Hacker News Reader

Comment by dpark | Hacker News Reader

So the punch is based on scanning a QR code? Unless I'm misunderstanding, this is really broken. It sounds like someone could write a counterfeit app that scans the QR code, records the current location, and resubmits every minute, recording tons of punches that never actually happened.

They should do it the other way. Your phone should pop up a unque code for the cashier to scan. I guess that makes the barrier to entry higher, though. Maybe change the QR code daily at least (for businesses concerned about fraud, anyway).

View on HN

So the punch is based on scanning a QR code?

That's correct. The business has a card with a QR code printed on it that you scan to get a "punch."

This is part of the value proposition for the merchants, I guess - they don't need a phone or device of their own at all, they just need to print a few things. The tradeoff is maybe the system is easier to game for the tiny percent that is technically inclined enough to try it.

Perka closes that loop hole by having the person behind the counter verify your visit using the app as a merchant.

http://getperka.com/foryourbusiness/merchantfaq.html

My local coffee shop uses a paper card that is scribbled with signatures. It would probably be easy for me to fake it and get free coffee. The security requirements for this are pretty lenient. Of course, this doesn't mean that a more technical replacement such as Punchd shouldn't be secure, I just think it's interesting that security wasn't such a big deal before, but now it is, since there's a technical solution.

Fair enough. It's a low-security solution replacing a different low-security solution.

I guess the difference with the technical security problem is that it scales. If I write an an app that does provides counterfeit punches, I can distribute it easily and nearly for free. Few people would go through the hassle of counterfeiting the cards, but they might install an app.

I guess that if this gains traction and security proves to be a meaningful issue, plugging the hole should be easy enough.

Reply on news.ycombinator.com