Evan Schuman's StorefrontBacktalk

The food allergy example is probably the most extreme, because it literally can threaten the life of the consumer. It also is the most difficult retail customization to deliver, because it requires full cooperation from every supplier—something that is virtually impossible. Also, the whole idea of customization puts the burden of delivering on the retailer.Read more...

But instead of trying to shore up the popular but aging SecurID system, there's a better way for RSA to go: It could just publish the hashing algorithms and convert its SecurID users to mobile devices that could be updated on-the-fly at any time. That would eliminate all the advantage gained by the thieves who stole RSA's secrets, while making things more secure for SecurID users.Read more...

The punitive response options from the PCI Council were designed for chains that violate current PCI guidelines, in that those businesses engaged in explicitly forbidden behavior. But the rules have no standard way to deal with new technology. A new payment system, unanticipated by the rules, is neither PCI Approved nor PCI Rejected. It is, frankly, PCI Limbo.Read more...

Sean Bunner, HSN's Operating VP, echoed Kinzey's sentiment. "It's such an early channel to get so granular. There's some overall trend stuff we're more interested in, like 'what category of merchandise are they purchasing?' From what we've seen, mobile is significantly different than Web or, for us, TV," he said. "But even within mobile, between mobile Web and apps. You see pretty significant shifts in categories, so we then have to get into CRM activity to see 'Why is that?' Do you want to merchandise that store differently?"Read more...

The problem isn't near field communications (NFC) itself. Apple could easily stick the hardware into the next iPhone, just as Samsung put an NFC controller and security hardware in its Nexus S Android-based phone. But Apple is worried that there's no industry-standard way for apps to communicate with that hardware, which is also why the Nexus S can't currently behave like a Visa PayWave or MasterCard PayPass card, either. Once Google updates Android to add a software stack that can do payments, the process of hashing out that standard can begin in earnest.Read more...

The move, which hit at least one of the delisted vendors on January 31, is part of PCI's effort to create a proverbial level playing field. There are good and bad sides to this effort. The good is that it's noble in intent. It acknowledges that mobile payments have so many crucial differences from earlier payment methods that merely tweaking today's guidelines won't work. And it also notes that it would be unfair to let vendors that happened to have already been approved be the only applications with the seal of approval, as the door slamming on everyone else. The bad is that it's seeking the perfect at the expense of the good.Read more...

"Using an encrypting reader is not as simple as plugging it in. Very few POS processing systems can handle encrypted data. The vast majority of card data is processed as clear text ASCII. That includes the data read by most VeriFone terminals," said Tom Siegler, VP of Strategic Market Development at UIC USA, another vendor in the payment space. "The reader must be key-injected by a certified vendor with the key for the acquiring processor. This typically costs from $15 to $40. Some vendors want to gate the transaction and charge a fee for the service. This was VeriFone's and MagTek's business model. All encrypted transactions would generate revenue. Nice business, if you can get it."Read more...

Both debuted at this week's South by Southwest Interactive show in Austin, Texas. The Amex trial was with Foursquare, and it let consumers associate their American Express card with Foursquare and then use that check-in service to get automatic discounts through mobile devices. Sounds good and mobile, no? Not at all. Turns out that the program requires consumers to use their rectangular mag-striped plastic for each purchase. In short, both Foursquare and mobile were solely decorative. Amex could have accomplished the same thing by issuing a news release and putting up posters announcing that its card users could get instant rebates at select retailers.Read more...

"If you think about mobility, interesting applications tend to leverage three things: presence; authentication; and location. Presence: Are you there? Are you on the network? Are you live? Can somebody see you? Location: Where are you physically? And to what level of granularity can you see that? Authentication: Are you who you say you are?" Sajor said. "Those are the three crown jewels. You can't do much interesting unless you have those three things locked in to some degree or another."Read more...

VeriFone did this all to attack a much smaller rival called Square, which it repeatedly identified by name. The ironies continue. VeriFone posted a special page for this content, including a domain name referencing its rival, Square: http://www.sq-skim.com/. A key part of that page was a YouTube icon that would play the video. But YouTube quickly took down the video, breaking the link.Read more...

Lack of training, coupled with little or no signage and marketing support, will be the silent killer of many in-store retail mobile efforts. For example, Starbucks' mobile payment scheme remains invisible in some stores, where associates still don't know how to use the scanners that read payment codes off customers' mobile phone screens. And Shopkick is in many retail locations where there's no signage about Shopkick and the associates don't even know what it is.Read more...

Still, are the extreme bandwidth and related demands of streaming video going to end up undermining more strategic network functions, such as selling stuff? Pizza Hut CIO Baron Concors was afraid that it might indeed do that. He still went ahead with video. But he wanted a third party—one that would keep these bandwidth-breaking B-movies far away from his pizza-selling sites—involved. "I was not interested in undertaking the effort to build out a YouTube-like infrastructure, along with the concerns about bandwidth, security and site performance," Concors said.Read more...

Google has reached into users' mobile devices at least once before to delete apps in the name of security. Most users may not mind—certainly not as much as, say, Amazon reaching into their Kindles to delete mistakenly published e-books. But for retailers that want to use an Android device as a point-of-sale unit, the ability of a vendor—or any outsider—to modify the device by long distance could make getting a QSA's approval impossible.Read more...

