Slashdot Mirror
Google Wallet: the End of Anonymous Shopping
jfruhlinger writes "Google today announced Google Wallet, an NFC-based payment system that will allow people to pay for purchases just by waving their phone across a reader. It's the beginning of a future where commercial transactions are 'frictionless' and convenient — but it's a future where every transaction can be tracked and data-mined, as Dan Tynan points out. Stores can user information about your Doritos purchases to rearrange their wares; Google could push coupons via its new Google Offers service; your health insurance company might be interested in your sodium intake."
C'mon, Google Wallet is the end of anonymous shopping? No, if you don't want to be tracked by Google Wallet, just don't use Google Wallet. If you want to stay anonymous, use cash.
And wear a hat.
And gloves.
And a fake mustache.
My postings are informational and does not constitute legal advice. Act on it at your risk.
Aside from being run by Google?
Sendou Wave Kick!!
There's always BitCoin.....
Well, you see, when it comes to patents, people are offended that adding but it's online or but with a computer or but in the cloud makes something qualify as a new idea.
When it comes to things that could involve gathering data, adding but now Google is doing it makes it new and outrageous.
Certain renegade elements of the consumer sector are considering switching to alternate methods of payment in retaliation against Google's proprietary monetary transaction system. "Basically the plan is to exchange small rectangular pieces of green paper in exchange for all debts, public and private," said one proponent of this new monetary system. When asked how his purchasing history would be tracked, indexed, and made available to advertisers in order to better serve him, he responded, "That's kind of the point."
More on this story, and new developments that indicate water may be wetter than once thought, at 11.
It costs the merchant more. It won't be implemented widely in the US, considering that Google's fees are higher than American Express.
I don't respond to AC's.
How is this different from credit cards?
Simple:
A traditional credit card has raised digits and other information on the card itself -- It is not very secure. When you hand your credit card over to the waiter/waitress they can easily snap a pic with their camera phone and sell that data for $2 (wholesale) online.
A magnetic strip bearing credit card has the above insecurities, plus a convenient stripe that can be used to input the information into a computer -- Fake "clone" cards can be created that have the same magnetic signature as your card, and actually, the mag stripe lessens security by giving the clerk a false sense that the card is legit. The clerks don't care anyhow, it's not their money -- As a test I actually use a cloned card printed with the name "Sir Thievey Thiefterson III" and always sign my name as: "This card is Stolen" on all receipts; It's been four years, and still only eight times has my ID been asked for -- at which time I tip the cashier and use my real card.
A near field credit card works via RFID. RFID is not secure. It has no concept of a secret internal state and a challenge response system to authenticate that single (and only that single) transaction. It simply responds to query, any query, with your card info. Once again, we're putting the insecure data that's printed on the outside of the card into a more conveniently readable format, but this time it can also easily be scanned by malicious persons from several hundred feet away by using a Pringles can to shape their antenna's emissions.
None of these data exchange formats have the concept of a secret internal state and a challenge response system to authenticate that single (and only that single) transaction. It takes a computation capable device to provide public key encryption. We solved the problem a long time ago with public / private key pairs -- Google Wallet is a technology that finally uses the solution to the problem of identity theft via "public" card information dissemination. The device and/or application containing the private key (the key itself, even) can itself be locked/unlocked with a pass-phrase.
Note that this is not absolutely secure -- nothing is -- however, it is leaps and bounds more secure than the current dumb "hey here's a plain-text number to get my money" credit card system.
As for traceability -- It's no more traceable than the credit card system, true. It could be made more private by using something in the vein of Bitcoin (there I said it), since it has over a hundred unique account tokens for a given wallet. However, you would need an intermediary to process the transactions on your behalf, and trust them with your identity -- I'm looking at you Google.
In short: The Current Bullshit CC system is Broken as Hell! This is a step in the right direction, get on board or have your identity stolen like a dumbass.
P.S. In 2001 my wallet was stolen from my locker while I was clearing a jam from a trash compactor. I canceled my cards & entire bank account, got new checks & cards, and STILL was fraudulently charged $557.00 via the old canceled bank card three weeks later -- Wells Fargo doesn't care if I followed their security guidelines to the letter and have written proof of such -- they don't care if their agents were the ones that fucked up and didn't take the stolen card off of my name, and it ended up linked to my new account: It's not their money, they don't care (I still "owe" them this money since I refuse to pay for others' mistakes, also, credit reporting companies don't care either).
