Hacker News Reader

> Why is a camera involved in purchasing coffee with a card? Genuine question. Was there an issue of people stealing coffee cards, so they used facial-ID matching?

There's huge loss/fraud prevention value in creating visual audit trails.

You don't need to do facial ID matching to recognize recurring theft. You just need a historical photo to correlate who used a card (that you subsequently might learn was a fraudulent charge).

Same way CCTV cameras are used in retail.

> huge loss/fraud prevention value

in a company owned cafeteria, for ordinary pay-per-purchase coffee ?

where is the "loss" ?

better question - is management addicted to spying here?

I think the easy read is that the machine is a commercial machine that can be deployed in places where the functionality is needed. That is, this is not a custom machine for this location. (The story states that the coffee is free in this location.)

Occam's Razor.

>in a company owned cafeteria, for ordinary pay-per-purchase coffee ?

Did you read the thread you are responding to? They said they don't use the camera for this exact reason.

I've worked at several places that had self-serve snack bins that you were expected to pay for, but the machine was just a pay kiosk, not a vending machine.

Typically, the way these operations work is that either the employer contracts out the snack bin to a vendor, or the employer buys the snacks themselves, then charges the employees for them. In either case, if the expectation is to pay for the snacks, and you don't, that's theft.

I have complicated opinions about whether or not an employer should charge their own employees for break-room snacks, but once an employer decides that they should charge for the snacks, then the loss is clear when a snack is taken without paying.

> Same way CCTV cameras are used in retail

Back around 2003 a coworker thought she left her credit card at a store (I think Target). She called them, they asked her to read the number off of the receipt, pulled up the video of her transaction, and told her she had put the card back in her wallet/purse.

I was surprised they had that level of integration and can't imagine what they've got these days.

Wow.

On the one hand, I'm not surprised at all that there are security people in the company that can instantly pull up security cam footage of a register from the receipt number. That makes total sense.

But on the other hand, I never would have guessed that a customer service rep would have access to the system -- or even that if they had to transfer it to the security department, that the security department would be allowed to use the footage for anything customer-facing like that.

Still, that's kinda cool and helpful! Assuming it can't be used for any kind of nefarious invasion-of-privacy uses...

If I left something at a store I would be calling the store itself which I think to this day will eventually get you an internal store employee. Seems like that would be an easy bounce to the security person.

There's a lot of ATMs in Targets. If they have that much watching, I think I want to stand with my hand over the buttons now.

Although someone could probably watch your fingers at the checkout lane put in your pin. Camera script to correlate fingers to access pins automatedly. Machine vision is so much more advanced. Four finger movements, four numbers, tada, debit card access. I could probably write that with ML Kit.

Correlated to your exact receipt, purchases, and time of purchase (with enough fidelity to say "you put your card in your pocket at ##:##"). Track your card through the system, and what bank/clearing house is passing the transaction. When did this exact number amount of money go through and where did the lines send the data? What account was the final transaction processed through?

I usually put my wallet over the touchpad to block it.

Maybe I'll mess up on the PIN, too, to throw people off (although that's probably caused by not being able to see the numbers).

They could also use sound to detect the keypress, but I'm hoping any legit retailer hasn't gone that far, yet.

YMMV, as not familiar with all retail, but typically CCTV footage review is limited to a select group of people.

I'd guess your friend was forwarded to an asset protection person at the store or similar.

Also, in this case, there's not much sensitive about "we saw you put it in your purse."

It'd be a different story if your friend had asked "Did you see what 4-number code I entered on the PIN pad?"

this is absolutely impressive, but target is in no way representative of the avg. level of surveillance/LP tech in retail. they are notorious for being at the leading edge of technology and dedication. Their forensics actually did contract govt work at some point in time.

Meanwhile, someone backs into the taillight on my truck in the parking lot of the local Kroger, and they have zero surveillance footage showing it, despite giving them a date and a 40 minute window of shopping based on my receipt timestamp. sigh

You can't steal from them once you're out of the store. There's little business benefit to watch the parking lot.

And a huge liability - you can't prove that an employee damaged your car if you don't have video of the parking lot

This answer is too simple. For example, target has incredible surveillance of the parking lot so that they can correlate thieves with vehicles.

I think the real answer is that Kroger simply does not take operations seriously. Theres evidence for this in their app, their self checkout experience, how often sales are not applied, the quality of their produce, how dirty the stores are, the way their merger and acquisition stores are all 1/3 integrated, and more im sure

I had someone massively door ding me at Kroger like 15 years ago, and talked to their security and they had cameras but the angle didn't show enough of the door ding to definitely say the person parked next to me did it. I suppose it depends on your specific location, but it's not like they don't have surveillance at all.

Target is known for having forensics labs (which they sometimes loan out to law enforcement) and sophisticated surveillance.

https://www.washingtonpost.com/archive/politics/2006/01/29/r...

https://www.theatlantic.com/technology/archive/2017/04/csi-w...

