3 ms·

It's a cute idea, but a static pattern is trivially defeated by presenting a smartphone that records the touch pattern. Make a smart box that can stamp a dynami

by ynniv 14y ago

It's a cute idea, but a static pattern is trivially defeated by presenting a smartphone that records the touch pattern. Make a smart box that can stamp a dynamic pattern and you'll be on to something. EDIT: context on why this is important, a comment from the original poster lower on the page: We already have apps that do retail loyalty, coupons, and micro-payments launched on the platform. We also have developers working on apps to authenticate EMRs (electronic medical records) and industrial systems maintenance. Finally, we won the TechCrunch DisruptSF Hackathon back in September by using the stamp as the authentication step for a webservice actuated door lock http://news.ycombinator.com/item?id=4811221 http://news.ycombinator.com/item?id=4811221

oconnore 14y ago
Well, it's equivalent to static RFID or QR codes, and seems easier than either. It's neat. Other ways of doing handshakes with limited hardware: musical chirps, exchanging graphical codes with two front cameras, and ad-hoc wifi.
- ynniv 14y ago
  Indeed, it is equivalent to a static RFID or QR code. Would you secure door locks or physical transactions using a static QR code? "Scan this to prove you were here, but please don't share it on twitter."
  - oconnore 14y ago
    I don't think their security model relies on the pattern being secret. The worst case scenario is company B steals company A's number. This results in company A getting additional payments. Or perhaps company C, seeking to ruin the reputation of company A, sets up a fake 'A' storefront with customer service that doesn't shower.
    - deleted 14y ago
      [deleted]
    - freehunter 14y ago
      Looking around the site, it uses GPS data to verify that you are in the correct store. Stealing the code would give you nothing, since it won't authenticate unless you're physically in the correct location. It matches the three authentication factors: what you own (the phone and the app), what you know (the code on the stamp), and what you are/do (where you are physically). It's straight up multi-factor authentication from where I'm standing.
mikemoka 14y ago
I was about to say the same thing but there is no point in faking it because it appears that the stamp only tells your phone to pay that specific store, the app then would probably ask you for a confirmation on screen (it could also ask you to enter a pin possibly).
- ynniv 14y ago
  If there's "no point in faking it", why does the page make a big deal about uniqueness and ? In your scenario, a GPS fix serves equally well. The claim "Like snowflakes, no two SnowShoe Stamps are exactly alike." is wrong. If you stamp my phone, your SnowShow Stamp will have the same exact signature as a carefully carved potato.
  - mikemoka 14y ago
    in my view: 1-because it is key for each store to have a unique stamp 2- I don' think so,what about stores in the same building or stores very near each other? 3-no two officially produced "snowshoes" though, anyway yes no one would keep you from 3d printing the stamp of another store so that you can have your customers pay that store instead of yours, but I don't see any clear advantage in it, and, as i said before, the app would probably show you the store name before proceeding
evan_ 14y ago
a future improvement could have a stamp with a microprocessor and many touch nubs, which "activates" certain touch nubs based on a time-based algorithm. It would work like any other one-time passcode like Google Authenticator.
- ynniv 14y ago
  That was the improvement I imagined as well, but the product presented is not that and shouldn't be described as any more secure than a static QR code.

by ynniv 14y ago

oconnore 14y ago

Well, it's equivalent to static RFID or QR codes, and seems easier than either. It's neat. Other ways of doing handshakes with limited hardware: musical chirps, exchanging graphical codes with two front cameras, and ad-hoc wifi.

ynniv 14y ago
Indeed, it is equivalent to a static RFID or QR code. Would you secure door locks or physical transactions using a static QR code? "Scan this to prove you were here, but please don't share it on twitter."
- oconnore 14y ago
  I don't think their security model relies on the pattern being secret. The worst case scenario is company B steals company A's number. This results in company A getting additional payments. Or perhaps company C, seeking to ruin the reputation of company A, sets up a fake 'A' storefront with customer service that doesn't shower.
  - deleted 14y ago
    [deleted]
  - freehunter 14y ago
    Looking around the site, it uses GPS data to verify that you are in the correct store. Stealing the code would give you nothing, since it won't authenticate unless you're physically in the correct location. It matches the three authentication factors: what you own (the phone and the app), what you know (the code on the stamp), and what you are/do (where you are physically). It's straight up multi-factor authentication from where I'm standing.

mikemoka 14y ago

I was about to say the same thing but there is no point in faking it because it appears that the stamp only tells your phone to pay that specific store, the app then would probably ask you for a confirmation on screen (it could also ask you to enter a pin possibly).

ynniv 14y ago
If there's "no point in faking it", why does the page make a big deal about uniqueness and ? In your scenario, a GPS fix serves equally well. The claim "Like snowflakes, no two SnowShoe Stamps are exactly alike." is wrong. If you stamp my phone, your SnowShow Stamp will have the same exact signature as a carefully carved potato.
- mikemoka 14y ago
  in my view: 1-because it is key for each store to have a unique stamp 2- I don' think so,what about stores in the same building or stores very near each other? 3-no two officially produced "snowshoes" though, anyway yes no one would keep you from 3d printing the stamp of another store so that you can have your customers pay that store instead of yours, but I don't see any clear advantage in it, and, as i said before, the app would probably show you the store name before proceeding

evan_ 14y ago

a future improvement could have a stamp with a microprocessor and many touch nubs, which "activates" certain touch nubs based on a time-based algorithm. It would work like any other one-time passcode like Google Authenticator.

ynniv 14y ago
That was the improvement I imagined as well, but the product presented is not that and shouldn't be described as any more secure than a static QR code.