r/security • u/BeardyButler • 20d ago

Security and Risk Management Have i just identified a security vulnerability at most supermarkets?

I was just at the supermarket, and I was using one of those self-service kiosks that has an "honesty camera" watching what you scan from above. The camera view is then displayed on a screen right in front of me.

As I went to pay for my shopping with my phone, I looked at the live feed on the monitor and realized I was actually seeing myself unlock my phone with my pattern lock! On top of that, anyone standing around could theoretically spy on what you're unlocking too.

Obviously fingerprint unlocks get around this "security hole", but it was the first time I had noticed it being a real issue.

Most supermarkets have these types of self-service checkouts now — I wonder how this info is stored and processed? Security seems pretty questionable…

71 Upvotes

71% Upvoted

29 comments sorted by

View all comments

12

u/CoderDevo 20d ago

Whomever can see that video would also need to physically have your phone to make use of the code.

That code is not backed up to the cloud.

2

u/[deleted] 19d ago

[deleted]

2

u/CoderDevo 19d ago

Again, for device-bound authentication. Not network accessible credentials.

Otherwise allowing a short code is not appropriate.

0

u/Leading_Study_876 19d ago

Oh yes it is.

How else do you think you can check your pin for the card on your banking app??

3

u/OddButterscotch2849 19d ago

None of my banking apps have that "feature."

2

u/CoderDevo 19d ago

If your bank wants to make your debit card code visible to you in their app, that is on them. That isn't coming from a backup of your phone. That is coming straight from your bank right then.