Slashdot Mirror
Kroger Testing Fingerprint Payment System
MachineShedFred writes "CNN is reporting that The Kroger Company is testing the use of fingerprinting as means for payment at grocery stores. The article says that it has been well received by both college students and seniors. I, for one would love to see this rolled out to all of Kroger's stores, which include Fred Meyer, Ralph's, QFC, Fry's Marketplace (not the electronics stores), and others; however I'm sure some /.-ers will have privacy concerns as well as law enforcement cooperation issues..."
I'll take "Things that don't happen for $1000 Alex"
You cut or burn your fingers.
It's well hashed out how easy it to to fool fingerprinting biometrics, so let's not have at that again. It's a neat concept, but flawed system. To easy to fool and not bulletproof enough to allow for every day accidents that happen in the kitchen (heaven help me if i cut my finger cutting veggies AND burn it on the stove..)
I just got an HP iPaq 5450 with biometric fingerprint reader. I thought the finger print security feature was pretty sweet until I let my brother try it. After 4 finger swipes, it let him through thinking it was me.
I doubt Kroger will use the same technology, but still cause for concern. Is fingerprint scanning technology really ready for mainstream use?
Now someone will steal my thumb instead of my wallet.
_______
2B1ASK1
So, this is really nothing new, but it looks like this may be one of the larger rollouts of such technology. Really no different (from a practical standpoint) than things like automatic toll booths or Mobil's Speedpass method of buying gas, although fingerprints would be inherently more secure. If we had Kroger stores around here, I'd be willing to sign up, but I don't think they have a presence in Nebraska, at least not in the Lincoln area.
however I'm sure some /.-ers will have privacy concerns as well as law enforcement cooperation issues
SOME! Shit I already have a problem with the current system. Every time I get asked if I have one of their cards for "saving", I just say "Sorry, I don't join cults"!
I imagine they will have alternate forms of payment, to prevent themselves from being hit with an "Americans with Disabilities Act" lawsuit. People without arms or hands would be rightly able to sue the grocery store. I don't see credit card readers or checks being refused in the future.
The folks at the Kroger closest to where I live are very unfriendly and frequently downright nasty. I hate to think what the work environment must be like for everybody there to want to lash out at anybody who comes into the store... as a result, usually my wife and I drive a bit further to go to a different store.
But, if given the option of using my finger to pay, I might go back to the mean Kroger, if I had the option of choosing which finger I got to stick out at them when paying....
-Rob
in genl, i'd agree
one problem I see as we push forward with the "if you have concerns, use cash" is that after some time, it will be suspicious to protect your privacy. People who use cash will be singled out for scrutiny simply be not conformign to the technology that enables scrutiny.
Customers can register for the voluntary program by presenting a drivers license, an index finger and a method of payment -- either credit card, debit card or electronic check
The concern I have is whether random company X will be smart enough to protect payment methods data and fingerprint data, both (most likely) linked to personal info.
A relative worked in a co for a few years back that implemented the software to get supermarkets to accept CCs. The implementations always prevented the merchant from keeping/tracking the payment info. I think this intentional (data anyone?) on the part of the CC companies -- and it's why supermarkets use the 'bonus cards' 'rebate cards' etc. instead of just tracking your purchases with which CC you use. The supermarkets typically don't keep the cc numbers/ name etc. after purchase is complete (I think).
Regardless -- Under this new system, KROGER has to use/implement some IT system that tracks all the users payment methods and prints. While Kroger may do this fine, the assumption is that any company that wants to implement this kind of system, has to either implement or access a (possibly centralized) repository of fingerprint payment method mapping DB, with personal data. This is an enormous hacking target. I work under that assumption that anything that people access can be hacked, and therefore people should alway weigh the benefit of putting datasources together that create a risk for being stolen.
While that arguement does not really apply for one company, as more and more companies start to do this, the question becomes will the systems be secore enough to justify the benefits and costs?
That's right. Most stores, you don't even need the actual card. You just key in your phone number. So setup a card with someone's phone number (it doesn't even need to be a valid number), and give it out to all your friends. The more it is used, the more you get savings, and if you give it out to enough people, the demographics become to skewed to be of any use.
*shrug* It's what me and my family do, and we don't seem to have any problems with using it.
Such a system relies on two major assumptions:
The problems with such a system:
DNA just wants to be free...
They're not? The government can easily track your movements by tracking your credit card purchases. If you use your credit card in a Florida gas station, it's a pretty safe bet that you were in Florida at that time.
Criminals have been caught by the FBI tracking their credit card trail. It's helping in the D.C. sniper cases, too.
Sounds like you've already accepted a tool that lets the government track your every move, and you don't even have to wait 30 years for it!
The gummy mold is just an ordinary photo-etched copper-plated printed circuit board. (I made lots of them when I was a kid from stuff I bought at Radio Shack.) Take a photo of a fingerprint. Make a full size transparency of it. Expose the photosensitive circuit board using the transparency as a mask. Etch the circuit board. Pour ordinary hot liquid gelatin over the board in an even (3 mm or so) layer (the original paper gave a recipe, but you should be able to use any old recipe for "Knox Blox". It's just ordinary gelatin mixed with boiling water.) Harden it in the refrigerator. When it's time to use it, simply cover the tip of your own finger with the sheet of gelatin.
It passes live tests easily. The thin layer of gelatin is almost invisible. It's transparent, so your own skin shows through. It's conductive: it has a moisture content similar to your own body. And it's warm: your body heats up 3mm of gelatin quite rapidly.
And once you pass through the scanner, you just lick your fingertip and the evidence is gone.
Extensive testing of this was performed against eleven different fingerprint scanners earlier this year. EVERY TESTED SCANNER ACCEPTED THE GUMMY FINGERS, including those advertising "live and well detection", with acceptance rates varying between 65% - 100%. John Young's website has a copy of the paper here.
Biometrics, in general, are not sufficient for high security. They work best only in conjunction with other security measures.
John