On the security of credit card signature verification

I just rediscover this very entertaining post about a man's quest to have his signature verified when making a purchase.

So when does anybody look at the signature on the back of your card.
The short answer: Almost never.

Automated systems don't read it.
Humans never look at the paper receipt.
Most waiters only pick up the signed statement after you left the building.

And don't get me started on these "electronic signature" pads at grocery stores:



At first, I (quite naively) expected them to do a fancy AI signature comparison on the fly. That would be logical, since most of the time, the cashier does not even see what you wrote on her own screen.

After a lot of experimentation, I have reverse engineered the complex algorithms in these machines that decide on whether a signature is accepted or not.

It goes something like this:

10 DRAW(Blank_Rectangle, Buttons)
20 WAITFOR(Ok_Button_Pressed)
30 IF (NumPixelOnScreen < 20) THEN
BEEP
GOTO 10
40 ELSE
50 ACCEPT SIGNATURE
60 PROCESS(Transaction)

That's it. So a blank screen or a single dot wont be accepted. A straight line or any drawing that you can come up will.

Again, that's regardless of what is on the back of your card. Even if it says "SEE ID".

Side note: The whole idea behind "SEE ID" is that is would somehow be harder to fake a driver's license than a signature. If that is true, how come all those teenagers are using fake licenses to get alcohol?


So should you or should you not sign your real signature?


Let's run the scenarios:

When you sign your real signature:
- The shop has proof you made the purchase, can hold you liable.


When you don't sign your real signature:
- You gain time, since a quick swipe of the pen to draw a line goes a lot faster.
- The shop can never prove you made the purchase. If the purchase ever gets contested, their "image proof" will be laughed out of court.

I'll let you decide on this one...

American warning labels

Saw the label when packing stuff up:

What do mean I can't pack up my toddlers in these? I want to keep them organized and quiet!

"Faxing for security"

In this weeks episode, the alien tries to get his credit report from Transunion. (For the non US natives out there: You don't exist without a credit report. That high-tech visa may be good enough for DHS, but not for your landlord!)

I went through the entire online sign up process (did I mention that you need to pay to give them information on yourself, so that they can sell that information to others?). As expected, the online system freaked out and insisted that I call customer support to "confirm my identity". So I called the give number and got on the phone with "Michael", (who's accent I would place somewhere in the Southwest... of Bangelore!) who, in a calm and friendly voice, explained what I needed to do.

It went something like this:

- Please send a copy of your drivers license and proof of address to this fax number...
- I don't have a US drivers license. Would a passport work?
- Eh... Okay... We can accept any government issued ID.
- Any government? Or "US government"?
- Eh....
- Never mind. What's this about proof of address?
- We need a "recent utility bill" to prove your address.
- Ok... Right. I have all that online, available right now. Can I just email it to you?
- No! For your security, you need to fax it to our customer support fax!
- (Sigh) All right then....

Let me re-state some of the background issues here:

• Companies trust a "utility provider" as legal proof of residence. That includes the phone company, the water, sewage, cable, .... etc... These are the same guys that can't even get my bills right!
  
• Most of these providers allow you to sign up online, without any validation.
  
• Most of these can be paid and managed completely online, without ever seeing any paper. Which means... there is no address verification!
  
• All of them allow you to view and print your bill online, either from a web page or a PDF. This means that if you can hit the "Edit page" button before printing, you can make up your own address!
  
• For "my security", I need to login, download a PDF, print it, then stick it into the fax. Not only does this process eat a severe chunk of the quality of the documents (making any supposed verification even harder), it also means that I now have a paper copy of the (supposedly sensitive) documents, that I need to get rid of securely.
  

Now I know why Skype has the (banghead) emoticon.

I'm really hot on Myspace!

Just look at my "friend request" page....



If I am being stalked by hordes of sexy looking girls, I must be doing something right, right? Right? And they happen to all have their own webcam service!

But I wonder why they don't ever want to give me their phone number? :(


</SARCASM>

It seems like profile spammers are getting more and more desperate every day. Other food for thought: On myspace, I receive dozens of spam requests every week. On facebook, I have received... zero! Is the facebook system so much more resilient to spam? Or is their demographic much less gullible?

ObiJan Bio Page

I haven't risen (steeped) to the vanity level of blasting people with "About Me" pages (yet), but the geek in me wanted to play with the (now extinct) Google Social API. The OCD-based organizer inside me agreed that it would be neat to have a central page to list all my various "profiles". Even the slob in me liked that, because he keeps forgetting all those links themselves. The other voices in my head were talking about things involving cheesewire and an electric bushcutter, but I kept them sedated.

So here goes...
"About me" on various sites:

• Google Profile


• Twitter


• Facebook


• LinkedIn : In case somebody has a great job offer :)


• Plaxo : Part address book organizer, would-be social network


• Flickr : Not really my favorite photo sharing site

You may find my main "real" experimental site at ObiJan.com

2014 Update: Removed all the extinct links. 

2022 Update: Killed all more extinct links.