4 ms·

A frozen yogurt shop I used to visit a lot started using Punchd back in June. The app is cute, but I'd rather just have a paper card. After the transaction, t

by ben1040 15y ago

A frozen yogurt shop I used to visit a lot started using Punchd back in June. The app is cute, but I'd rather just have a paper card. After the transaction, the clerk has to pull out a QR code card to let you scan. The app on your phone won't try scanning until it can get a location to verify you're actually there. Maybe a quarter of the time my phone's flaky GPS has trouble getting a location, so the clerk ends up standing there with the card out while I hold my phone out. Then once it scans, it takes a moment or two for the app to talk to the backend and register the punch. Even if my phone had perfect GPS it'd still be a little too much effort. The yogurt shop eventually wound up getting paper punch cards in addition to Punchd, and I started using those instead of the mobile app. It takes less time for them to just take the card and stamp it than it does to do the whole Punchd dance. With Google's oomph behind this, I could see them start using NFC tags, which might speed up the process. But until then I've quit using this as a customer.

dpark 15y ago
So the punch is based on scanning a QR code? Unless I'm misunderstanding, this is really broken. It sounds like someone could write a counterfeit app that scans the QR code, records the current location, and resubmits every minute, recording tons of punches that never actually happened. They should do it the other way. Your phone should pop up a unque code for the cashier to scan. I guess that makes the barrier to entry higher, though. Maybe change the QR code daily at least (for businesses concerned about fraud, anyway).
- ben1040 15y ago
  So the punch is based on scanning a QR code? That's correct. The business has a card with a QR code printed on it that you scan to get a "punch." This is part of the value proposition for the merchants, I guess - they don't need a phone or device of their own at all, they just need to print a few things. The tradeoff is maybe the system is easier to game for the tiny percent that is technically inclined enough to try it.
  - datums 15y ago
    Perka closes that loop hole by having the person behind the counter verify your visit using the app as a merchant. http://getperka.com/foryourbusiness/merchantfaq.html http://getperka.com/foryourbusiness/merchantfaq.html
- vetler 15y ago
  My local coffee shop uses a paper card that is scribbled with signatures. It would probably be easy for me to fake it and get free coffee. The security requirements for this are pretty lenient. Of course, this doesn't mean that a more technical replacement such as Punchd shouldn't be secure, I just think it's interesting that security wasn't such a big deal before, but now it is, since there's a technical solution.
  - dpark 15y ago
    Fair enough. It's a low-security solution replacing a different low-security solution. I guess the difference with the technical security problem is that it scales. If I write an an app that does provides counterfeit punches, I can distribute it easily and nearly for free. Few people would go through the hassle of counterfeiting the cards, but they might install an app. I guess that if this gains traction and security proves to be a meaningful issue, plugging the hole should be easy enough.
7952 15y ago
Having to use QR codes seems like a real annoyance for marginal benefit for the customer. The advantage for the shop is that it is trivial to implement. Android has started to implement near field communication, which would be much better than scanning a QR code.

by ben1040 15y ago

dpark 15y ago

So the punch is based on scanning a QR code? Unless I'm misunderstanding, this is really broken. It sounds like someone could write a counterfeit app that scans the QR code, records the current location, and resubmits every minute, recording tons of punches that never actually happened. They should do it the other way. Your phone should pop up a unque code for the cashier to scan. I guess that makes the barrier to entry higher, though. Maybe change the QR code daily at least (for businesses concerned about fraud, anyway).

ben1040 15y ago
So the punch is based on scanning a QR code? That's correct. The business has a card with a QR code printed on it that you scan to get a "punch." This is part of the value proposition for the merchants, I guess - they don't need a phone or device of their own at all, they just need to print a few things. The tradeoff is maybe the system is easier to game for the tiny percent that is technically inclined enough to try it.
- datums 15y ago
  Perka closes that loop hole by having the person behind the counter verify your visit using the app as a merchant. http://getperka.com/foryourbusiness/merchantfaq.html http://getperka.com/foryourbusiness/merchantfaq.html
vetler 15y ago
My local coffee shop uses a paper card that is scribbled with signatures. It would probably be easy for me to fake it and get free coffee. The security requirements for this are pretty lenient. Of course, this doesn't mean that a more technical replacement such as Punchd shouldn't be secure, I just think it's interesting that security wasn't such a big deal before, but now it is, since there's a technical solution.
- dpark 15y ago
  Fair enough. It's a low-security solution replacing a different low-security solution. I guess the difference with the technical security problem is that it scales. If I write an an app that does provides counterfeit punches, I can distribute it easily and nearly for free. Few people would go through the hassle of counterfeiting the cards, but they might install an app. I guess that if this gains traction and security proves to be a meaningful issue, plugging the hole should be easy enough.

7952 15y ago

Having to use QR codes seems like a real annoyance for marginal benefit for the customer. The advantage for the shop is that it is trivial to implement. Android has started to implement near field communication, which would be much better than scanning a QR code.