But the trick is not—in this case—getting people to use this feature. It's getting them to use the mobile device itself for commonplace functions. It's also waiting a year or so to see if this scan convenience exposes security issues, such as the one last year involving Walgreens and chat transcripts. Will those scans be encrypted and protected as aggressively as the older methods? As new methods are tried, extra effort must be applied to anticipate new data breach attack methods.Read more...

Increasingly, retailers are looking at mobile payment systems that do not require their own dedicated infrastructure. Using ubiquitous handheld devices over regular Internet connections, these devices are cheap, easy to maintain and hold great promise for line-busting, inventory management, offsite purchases and a host of applications we haven't even thought of. An example of such a device is the "square" payment system. This small cube-shaped device plugs into any iPhone's audio plug and, with the downloadable software and a square processing account, allows anyone to process credit cards.Read more...

The video of the execution released by the killers showed just a little of the skin of the arm of the executioner. Authorities then matched a "bulging vein" in his hand with that of the suspect in custody. Some question the accuracy of vein patterns in a retail application, but NEC argues authentication that combines a vein scan and a contactless fingerprint scan may prove to be difficult to fool.Read more...

The Inside Secure OpenNFC standard can allow third parties to access NFC capabilities on phones, effectively bypassing mobile-operator-led initiatives such as Isis. Asks Columnist Nick Holland: Is it too late for the Isis consortium to change direction and work in conjunction with existing card networks such as Visa and MasterCard?Read more...

"The carriers know something about you. They authenticate you, and it's reasonably difficult to falsify or spoof that authentication. If you're holding that device, there's a pretty darn good chance that you are who you say you are, as you've authenticated with the mobile network," said Sajor, who was recently promoted to CIO from Chief Technology Officer. "Wouldn't it be interesting, wouldn't it be nice to use that authentication to authenticate you for your mobile experience all the way through the entire mobile payment channel? That would take away the logins and all of that kind of thing. You'd probably want to have some secondary protection: PINs or whatever. But if you could actually use that authentication in a sensible way to seamlessly permeate the entire experience, now you get a much more holistic experience based on what the carrier already knows. The data is already there. We just have to be able to get to it. I don't think we're quite at that point yet." But Pizza Hut's CIO urges caution until the U.S. cleans up mobile standards.Read more...

Their consensus: The First Phone works, but it still has a long way to go. That's what you'd expect from a first try at a mobile POS device, though, and that first draft won't get better without lots of listening on the part of IT. The comments of the Home Depot associates go a long way to point out the challenges mobile POS faces as it rolls out at Home Depot, Nordstrom and other retailers.Read more...

Also, of the few consumers who are in a Wi-Fi-friendly store and are comfortable with the perceived security risks of connecting to a retailer's Wi-Fi and know how to connect and know that connecting to Wi-Fi is even an option, how many will want to take the minute and bother to do so for what are commercials?Read more...

In Russia, the non-intuitive reason is decades of academic focus on science education. That has created a huge number of Russians with high-end science degrees and tons of coding background, Buzek said, the result of which is an employment pool swimming with coders who are perfectly suited to managing an open-source product such as Linux.Read more...

So how closely can a consumer's location be determined? In the AT&T effort, the telco is not using GPS and is limiting itself to cell tower triangulation. Depending on the area, that can range from 200 meters to as much as a three-mile radius. The nature of the alerts are such that they really shouldn't be used when someone is driving or in any other form of transportation (although it would be fun to try in the subway, watching as hundreds of ads appear and disappear).Read more...

Schumer's effort is to push HTTPS for a much higher percentage of sites. HTTP Secure is the easiest way to block most attacks that come via public Wi-Fi. It's not perfect, but it's largely effective. Unfortunately, it's not that simple. For one thing, HTTPS isn't cheap. Encrypting every session for every Web surfer chews up more processor power and fills more bandwidth than plain-vanilla Web connections. Just setting up the coding is non-trivial, and complexities like content from multiple sources make it even more complicated. Good luck getting Amazon.com to convert its entire E-tail operation to HTTPS before the noise from Schumer's news conference has faded to silence.Read more...

In short, what happens when consumers want to be able to read an e-book on their desktop computers at home, on their laptops during the train ride to work, on their tablets while sitting in a client's waiting room and on their smartphones while having a picnic in the park? Do retailers think these consumers will pay for the same e-book four times? Or that song? Mike Sajor, the CIO at apparel chain Ann Taylor, weighed in on this challenge.Read more...

"The mobile experience for our client isn't only our application, our content, our delivery vehicle. It's what everyone else is doing," said Michael Sajor, Chief Technology Officer at Ann Taylor. "When our client walks into a store and has a great experience trying on product, and she selects an outfit and is standing there in the store, picks up her Facebook app and puts a status message about the fantastic experience she just had, that's as much a mobile experience for us as is an application that we field or some video that we might stream." Sajor participated in a StorefrontBacktalk podcast series on retail mobile strategies, along with the CIO of Pizza Hut, the Snr. VP for IT at Home Depot and the Operating VP at HSN. This episode in the podcast series is focused on selecting the best mobile platforms.Read more...