Hacker News Reader

Comment by hendzen | Hacker News Reader

Next time Keurig should hire a cryptographer. GPG signed QR-codes or something similar (vulnerable to replay attack, but harder to circumvent).

View on HN

I don't understand how literally printing the password on the cup would be more effective, unless the coffee maker is internet-connected and each code is revoked after usage.

It harkens back to having to call Microsoft because you've replaced your motherboard except now it's Keurig and even less pleasant because you can't have your coffee while you're on hold.

The machine could add each code to an internal blacklist after each use. It doesn't prevent the same code being used with another machine, but it would prevent coffee vendors from providing boxes of K-cups that are all printed with a single code.

Those vendors could acquire new codes as easily as making a trip to the store. Heck, they could even incentivize customers to snap a photo of an authentic K-cup's code and tweet it to them, maybe for a coupon or imaginary internet points. As long as they had enough codes to make sure any given pallet didn't have any duplicates, they could be 99% certain a customer wouldn't get repeats, especially if they retired codes after a certain number of printings.

I predict that the Keurig 3.0 will be Internet-only. Using an expanded Hyper Text Coffee Pot Control Protocol: http://tools.ietf.org/html/rfc2324 for management. Surely no DRM opponents can complain if they're using standardized protocols.

Using an app on your phone, you'll scan the coffee pod you want to use (your phone takes a picture of you via the front-facing camera as a security measure; much like ATMs have cameras); this connects to the central Coffee Server to generate a one-time passcode. Then your phone does a BREW via HTCPCP to the Keurig, providing an K-Authorization header. Having the encryption key for the one-time passwords be stored on the server avoids the mistakes problems Sony etc. have had where private keys inside devices are compromised.

Requiring a smartphone could present interesting branding opportunities, e.g. co-branding the Keurig 3.0 with iPhone 7, social network integration (click once to post the coffee you're drinking to Facebook), automatic reordering and possibly integration with health services as your coffee drinking data can be shared with your health care provider who can adjust your insurance accordingly.

They could do a Louis Vuitton and make their trademark an integral part of the password design. Or pick a nice QR code and trademark that.

I don't think you could trademark a QR code as it wouldn't be sufficiently distinctive.

morcheeba: looks like your account's been shadowbanned for some reason.

Possibly for good reason: https://news.ycombinator.com/item?id=8170246

Best leave it to the mods.

This doesn't work... Nintendo tried it with the gameboy. The boot rom would extract the nintendo logo from the cartridge and display it on the screen. If it wasn't correct, the game wouldn't run. If it was correct, the theory was that trademark would prevent 3rd party games. But the judge ruled it was being used as a functional access control device and not as a trademark, so 3rd parties could include the nintendo logo in their games.

LV uses pure trademark law; it's not functional. That's why their protection stands.

Next time Keurig should stop engaging in lunacy like DRMed coffee.

Can you (tm) a QR-code?

Things that are printed have copyright. Copying them is not allowed. If the machine has a camera and can recognise the printed material on the cup, then it cannot (legally) be copied.

In order to prevent -replay- refill attacks, the machine has to destroy the cup too after use.

Depressing if my suggestions are true :(

No. Only sufficiently creative works by humans have copyright. Some sort of QR code or barcode could have patent protection but never copyright. Trademark protection would be unlikely for something as generic as a QR code.

Nintendo once made a game system which only accepted floppy disks embossed with the Nintendo logo[1]. Which obviously can be protected by trademark law.

Perhaps they should use the camera to look for some pattern they can copyright.

Of course, for Nintendo I don't think it prevented piracy...

[1] http://www.glitterberri.com/developer-interviews/how-the-fam...

I doubt that a camera would be practical though, the slot for the pod would need to provide illumination and the camera lens would need to be positioned far enough away from the pod so that it could focus on the logo printed on top of it. The camera would need to be of a relatively high resolution, which would be expensive, otherwise competitors could print artwork which is not the trademarked logo but which does fool the machine into recognising it.

> otherwise competitors could print artwork which is not the trademarked logo but..

And by definition imitates with the intent to mislead? Seems that ought be illegal?

Misleading a coffee machine? No...

RFID chips are almost at the point where they would be cost effective for a K-cup. Then the private key could be stored on silicon, where it's much harder to get out. I worked on a medical product with this system.

I feel so bad suggesting this.

Reply on news.ycombinator.com