Flutterby™! : How come nobody's done a take a 2013-03-01 17:21:09.253359+00

How come nobody's done a take a

2013-03-01 17:21:09.253359+00 by Dan Lyke 9 comments

How come nobody's done a "take a picture of this QR code to pay for your purchase" system yet? We don't need NFC for that. #freebusinessidea

"Of course if "payment processor with integrity" didn't make you break down in hysterics, you've never actually had a credit card..."

If most people have seen the things I have, they would never ever use one. I'm actually impressed that fraud and abuse it as low as it is.

I was recently emailed a spreadsheet with thousands of transaction records and asked to make the system (for a utility) use that data for recurring payment transactions.

Yeah, SSL should take care of most of the MItM attack issues, so that portion could just be PayPal (if they haven't scared everyone off yet), but the malicious QR code issue is a point. You'd still want people to have to acknowledge the purchase, and any payment processor with integrity would want single tokens per transaction with some relatively short lifespan to avoid the "print a 'transfer a whole bunch of money to my account' sticker and plaster it everywhere" problem.

Of course if "payment processor with integrity" didn't make you break down in hysterics, you've never actually had a credit card...

Okay, that solves one end of the security issue. It doesn't solve the other end, where for instance, someone overlays a malicious QR code on a public display somewhere that can drain your account. If the service is entirely browser-based, IMO someone could always sit in the middle and approve the transfer without you noticing. Only an app on the phone end, which would specifically pop up a warning with the transaction details, would sufficiently protect you. Such an app shouldn't be too difficult to write, but it would still need to be there.

Yeah, I see it as a "encode a transaction ID in a URL, send your phone to a URL that serves up a mime-type that launches your payment app" thing. Of course I also just realized that network coverage in my local OSH, where I'd love to use this, kinda sucks.

I think it could be a display on a cash register (or smart phone) that simply displays a QR Code URL to the chosen method of payment for the customer with the total and order number encoded. Like a "click this link" to order an item via PayPal or some other common system. The "service" could just be something that generates these QR Codes for merchants easily, it wouldn't be the ecommerce platform initially, it's be a service to create qrcodes with a merchant ID, amount and transaction number in the URL to existing payment platforms.

I think there are some potential security issues without specialized software on your phone to prevent them from happening. I don't think it can be done solely using a web-based system without having miscellaneous QR codes able to access that same system. NFC has the same issues, but it's more expensive to implement than slapping a sticker with a different QR code on a cash register.

Know anyone doing point-of-sale systems? Seems like that's the critical bridge...