on a large scale, yes, the whole project is doomed.
      - pavel_lishin 5y ago
        What happens when you register with the next credit card? It's not like your palm print will change.
        NovemberWhiskey 5y ago
        Don't do that then. If you find that someone has (somehow) managed to duplicate your palm print then you probably do not want to enroll with that option for payments in the future.
        pavel_lishin 5y ago
renewiltord 5y ago
I feel like the crime of hand-cutting is way worse than the crime of using a stolen credit card. Like, it feels like the worst way to buy groceries. The cases in Malaysia with the cut off thumbs to start a Mercedes make sense but for groceries the concept is outlandish.
- tyingq 5y ago
  I think the idea is that Amazon is big enough to make palm prints a strong precedent that eventually ends up in things like expensive cars.
  - throwawayboise 5y ago
    An employer of mine used biometrics (palm scan) to control entry. They dropped it and went back to NFC cards and PIN. Never explained why.
- olyjohn 5y ago
  Do you think they're only using this for groceries and that it will never be expanded to other retail? In the article it says they are already in talks with other vendors. This means your hand does more than just buy groceries, it will work anywhere there is a palm scanning terminal. It will work at WalMart or Best Buy to buy thousands of dollars of electronics, or maybe even one day to buy a car. Maybe your phone will even be able to read palm prints, and you can buy and sell private goods, or illegal goods using it. That's a lot more than a bunch of groceries.
  - renewiltord 5y ago
    Sure but if you're walking into a store you can use my contactless card. Using my hand is kind of...unnecessary. At that point, you're just cutting off my hand for the sake of it.
  - NovemberWhiskey 5y ago
    If people are willing to go to these extents then the biometrics aspect is just a red herring. They kidnap your spouse/child/parent and threaten to murder them unless you go through with the transaction. They hold a gun to your head while you transfer the contents of your bitcoin wallet to them. They beat you with a rubber hose until you give them your safe combination.
RandallBrown 5y ago
You wouldn't be responsible for the payment just like you aren't responsible for the payment with a stolen credit card. I also wouldn't be surprised if these terminals had a pulse detector that would stop a severed hand from working at all. You'd probably even have an easier time proving your hand was stolen it since your hand is missing. It's still a problem that if someone compromises your biometric data they'll have full access forever. In practice that isn't a huge problem because it's still really hard to do.
notatoad 5y ago
>They can then produce that bloody item at the POS terminal given the general attitudes towards privacy and biometric data here on HN, i honestly can't tell if people trying to pay for groceries with bloody severed limbs is a concern you legitimately have or if this is satire.
- DannyB2 5y ago
  Shirley being responsible for payment wouldn't be the first serious crime that one would have been the victim of if their hand were severed.
- cheschire 5y ago
  Well maybe it's intended to be tongue-in-cheek, like "prepare for the zombie apocalypse, and you prepare for all catastrophic events."
- evanextreme 5y ago
  The cutting off a hand thing might be satire, but the threat of biometric data being replicated and used if its the only measure of authentication isn't. If we have the ability to read and scan palm prints, than the technology to replicate those prints into maybe a faux glove and trick this system isnt that far off i'd assume, right? Comparing this system to, for instance a chip card reader, the palm print is significantly less secure because it uses a single factor (something you are) versus a chip which requires the customer to both have the card with the chip present for payment, and to know the PIN in order to authenticate. Or your phone for example, if someone steals your fingerprint (or even models your face), they still need to have your physical phone to unlock it. With this palm scanning tech, all you need is the palm and you can pay for anything anywhere because there's no secondary confirmation
maxk42 5y ago
Serious response to your non-serious question: There are numerous reports of people being locked out of their biometric accounts after an injury. If you burn yourself cooking and have a blister on your hand you may not be able to go buy first aid supplies at Whole Foods afterward. Alternatives are required.
AndrewMock 5y ago
Biometrics are immutable! I don't think anybody's going to cut your arm off to steal a television with. However, extremely secure environments certainly avoid biometrics as a "single factor" for this reason. https://arstechnica.com/information-technology/2014/12/politicians-fingerprint-reproduced-using-photos-of-her-hands/ https://arstechnica.com/information-technology/2014/12/polit...

