>They can then produce that bloody item at the POS terminal

given the general attitudes towards privacy and biometric data here on HN, i honestly can't tell if people trying to pay for groceries with bloody severed limbs is a concern you legitimately have or if this is satire.

The cutting off a hand thing might be satire, but the threat of biometric data being replicated and used if its the only measure of authentication isn't. If we have the ability to read and scan palm prints, than the technology to replicate those prints into maybe a faux glove and trick this system isnt that far off i'd assume, right?

Comparing this system to, for instance a chip card reader, the palm print is significantly less secure because it uses a single factor (something you are) versus a chip which requires the customer to both have the card with the chip present for payment, and to know the PIN in order to authenticate. Or your phone for example, if someone steals your fingerprint (or even models your face), they still need to have your physical phone to unlock it. With this palm scanning tech, all you need is the palm and you can pay for anything anywhere because there's no secondary confirmation

Well maybe it's intended to be tongue-in-cheek, like "prepare for the zombie apocalypse, and you prepare for all catastrophic events."

Shirley being responsible for payment wouldn't be the first serious crime that one would have been the victim of if their hand were severed.

Maybe a less dramatic situation than your hand being removed, what if a bad guy figures out the ability to copy your palm print.

> what if a bad guy figures out the ability to copy your palm print

Then you would dispute the charge and have your own geolocation data or the store's video footage to substantiate your claim. This is a grocery store, not a diamond merchant.

The problem isn't this one transaction. Of course you could dispute it, but you're in for a life of disputing charges as you can't tell the merchant to not accept your hand print and use a newly issued one like a card number when it is compromised

The article says that you have to register the palm print vs a credit card. A common-sense approach would suggest that if you cancel the credit card, then registration also lapses.

If you happen to have attracted the attention of this master counterfeiter who has duplicated your palm you would simply have the option of not registering your new card with the system.

If this happens on a large scale, yes, the whole project is doomed.

Again, it's not that this specific issue can't be dealt with by canceling your palm print or convenient checkout. You're just left with not being able to safely register your palm print with any company if your biometric data gets stolen. I can envision a world where it doesn't take a master counterfeiter to 3d printer a palm print that gets through the scanner and a database of stolen palm print data people can buy and trade like they currently do with stolen credit card numbers.

The issue is once your biometric data is compromised you have no recourse to regenerate it. Your solution is you just don't get to participate in these features anymore.

Yes, that's right. But what's the problem?

You're back in the same place you are already. If this putative palm print duplication technology becomes widely available then people will stop building technology that depends on palm prints.

As has been repeatedly pointed out, the risk lies with the merchants and the issuing banks (at least in the U.S.) for credit card payments.

EDIT: and, at least in the U.S. again, no-one is going to be able to force you to use this technology; there will always have to be an alternative mechanism because there are people with no hands, and a system that required them would be a massive ADA liability.

What happens when you register with the next credit card? It's not like your palm print will change.

Don't do that then.

If you find that someone has (somehow) managed to duplicate your palm print then you probably do not want to enroll with that option for payments in the future.

That's great advice for me - a person who's not going to register his palm anyway - but what would be your advice to Amazon for how to deal with this? Or what would be your advice to someone who wants to use their palm with a different credit card once their palmprint has been lifted and used to commit fraud?

Or create a palm reading fortune app that sells for 1.99, and sell the data to amazon to train their AI. Unless that database has been purged of PID, there would be the potential for abuse if it was sold or stolen for getting some free groceries.

You wouldn't be responsible for the payment just like you aren't responsible for the payment with a stolen credit card. I also wouldn't be surprised if these terminals had a pulse detector that would stop a severed hand from working at all.

You'd probably even have an easier time proving your hand was stolen it since your hand is missing.

It's still a problem that if someone compromises your biometric data they'll have full access forever. In practice that isn't a huge problem because it's still really hard to do.

Let's be real.

Changing your name does not change your credit history. Losing an illusory value you have never owned by adopting a new technology, that's not a real problem.

Serious response to your non-serious question:

There are numerous reports of people being locked out of their biometric accounts after an injury. If you burn yourself cooking and have a blister on your hand you may not be able to go buy first aid supplies at Whole Foods afterward. Alternatives are required.

I feel like the crime of hand-cutting is way worse than the crime of using a stolen credit card.

Like, it feels like the worst way to buy groceries.

The cases in Malaysia with the cut off thumbs to start a Mercedes make sense but for groceries the concept is outlandish.

Do you think they're only using this for groceries and that it will never be expanded to other retail? In the article it says they are already in talks with other vendors. This means your hand does more than just buy groceries, it will work anywhere there is a palm scanning terminal. It will work at WalMart or Best Buy to buy thousands of dollars of electronics, or maybe even one day to buy a car. Maybe your phone will even be able to read palm prints, and you can buy and sell private goods, or illegal goods using it. That's a lot more than a bunch of groceries.

If people are willing to go to these extents then the biometrics aspect is just a red herring.

They kidnap your spouse/child/parent and threaten to murder them unless you go through with the transaction. They hold a gun to your head while you transfer the contents of your bitcoin wallet to them. They beat you with a rubber hose until you give them your safe combination.

Maybe you're right. This may make people safer, because they no longer need to threaten your life to get your PIN. They just knock you out and cut off your hand. At least you are still alive that way.

Sure but if you're walking into a store you can use my contactless card. Using my hand is kind of...unnecessary.

At that point, you're just cutting off my hand for the sake of it.

I think the idea is that Amazon is big enough to make palm prints a strong precedent that eventually ends up in things like expensive cars.

An employer of mine used biometrics (palm scan) to control entry. They dropped it and went back to NFC cards and PIN. Never explained why.

Biometrics are immutable! I don't think anybody's going to cut your arm off to steal a television with. However, extremely secure environments certainly avoid biometrics as a "single factor" for this reason.

https://arstechnica.com/information-technology/2014/12/polit...

I think owing $50 for groceries is not what someone is going to be worrying about the most here...