Neat! TIL

It's hard to keep competency from developing when you have (frequent, sophisticated attacker) + (financial motive to fund countermeasures and resourcing).

(Albeit some retail still seems to find a way)

I assume the end to this story is: they were proven correct when she found her card?

> Why is a camera involved in purchasing coffee with a card? Genuine question.

The sheer number of people in here espousing great volumes of text to explain the ulterior motives of a shitty OEM android control panel on a vending machine crashing out of kiosk mode is utterly unbelievable.

There's probably a nicer way to say this.

On the other hand, maybe a broken vending machine wouldn't be a national talking point if even one person in this entire chain of events had simply accepted that the machine was malfunctioning and might not actually be an instrument of the surveillance state.

Amazon is well known for surveilling its staff. Why act surprised that staff think the worst when they find another piece of surveillance gear in the breakroom?

This is a good point. Many are in glass houses on this issue as who amongst us can say that they have bought a vending machine that doesn’t come with a built in camera

Don't necessarily disagree, but also there's a lot of conspiracy theorist nonsense here for something that could well simply be explained away by "Cheap Android off-the-shelf tablet used as a UI for something". It would've been useful to see some screenshots/pictures of the UI before writing a scare-mongering article about it.

gorkish's comment does at least bring things back down to earth.

I agree with that, but I'm also surprised the vendor didn't go through the process of custom-ordering the off-the-shelf tablet in an MOQ so they could shave cost off by flagging things like the camera as a DNP part.

> shitty OEM android control panel on a vending machine crashing out of kiosk mode

This spot in Seattle has a digital dot matrix sign (says "Surface Mount Technology" in the street view) that has been in factory reset mode, cycling through a demo of its fonts and specs for its serial port, for at least five years.

https://maps.app.goo.gl/87wymvx6kxKToacq5

I've always wondered what the store was behind it. Maybe some defunct business?

Sigital marquees, especially old ones, are hilariously expensive to fix or replace. A client of mine has one like that and was quoted over 300k to replace it when a control software failed.

Luckily, we fixed the controller (which is IR based) but I fully understand why one of those signs would stay in that state now.

I am not sure if this comment was directed at me, but the "genuine question" was a genuine question, not rhetorical :) And the answer I was looking for was "the payment cards probably use QR codes instead of magnets/IR/RFID/etc."

Not sure if anyone has been to shake shake with self order screens lately but those device still have the 'new note' shortcut still enabled. I would leave random notes and come back to see if anyone ever discovered it.

>Why is a camera involved in purchasing coffee with a card?

to scan the QR/bar code that's on the card

If so it should be faced at the ground if that were the case. But that would require privacy considerations by engineers who design cameras into their hardware :/

It makes a ton of sense when you consider that it's cheaper to buy a freight train full of cheap Android tablets with front-facing cameras than it is to engineer a custom device with a camera that faces downwards.

This is exactly it - the number of "high-end" devices that have things like that inside would boggle the mind.

Perhaps the most famous: https://www.theverge.com/circuitbreaker/2017/9/21/16339122/e...

There is no expectation of privacy of your face when engaging in any kind of commercial transaction.

To the contrary, it's an essential measure for helping to track down theft and fraud.

Every self-checkout takes a photo of your face. Every ATM. And basically every store where you check out with a cashier has security cameras capturing your face from angles.

So there is no reason why engineers would want to angle the camera downwards.

> There is no expectation of privacy of your face when engaging in any kind of commercial transaction.

I expect to be informed that recording will be occuring given I live in a two party consent state.

There is an expectation of privacy in certain circumstances, ex law office, Drs office, and the break room (given discussing working conditions in a break room is a protected activity where recording is disallowed)

Every customer support hotline I've ever dialed prefaces the message with 'this conversation may be recorded'. Most ATMs have a video surveillance tag somewhere nearby.

Regardless, if Amazon bought commercial products with recording devices and installed them in the break room, that's ultimately Amazon's responsibility. Perhaps it was an honest mistake, but IMHO Amazon has failed to Earn Trust and Disagree and Commit to following the law when it comes to labor regulations

In case it wasn't clear, I'm talking about taking basic video/still security footage while paying for something. There's no such thing as two-party consent for that.

That has nothing to do with audio recording, which seems to be what you're talking about. I'm not talking about audio, nor is the original article in question, nor the coffee machine in question.

I don't think the media of recording matters so much as that there exists a recording. I agree that in other contexts this might be less troublesome, but Amazon has a history of retaliation against labor organization, and it's quite possible (I'm by no means saying certain or even probable) that this is another instance of such.

It does matter. Video must respect reasonable degree of privacy. So no bathrooms or bedrooms. Anywhere else, fair game.

Well, save for the break room if you're an employer. Any form of surveillance of a break room by the employer opens you up to litigation afaik. If not legally, at least ethically.

