Evan Schuman's StorefrontBacktalk

The security exec then asked an annoyingly thought-provoking question: What do you think would happen if retailers were given perfect encryption? Answering his own question (because I certainly wasn't able to do it), he painted a picture of retailers who would use their perfectly-protected data and would confidently let it ride atop the public Internet. At that point, paying for the private security tunnels of a Visa or MasterCard would no longer be essential. Read more...

The primary benefits of virtualization are flexibility and scalability. It allows a company to "pool" computer hardware and create new applications, new servers, new networks, new data storage at the touch of a button and, in the process, reduce costs and administrative overhead.Read more...

Social networking giant Facebook suffered a major privacy glitch this week, where strangers were able to download members’ supposedly private restricted photos.
The Associated Press broke the story this week. “The Associated Press verified the loophole Monday after receiving a tip from a Byron Ng, a Vancouver, Canada computer technician. Ng began looking for security weaknesses last week after Facebook unveiled more ways for 67 million members to restrict access to their personal profiles,” the story reported. “But the added protections weren’t enough to prevent Ng from pulling up the most recent pictures posted by Facebook members and their friends, even if the privacy settings were set to restrict the audience to a select few.”…

The bill had been pushed by Assemblyman Jeff Morris. The final version of the bill—which Morris said he expects Washington Governor Chris Gregoire to sign into law on Tuesday—makes anyone guilty of a Class C felony if they "intentionally scan another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft or for any other illegal purpose." Read more...

In a delicious game of “Now You See It. Now You Don’t,” a security vendor called Rapid7 had proudly told the world that Hannaford was a key customer. But when Hannaford’s breach was announced this week, all references to Hannaford quickly disappeared. And then reappeared. Company officials then stumbled over each other, offering contradictory explanations for it all.

The changing official explanations was deliciously chronicled by NetworkWorld. But the gold medal award for illustrating the actual disappearing acts with wonderfully annotated screen captures goes to the Attrition.org site. If you want ideas on how to not handle a perception crisis, you’ve got to read them both.…

Pay By Touch (officially Solidus Networks Inc. doing business as Pay By Touch) issued a statement on Thursday that it "regretfully announced today that it will no longer process biometric transactions on behalf of its merchant customers and consumer membership base, as 11:59:59pm March 19, 2008."Read more...

For those who contend that PCI's only purpose is to transfer risk from the card brands to the retailers, Taylor writes, "I've worked with a number of retailers on PCI projects over the past few years and, believe me, retailers already own the risk of a breach. It's their brand on the line and they don't need the card brands or their acquiring banks to tell them that." Read more...

"The PCI Security Standards Council is made up of seemingly smart folks from the credit card brands and security industry. Unfortunately, this group of misfits is saddled with a myriad of competitive conflicts of interest and, worst of all, a complete misunderstanding of how to best protect card data and consumer identity," writes Adams. Read more...

The science of reverse cryptography is a fascinating one but this is a rare story that gives some explicit details on how such science is done.

The Computerworld story uses the MiFare chip fiasco as an example and describes the microscope examination, the many in-depth photographs and how researchers sliced off minuscule layers from a 1-millimeter-square shred of silicon. “There are thousands of tiny blocks on the chip — about 10,000 in all — each encoding something such as an AND gate or an OR gate or a flip-flop.” A rare look into how poorly security holds up to a dedicated hacker, whether it’s the good kind or not.…

Shortly after reports surfaced that the Hannaford grocery chain had been PCI compliant at the time of its data breach attack, the Web has been crawling with those questioning the value of PCI, even as the confusing preliminary details of the breach are being sorted out.

As one who has frequently used this column to point out the many flaws within PCI, please allow me to stand up and say to those PCI critics: What planet are you from that tolerates only perfect security systems? Do they conclude from one successful burglary of a house protected by a top-notch burglar alarm and high-security deadbolts that burglar alarms and deadbolts are worthless? Read more.…

During the breach, "no personal information, such as names or addressed, was accessed or obtained" but the breach did expose customer credit and debit card numbers along with their expiration dates, said Hannaford CEO Ronald Hodge.Read more...

You don't address security concerns by pretending they don't exist. You acknowledge that everything is relative and that weaknesses are there but there are advantages, too. Read more...

"Since Bernie ordered me to accompany him on this stupid trip to Philadelphia and we sit here in a five-hour connecting flight delay in Chicago, it's the least I can do to thank him by giving his luggage a much-deserved holiday in Hong Kong," deviously thinks Brad, the junior LAN administrator with far too much time on his hands. Read more...

Some retailers cite the relationship between Enron and Accenture as an example of why they do not use their PCI assessor for remediation services, or purchase security products from their assessor. Read more...

"We need to do a little more training," said Michael Verdesca, the chain's VP for systems development. Read more...

The laptop label that the company, Cybersource, uses is not actually based on the computer's unique identification, as such data can't be easily learned by the clues they drop when surfing. Instead, it's based on the intersection of several routine characteristics, which combined make it fairly likely it's the same machine. Some of the individual details would include the browser version, the exact operating system ID and the time differential on the system's clock ("clock drift"). Read more...

JCPenney and Krogers are the latest U.S. members of the National Retail Federation’s Association for Retail Technology Standards, joining the newest global members of Tesco, Carrefour and IKEA.

The Association for Retail Technology Standards is an international membership organization that, since 1993, has said that it was dedicated to reducing the costs of technology through standards.…

Hello, blog readers! We’ve been approached by a company that wants to create a 3-D environment for StorefrontBacktalk, complete with avatars for all readers. Before we explored this more seriously, we wanted to ask our readers whether we should proceed. Therefore…

…

Near Field Communication (NFC) is running into the exact same kind of tech hurdles that has slowed down RFID, according to a new report from the Venture Development Corp., which cited a lack of supporting infrastructure, standards problems and a “complex ecoysystem of stakeholders.”

VDC “believes that NFC may take root first in niche vertical applications rather than hypervolume consumer applications like contactless payment,” said this RFID Update story.…

The Metro Group’s RFID trial efforts have been well-known, but this is an interesting International Herald-Tribune story discussing some of the privacy debates within Europe on their efforts.

The piece quotes a Metro person as saying that a recent European Union effort to force the tags to be deactivated at POS as the kiss of death for consumer-facing RFID. “If we have to deactivate at the check-out, then the technology is going to stay within the logistics process – to say where is a box or where is the pallet in the distribution center. It won’t come on consumer items. They’re going to kill the technology with that.”…

The potential is absolutely there, with retailers collecting molecular mountains of shopping history—sometimes more than a decade's worth—and law enforcement seeking creative ways to find criminals (or people they think are criminals) who are quite determined about not being found. Read more...

"In today's environment, the card is swiped by a consumer and it's never seen by the cashier," said Joe LaRocca, the NRF VP for loss prevention. "There's no way to see the information on the plastic," he said, and therefore no way to verify identity." Read more...

A pair of companies is pushing an approach where hotel guests could use their electronic room key to also open vending machine snacks, which would then be automatically charged to the guest’s room.

The new approach, from Cstar Technologies and Fastcorp, would theoretically make such purchases easy to order repeatedly, offering revenue and margin that could more than compensate for reductions in “honor bar” purchases. …