Printed from www.pcpro.co.uk
Amazon lets shoppers pay with a phrase
Posted on 29 Oct 2009 at 16:31
Amazon has launched a new online payment service that lets users pay for goods on the internet simply by entering a phrase and a PIN number.
Dubbed PayPhrase, the service lets you link a two-word phrase and a four-digit PIN number to the credit card and shipping details already stored on your Amazon account. Users can create their own phrase or use the one provided by Amazon.
Each PayPhrase is unique, and can vary in length from only four to 100 characters.
PayPhrases can be used to buy goods on Amazon and a rather thin selection of other US retailers. The system is not yet available in the UK.
There's a concern that people usually use very dumb phrases
The system will naturally raise security concerns, especially as Amazon is encouraging parents to supply their children with PayPhrases and PINs, which are given a set spending allowance each month.
Amazon is also encouraging customers to create different PayPhrases for different shipping addresses, further increasing the temptation to write those key phrases and PIN numbers down somewhere.
Security experts believe there are other dangers to the system. "There's a concern that people usually use very dumb phrases [for passwords], often dictionary words that people can guess," says Graham Cluley, senior technology consultant at Sophos.
He's also worried that people will use the same PIN number for their PayPhrase as they do on their bank cards, making them a prime target for phishing attacks. "Numbers are even harder to remember than words," he cautions.
Amazon insists the system will make online shopping easier. "PayPhrase solves the headache of trying to keep track of all the different usernames and passwords people use to shop on various sites across the web," says Amazon's PayPhrase general manager Matt Williams, who bizarrely reveals that his own PayPhrase is "Good to Go" in the Amazon press release.
"With PayPhrase all you need is one phrase and one PIN to pay online,” he adds.
Now all you've got to do is guess his PIN then...
Author: Barry Collins
I like the idea
With up to 100 characters this has the potential to be a secure system, If the password was entered via a touch-screen PC not even a key logger virus could capture it.
By Tibbs on 30 Oct 2009 
@Tibbs,
Unfortunately, I don't think using a touch-screen PC would help prevent a key-logger from detecting the phrase, as the user would probably be using the standard Windows 'onscreen keyboard'.
I have not looked into it, but I suspect that a good keylogger would detect the events triggered by the onscreen keyboard and log them. Failing that, it will just breed a whole load of new keyloggers.
eg. popping up an identical-looking onscreen keyboard which sits over the default Windows one. When the user pushes a key, the key is logged, and then the SendKeys API is used to transfer the key to the legitimate text box.
Unfortunately, until we move to one-time-keys for such things (like the paypal dongles and RSA securID things, I don't think anything like this will help protect against malware.
By GlasgowGuy on 30 Oct 2009
advertisement
- ATI Radeon HD 5970: 42% more expensive in the UK
- Office 2010 Beta – 32-bit or 64-bit – The Choice is Clear
- Why Britain's watchdogs have fewer teeth than goldfish
- Tabbed documents: how to make Office 2010 great
- Outlook 2010 People Pane – does it spell death to Xobni
- Microsoft Outlook 2010 screenshots
- Co-Authoring in Word 2010 and SharePoint Foundation 2010
- Microsoft Outlook 2010 screenshots: Backstage view
- Flash 10.1: Developing for Desktop and Device
- Microsoft Office 2010 screenshots: Recover unsaved items
- Avira Premium Security Suite 9
- ZoneAlarm Internet Security Suite
- Webroot Internet Security Essentials
- Trend Micro Internet Security
- PC Tools Internet Security 2009
- Panda Internet Security 2009
- Norton Internet Security 2009
- Kaspersky Internet Security 2009
- F-Secure Internet Security 2009
- Eset Smart Security
- BitDefender Total Security 2009
advertisement
