Quantcast StorefrontBacktalk » Blog Archive » Amazon’s New PayPhrase Has Definite Shakeup Potential
advertisement
advertisement

Amazon’s New PayPhrase Has Definite Shakeup Potential

Written by Evan Schuman
October 29th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Amazon on Thursday (Oct. 29) introduced Amazon PayPhrase, the first real acceleration of E-Commerce checkout in years, ever since one-click. But PayPhrase does one-click one better. Once set up, it allows shoppers to choose their own short phrase, which is then coupled with a password. After that, PayPhrase allows for purchases right from the product page. Amazon is pushing the very small group of retailers that have agreed to use Checkout By Amazon—including DKNY, Jockey, Patagonia, Buy.com, J&R Electronics and Car Toys—but the beauty of the rollout is that it fundamentally accelerates Amazon direct purchases by removing several key steps.

“Amazon.com customers can use their PayPhrase for express checkout wherever they see the PayPhrase button: on sites across the Web and on Amazon.com. Customers on Amazon.com simply find the item they want, type their PayPhrase into the PayPhrase button on the product’s page and click to instantly preview the total cost of their order, including shipping and tax,” said an Amazon statement. “No need to ‘Add to cart,’ ‘Proceed to checkout,’ sign in or type in credit card information. If the customer is satisfied with their order, they enter their PIN to complete the order.”


advertisement

One Comment | Read Amazon’s New PayPhrase Has Definite Shakeup Potential

  1. Dymo King Says:

    That’s fine for single item purchases, but what if they want to purchase several items from the same store?

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...