Fingerprints Replace Credit Cards in Seattle

prostoalex writes "According to CNET News.com, Thriftway introduced biometric systems in its Seattle stores as far back as 2002. The customer would have to be identified first and submit his own fingerprints, as well as register credit cards with the grocery store. But then a Pay By Touch system became quite popular among the store regulars. According to CNET, "one man even drove 400 miles to use the technology". The store also reports 0% of such transactions being fraudulent."

Comments

It's the automated transactions I'm worried about

[bersl2]

The store also reports 0% of such transactions being fraudulent."

I don't think anybody's going to let you buy stuff with a severed finger.

Kind of scary actually

[DarKry]

Someone may have more experience with this than I do, but this is a bit scary. Has anyone else read the book "Stealing the Network". It goes into some detail on the subject of synthetic fingerprints and just how easy they are to make at home. The book is at home and I am at work or I would post the links that they have as refereneces. I can see the usefulness of the fingerprint perhaps replacing the signature or pin number, but the whole credit card!!! I don't know about you guys but when I realize that I left my credit card sitting around in a public place I freak out. I guess I am going to have to wear gloves from now on, or carry around a bottle of cleaning solution everywhere I go.

Someone with more experience please comment, especially if you have the links from that book, I am curious to read up.

Thanks

2 Questions

[bwcarty]

1) Have sales of gummy bears experienced a dramatic surge in the area?

and...

2) Can I choose which finger to give them for my biometrics?

Identity theft would require a two phase approach

[crovira]

The only finnicky part is getting your fingerprint pattern key (the raw info is not sent, it gets crunched down by the scanner,) into the database on somebody ELSE's account. HE will be the one stuck with the bill.

You can then run the scam the same way.

Actually it takes less balls to do it because either it works and your laughing or it doesn't and your mutter something about a new scar on your fingerprint to a clerk.

You don't have to worry about getting caught because you're going to have created a false positive (doubling the key) rather than replacing a real record.

Your fingerprint is essentially worthless for security when you've got access to a scanner and to the system.

The trust-worthyness of the original scanner and scannee is the key. The more paranoid you need to be, the more data points you pick, and the more tightly you control the access to the system.