Hacker News Reader

Comment by ynniv | Hacker News Reader

It's a cute idea, but a static pattern is trivially defeated by presenting a smartphone that records the touch pattern. Make a smart box that can stamp a dynamic pattern and you'll be on to something.

EDIT: context on why this is important, a comment from the original poster lower on the page:

We already have apps that do retail loyalty, coupons, and micro-payments launched on the platform. We also have developers working on apps to authenticate EMRs (electronic medical records) and industrial systems maintenance. Finally, we won the TechCrunch DisruptSF Hackathon back in September by using the stamp as the authentication step for a webservice actuated door lock

http://news.ycombinator.com/item?id=4811221

View on HN

I was about to say the same thing but there is no point in faking it because it appears that the stamp only tells your phone to pay that specific store, the app then would probably ask you for a confirmation on screen (it could also ask you to enter a pin possibly).

If there's "no point in faking it", why does the page make a big deal about uniqueness and ? In your scenario, a GPS fix serves equally well.

The claim "Like snowflakes, no two SnowShoe Stamps are exactly alike." is wrong. If you stamp my phone, your SnowShow Stamp will have the same exact signature as a carefully carved potato.

in my view: 1-because it is key for each store to have a unique stamp 2- I don' think so,what about stores in the same building or stores very near each other? 3-no two officially produced "snowshoes" though, anyway yes no one would keep you from 3d printing the stamp of another store so that you can have your customers pay that store instead of yours, but I don't see any clear advantage in it, and, as i said before, the app would probably show you the store name before proceeding

Well, it's equivalent to static RFID or QR codes, and seems easier than either. It's neat.

Other ways of doing handshakes with limited hardware: musical chirps, exchanging graphical codes with two front cameras, and ad-hoc wifi.

Indeed, it is equivalent to a static RFID or QR code. Would you secure door locks or physical transactions using a static QR code?

"Scan this to prove you were here, but please don't share it on twitter."

I don't think their security model relies on the pattern being secret.

The worst case scenario is company B steals company A's number. This results in company A getting additional payments.

Or perhaps company C, seeking to ruin the reputation of company A, sets up a fake 'A' storefront with customer service that doesn't shower.

Looking around the site, it uses GPS data to verify that you are in the correct store. Stealing the code would give you nothing, since it won't authenticate unless you're physically in the correct location. It matches the three authentication factors: what you own (the phone and the app), what you know (the code on the stamp), and what you are/do (where you are physically). It's straight up multi-factor authentication from where I'm standing.

a future improvement could have a stamp with a microprocessor and many touch nubs, which "activates" certain touch nubs based on a time-based algorithm. It would work like any other one-time passcode like Google Authenticator.

That was the improvement I imagined as well, but the product presented is not that and shouldn't be described as any more secure than a static QR code.

Reply on news.ycombinator.com