>I expect to be informed that recording will be occuring given I live in a two party consent state.

The concept of "two party consent" only applies to conversations. They don't apply to video recordings.

> I expect to be informed that recording will be occuring given I live in a two party consent state.

As far as I am aware, two-party consent is specifically for audio recordings, not recordings without an audio component.

Can these not be scanned using a laser as opposed to a fully fledged video camera?

cots tablets have cameras that are adequate for barcode reading, why increase the bom needlessly?

because a super-obvious spy move is to use something ordinary but also add surveillance to it?

if you have been to a secure Amazon facility you know that there are cameras in every room and in every hall and at every point of entry and exit. Management appears to make no excuses about using those for every possible purpose. The people that work there seem in "constant compliance" mode, and there are more than a few wrecked individuals "just making a living" .. is this a social pattern for the most successful companies to emulate? It seems to be much more like the Ottoman Empire than any Western thing I know of..

The regular UPC style linear barcodes ( https://en.wikipedia.org/wiki/Barcode#Linear_barcodes ) can be read with a laser. You can do neat things with spinning mirrors to handle orientation changes (supermarket checkout scanner).

However, they can't handle the information density of a 2d barcode and the transformations needed to scan a 2d barcode at an arbitrary orientation and reconstruct the original information are more finicky than including what is now a cheap digital camera. The difference between a digital still camera and a digital video is how often you read it out.

You can get a camera for under $10 ( https://www.adafruit.com/product/5733 ) and the ease of using that in combination with a library that can handle 2d barcodes in any orientation is much less work to use than trying to make a scanning laser system to read a 2d barcode.

I imagine in modern devices adding a "fully fledged video camera" is a lot simpler than adding a laser that has moving parts and regulatory baggage.

This probably became cheaper and simpler to put a camera than a real code bar scanner.

Yeah I think this is the best explanation - I've used "cafeteria cards" before with RFID or NFC, so QR didn't even occur to me.

Confirmed. Most (all?) "2D barcode scanners" are cameras.

It is also way cheaper to get off-the-shelf tablets with camera to embed into systems, then add extra hardware to read just barcodes.

If a random employee could look at the gallery, the coffee machine probably was not locked down

Whoever installed the coffee machine probably just plugged it in and filled it with beans.

Another employee might have changed the settings. I know if I came across an unlocked admin interface, I would fuck with it.

I press all buttons

My former workplace had a Canteen kiosk and the camera in question was a webcam at the top center of the screen. It showed your video during the checkout process.

Bonus item: Canteen had to mail me a check for $30 after losing a class action lawsuit. You could register a fingerprint to access your account with, but we were in Illinois and they did not collect a biometrics waiver during enrollment.

> Why is a camera involved in purchasing coffee with a card?

Many times people who steal credit cards will try to make small purchases to validate cards. Since there is no human interaction someone who has stolen ~10 cards could try each one by buying a $1-2 coffee and seeing which ones work. The machine takes photos which could then be turned over if/when the card holder reports fraud.

So they enter a secure facility with their already vetted credentials and CCTV in operation to try out stolen credit cards? Or they could do those same validation tests at home on a dodgy website.

Do you think using stolen credit cards is a big problem in Amazon warehouses, because what I think is this isn't a bug but a feature to detect who is working and who is slacking.

From parent comment

> uses a camera for people to purchase coffee with a card, she said. But Carroll added that Amazon offers the coffee to employees free of charge and has no practical use for the camera.

I'm not sure why you quoted that because there is a camera in operation and whether Amazon 'has a practical' purpose for it or not is irrelevant here.

Would be like finding a camera in a girls locker room and then saying 'we have no need for that'. Like what the hell is doing there is the real question and I suspect it does have a practical purpose for Amazon.

Amazon didn’t make the coffee machine.

That’s like I saying I approved of my Samsung fridge shitting the bed. No, Samsung did that. I just bought it.

Also, even if a camera is involved in purchasing a coffee with a card, why is there a gallery of these pictures?

Maybe because it's some messy custom Android setup that was put together by an intern in 3 months and it piggybacks on the existing camera functionality.

This is the answer. My work tablets are android based and taking pictures isn't supposed to be part of the workflow, but sometimes by using random button presses, you can accidentially bring up the camera/gallery (its supposed to be locked out, but our IT dept didn't do a good job of totally locking it out).

The easiest way to do it is from the lock screen, if/when it's enabled. My own gallery is full of black pictures taken of the inside of my pocket.

>Why is a camera involved in purchasing coffee with a card? Genuine question.

Check the POS card pads at your local Starbucks, drug store, grocery store, etc. ALL of the new ones have cameras on them now (not just the self-checkout kiosks), and it's reasonable to assume they are snapping pics of everyone to assist with fraud investigations.

Sometimes I carry around little stickers with me and cover the cameras up.

The best solution may be low-tech: duct tape!