P.P.S. Cash is still the most secure, but carrying a lot of it is arguably not (Yes, I have been robbed at gunpoint after cashing a large check -- if I had digitally transferred the funds, I would not have lost the money).
Your's truly,
A FOSS Hacker that grew up in the ghettos of H-Town.
What puzzles me is that there is no confirmation step required in these contactless payment systems.
When I buy stuff with my chip-based debit or credit card, I'm asked to enter a PIN. Else, I have to physically swipe the card to ensure there is no ambiguity as to whether or not I meant to pay with my card of choice.
With a contactless system, I could be wanting to pay with my credit card, but if I accidentally held my cell phone too close to the reader, it would debit the amount from my phone instead of my card. Why can't there be a screen that pops-up on the phone that says "Touch button to confirm payment"? This seems to me to be a major design flaw.
Don't wait, switch to cash. They won't be able to track you as easily (not that you probably matter or that they care) and also it'll mean you can't get into debt. Credit is the devil. Never had a credit card, never will. Can't afford it, don't buy it. It's worked great for me for years.
No, that link you posted to a web comic we've all seen a hundred times is not "obligatory."
You are. Either that or your a "them", which might be worse ;)
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
This kind of system offers significantly better security than CCs.
If the system is designed well the stores you visit will never see your financial information (and never have an opportunity to lose it). Encrypt the account information on the phone with a psuedo-random number that is generated every 60s (along the lines of SecureID), send the encrypted data to the store, the store forwards that encrypted string, along with the amount of purchase to the payment server, the server responds back with a simple 'approve/deny' response. This also applies to card skimmers, if someone skims your account details, they're valid for 60s or less.
The system can also be password protected, or even biometricly protected if you really wanted to make things easy; which is better than I've heard of CCs being able to do.
Well, a credit card terminal just gets a total from the register. TFA is assuming that Google will demand and require that all cash registers tell the Google Wallet terminal every single item being purchased! And in case they're wrong, watch how easily it is to back peddle! "You're right, they don't examine what's being bought....yet." It's a classic move, but stick with what works I say.
FTA is absolutely mentally retarded. Lets take a quote. "The store, for example, could aggregate that information to determine that a lot of people are buying Modelo and Doritos at the same time, and may display them closer together inside the store. Or it may determine the demand for Modelo and Doritos spikes after 11 pm and institute variable pricing, charging more for it in the wee hours than it does in the afternoon." Does this retard think that if you pay cash, the cashier is obligated to sell "under the table" and not use the cash register? Cash registers already record what's being bought. And big shock here, but CASH registers are used even for CASH purchases. What total and complete idiot wrote this pile of garbage?
ASCII stupid question, get a stupid ANSI
http://www.google.com/wallet/how-it-works-security.html
The Kruger Dunning explains most post on
Sheesh, people. Stop worrying about about all the silly little things. If you don't want your grocery store collecting information on you, use fake information when you sign up for your card like I do! Problem solved.
There's a bigger issue at stake here, but I haven't seen anyone else mention it yet.
Have you heard of Michael's? The nationwide craft store? Thieves managed to swap out 90 separate credit card readers without anybody knowing, in Michael's stores around the country. They've been snarfing credit card data for quite a while.
With NFC, the thieves will have a field day! They don't even need to swap out readers; just stick your sniffer's antenna somewhere close enough to read the NFC transaction. What do you want to bet that passive receiving can be done from a couple of feet away? Then they just sniff the transaction and away they go.
What's that you say? Secure communication? Hahahaha.
There isn't a major credit card system in existence in the world today that hasn't been hacked at one time or other, and most of those "bugs" just got whitewashed over, not really fixed. Hell, it didn't take long at all to hack the "unique, secure" id from RFID tags and clone them.
The probability that somebody will find a serious vulnerability in the system is close to 1. Combine that with reading from a distance, and it will be a free-for-all.
This is such an outrageously bad idea, I can hardly sit still and not yell at people about it. I have already berated one software company for planning to support NFC in its apps.