🚀 go-pugleaf

Sylvia Else wrote
> Sunny wrote
>> Sylvia Else<sylvia@not.here.invalid>  wrote
>>> Sunny wrote
>>>> Sylvia Else<sylvia@not.here.invalid>   wrote
>>>>> Aussie Bob wrote

>>>>>> What does everytone think of this idea? Using your mobile to pay for coffee at Starbucks (yecch!)

Fine by me as long as its properly secure.

>>>>>> http://www.smh.com.au/technology/technology-news/starbucks-stop-here-forget-cash-use-your-phone-to-pay-20110120-19x9r.html

>>>>>> "US coffee chain Starbucks has started allowing customers in its US stores to keep their cash and credit cards in 
>>>>>> their wallets and pay for their drinks with mobile phones."

>>>>>> But I don't see how it would work if you're on a cap plan. Say I've got a $400 cap, does that mean I can get $400 
>>>>>> worth of coffee each month instead?

>>>>> I'd have to wonder how secure they've made it. It could be done properly, but it wouldn't surprise me if it were 
>>>>> possible to get coffee at someone else's expense.

Tad unlikely they havent thought of that.

>>>> The machine records the phone number of the mobile, and the bill is forwarded to the phone plan provider

>>> The article implies that a code is read of the screen.

Doesnt matter what it implys, what matters is what actually happens.

>>> The question whether that code is constructed in a way that means that it cannot be faked, nor reused.

Tad unlikely they havent thought of that.

>> There are several Mobile Phone "pay for goods" systems.
>> A popular Japanese one is billed through the phone provider, the
>> Starbucks one seems to be an electronic "store credit card" and
>> would have a unique number, same as a normal store credit card.
>> e.g.  Myers, Woolworth's etc.
>> (problem could occur if you wandered too close to a scanner though
>> :-)

Nope, they have to have some way of matching the bill with the phone.

> The difference is that a store credit card requires a signature.

Hasnt been like that for a long time now.

> What I'm thinking is that one could contrive to record the image displayed on the screen of someone's mobile phone 
> while they're using it to buy coffee, and then duplicate that image on one's own phone, so as to buy coffee from the 
> other person's account.

It doesnt work like that.

> There are ways of preventing that from working, but the question is, have those ways been used.

Tad unlikely they havent thought of that.

> The person tasked with implementing this
> may not have had security high on their mind.

Mindlessly silly.