smashem 5y ago

Much better than using facial-recognition tech.

judge2020 5y ago

Disney already required fingerprints for their check-in terminals (and that only stopped with the pandemic; in Disney World, they’re covered up for now). People seem to think accessing Disney is worth it, but I’m not as certain they will for Whole Foods.

gamegoblin 5y ago
A key difference is that this is an optional add-on, rather than a requirement. I imagine many people will do this for the convenience.
crooked-v 5y ago
The Disney World fingerprint thing (assuming they reinstate they reinstate it) is also a bit different in that they only store a given fingerprint scan for the lifetime of that specific ticket, then discard it.
- easton 5y ago
  And, interestingly enough, it doesn't actually record the print, but the shape of the fingertip. If you know someone with a close enough fingertip shape, they can use your ticket.

kstrauser 5y ago

This is a terrible idea. I do not believe this, but I was raised around a lot of people who sincerely, devoutly, believe that in the "end times" of the world, a literally Satanic commerce system will require people to buy and sell goods with imprints on their the foreheads or the palms of their hands.[0] If you think we've faced some goofy religion-driven complaints about stuff in the past, wait until that crowd finds out Jeff Bezos wants them to buy his stuff with the Mark of the Beast (which is how they'll describe it). People will lose their minds about this. I am completely serious. Even if the idea of the payment system itself has merit, I predict a terribly chilly cultural reception to the idea. [0]https://biblehub.com/revelation/13-16.htm https://biblehub.com/revelation/13-16.htm

JumpCrisscross 5y ago
> a lot of people who sincerely, devoutly, believe that in the "end times" of the world, a literally Satanic commerce system will require people to buy and sell goods with imprints on their the foreheads or the palms of their hands I imagine the overlap between Whole Foods customers and this lot is sparse. If anything, it sounds like a great opportunity for free marketing.
- kstrauser 5y ago
  Well, if this fully launches, I'd expect them to become completely disjoint sets. But don't for a second believe that the "Satan is coming for us any moment now" crowd doesn't have an awful lot of money and power. I'm not describing a tiny pocket of people who eschew physical possessions, but a rather large portion of the US.
- king_magic 5y ago
  > If anything, it sounds like a great opportunity for free marketing. Right? I'd shop at Satan's grocery store.
wrinkl3 5y ago
Is there a huge overlap between the types of people who worry about this and Whole Foods customers?

tyingq 5y ago

Doesn't say much about how it works. Palm prints? Or depth/shape of veins in your palm? Edit: There's a patent from AMZN: http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=/netahtml/PTO/srchnum.html&r=1&f=G&l=50&s1=20190392189.PGNR.&OS=&RS= http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=H...

akomtu 5y ago

In an alternative universe, the US AG has filed a lawsuit against Amazon and the House has prepared a law to ban collection and use of biometrics by non-gov entities.

deleted 5y ago

[deleted]

0xCMP 5y ago

I don't see the purpose of this. A phone which authenticates me based on my face or fingerprint and provides a signed request to the terminal is far superior in privacy and security. I never see the point in moving biometric authentication beyond the user device. Even in the event that the signing keys are compromised and are used without the biometric check you can have a chance to rotate those keys and etc. Devices with known problems with their biometric verification could be prevented from registering a new key. Never should a company like amazon have access to the biometric data itself.

adkadskhj 5y ago
> Never should a company like amazon have access to the biometric data itself. Perhaps that's exactly the purpose.

ortusdux 5y ago

Finger/palm prints are user names, not passwords.

tssva 5y ago

Can they first just integrate payment through the Amazon app with Whole Foods in store purchasing. If I'm scanning a barcode in the app to get Prime discounts anyways it sure would be nice to have that also process my payment. It would also allow the use of Amazon gift cards for Whole Foods in store purchases. If I order Whole Foods same day grocery delivery or pickup through the Amazon app I can already do this so why not in store?