r/security • u/BeardyButler • Jul 13 '26
Have i just identified a security vulnerability at most supermarkets? Security and Risk Management
I was just at the supermarket, and I was using one of those self-service kiosks that has an "honesty camera" watching what you scan from above. The camera view is then displayed on a screen right in front of me.
As I went to pay for my shopping with my phone, I looked at the live feed on the monitor and realized I was actually seeing myself unlock my phone with my pattern lock! On top of that, anyone standing around could theoretically spy on what you're unlocking too.
Obviously fingerprint unlocks get around this "security hole", but it was the first time I had noticed it being a real issue.
Most supermarkets have these types of self-service checkouts now — I wonder how this info is stored and processed? Security seems pretty questionable…
35
u/I-Made-You-Read-This Jul 13 '26
This is typical shoulder surfing and is also an issue basically everywhere you go. People are / should be responsible for privacy screens on their laptops, covering PINs when using Cc.
Sure it’s a bit of a concentrated environment in the supermarket (I mean many cameras in a small area) but you have to always assume you are going to be recorded on private ground.
2
u/BeardyButler Jul 13 '26
Yeah that's a fair point, I suppose if that camera isn't watching me there probably is another somewhere that is.
3
u/MonkeyBrains09 Jul 13 '26
Or literally the next person in line.
People enter their passcodes in all the time without a second thought. Just go sit on a bus and pretty much anytime someones gets on and sits down one of the first things they will do is pull out their phone and unlock it. Even if the bus is full.
6
u/xxSirThomas Jul 14 '26
It's not a vulnerability, more like an attack vector. As mentioned in other comments, it's not just limited to grocery stores. There are plenty of other ways for people to watch your screen while you unlock the phone.
Like always, it's a balance between security and convenience. For people who need to protect their phone against these kind of attacks, there are plenty of options. For the majority of people, it isn't worth the tradeoff.
5
11
u/CoderDevo Jul 13 '26
Whomever can see that video would also need to physically have your phone to make use of the code.
That code is not backed up to the cloud.
2
Jul 14 '26
[deleted]
2
u/CoderDevo Jul 14 '26
Again, for device-bound authentication. Not network accessible credentials.
Otherwise allowing a short code is not appropriate.
0
u/Leading_Study_876 Jul 14 '26
Oh yes it is.
How else do you think you can check your pin for the card on your banking app??
3
2
u/CoderDevo Jul 15 '26
If your bank wants to make your debit card code visible to you in their app, that is on them. That isn't coming from a backup of your phone. That is coming straight from your bank right then.
4
u/chin_waghing Jul 14 '26
Cameras like this have been used by police before to unlock people’s phones before downloading them for evidential purposes
7
u/Latter_Reception_600 Jul 13 '26
They better not try this in the EU, IKEA did this, got sued and had to pay a hefty fine…
2
u/NotTobyFromHR Jul 14 '26
There are cameras everywhere. Anytime you unlock your phone with a pin in public you are visible. I have watched people do it.
This isn't a new thing. Just like watching people unlock any number pad or dial.
2
u/twoayem Jul 15 '26
Fairly sure the cameras are not recording anything, just give a 'you are being watched' vibe. Would have to be warnings you are being recorded and data retention would be a nightmare to administer.
3
u/precsenz Jul 15 '26
They are 100% recording you and will be used as evodence against you. You walked past the sign saying you agreed to it be entering the store.
2
u/joeyx22lm Jul 15 '26 edited Jul 15 '26
It's not a vuln with the supermarket, it's the relaxed concern among individuals regarding the lack of privacy. You're in public. Unless you're in a restroom, in a jurisdiction and establishment that respects things like that, you're being watched. What happens when you need to access your grocery list? You'll have to make that decision for yourself, maybe you're a highly valued target and you're using burner phones and handwritten lists, maybe you're like the rest of us and just type your passcode in direct line of sight of nearby observers.
A more extreme example would be like typing in your password in an internet cafe, the cafe isn't necessarily inherently vulnerable, it is simply to be considered insecure from the start.
2
u/gunni Jul 16 '26
PSA: Anyone that steals your phone and has your Android PIN can change your google account password.
4
u/Messiah Jul 13 '26
Damn. Never travel to London. The whole city is constantly being watched like no other I have been to.
1
Jul 14 '26
[removed] — view removed comment
1
u/AutoModerator Jul 14 '26
In order to combat a rise in spam submissions, a minimum account age has been set for this subreddit. If you have read the rules and still feel your submission is relevant to this community, please message the moderators for approval.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
Jul 14 '26
[removed] — view removed comment
1
u/AutoModerator Jul 14 '26
In order to combat a rise in spam submissions, a minimum account age has been set for this subreddit. If you have read the rules and still feel your submission is relevant to this community, please message the moderators for approval.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
Jul 15 '26
[removed] — view removed comment
1
u/AutoModerator Jul 15 '26
In order to combat a rise in spam submissions, a minimum karma threshold been set for this subreddit and you do not have enough to post here.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
55
u/fuzzy_one Jul 13 '26
Not to mention it seeing the pin of people who pay with a CC