Beware of Android Market - especially with your kids

[billythewiz]

Blastuk, you might still be safe. It depends on which version on the Android Market app you are running.

If it's an old version, (especially if it doesn't give you the option to use a PIN), I'd advise you upgrade.

Instructions are here http://support.google.com/androidmar...&answer=190860

or in the original post.

[mikerr]

This device is the only instance in my entire life that I can think of, where verification is only ever required once (in this case in October) and that is accepted forever more without any further re-verification.

I dont see your point there single verification, and then variable amounts happens a lot:

E.g direct debits
Subscriptions
Ebay
Paypal (many sites like 123reg authorise forever on first payment )
And of course google checkout.

[billythewiz]

I dont see your point there single verification, and then variable amounts happens a lot:

Paypal/ebay always requires re-entry of a password for each individual purchase. At least they do for me.

Same with 123reg. They email me and I have to confirm that I wish to renew (and pay for) my domains. In fact 123reg has one of the strongest password requirements of any site I use (mixed case and numbers are required).

The other examples, DDs, subscriptions are re-current purchases of the same product. Direct Debits also have a very strong, legal guarantee (to protect consumers), that is operated by the financial ombudsman.

It's true that many sites retain credit card details (for convenience with future purchases), amazon and play.com are two obvious ones that I use, but ALL sites require a password before a purchase can be made. Amazon for example keeps me "logged in", so my wish list, etc. are always available without having to log in. But I HAVE to supply my password, every time I wish to make a purchase.

The old version of Google Market along with Google Checkout allowed repeated purchases, with different retailers, for different products without having to provide any proof (i.e. a PIN) that I am the authorised card holder.

[billythewiz]

So there is a happy ending. Today I received a refund for my "smurfberries".

Hello Mrs-qwerty,

We understand that it must be frustrating to see a charge you did not expect. We have refunded your purchase as a one time courtesy. To prevent issues like this from occurring in the future, we recommend locking purchases on your device.

In the most recent versions of the Android Market(Version 3.3.11 or above) you can set a password for your device which will be required to be entered before any purchases can be made on your device. This includes in-app purchases.

The following are the steps required to lock your purchases:
1) From your home screen select the Market.
2) Select the menu button on your device and then select settings.
3) Scroll down to "User controls" and select "Set or change PIN"
4) Insert a PIN number that you will remember and press OK. Once you have created a PIN more options should be highlighted.
5) Still under the "User controls" heading, ensure that the "Use PIN for purchases" check mark is green. This means your lock is enabled. To disable this feature, simply uncheck the "Use PIN for purchases" check box.

We appreciate your interest and support of Smurfs Village. Thank you,

Darren
Beeline Interactive Support

Thanks Darren.

[[GSV]Trig]

Have you upgraded the device as per my post?
I'm still wondering if this has been fixed with either the motorola update or other updates that might be in place since the device was RTM.
Granted I'm not running stock ROM on mine so the issue doesnt effect me but would be interested to know if this is more motorola's than googles fault, both could probably fall back and blame you, you've done well to get a refund from the guys at beeline tbh, certainly not a fault of them but they seem to have picked up where the other two fell...

[peterb]

I've reported this post - i dont see how it is helping the original poster.
As far as i'm concerned the guy isnt making a complaint, he is (very helpfully) warning other people who might be at risk of repeating his mistake.

I think that people need to either show a little gratitude, or else some restraint.

Thank you. For the benefit of the protagonist, I repeat my earlier post - I didn't think it was that difficult to follow...

<admin mode>Keep it civil please, it is an important subject, don't let it descend into personal point scoring... </admin mode>

That said, I'm delighted billythewhizz has received a refund, and I would repeat a general warning that with the integration of applications, it us even more important to monitor exactly what you data is being used for.

[scaryjim]

... The old version of Google Market along with Google Checkout allowed repeated purchases, with different retailers, for different products without having to provide any proof (i.e. a PIN) that I am the authorised card holder. ...

Of course, technically you have provided your password, as your google account is authenticated on the device, and the assumption is that a person using your device is you.</devil's-advocate>

Not a great assumption of course, and it's good to know that the market has been updated to allow purchases to be locked, but I can see google's point of view. I also think you're always going to be taking a risk allowing any young child play games on an authenticated device like an Android tablet. After all, there are dedicated gaming devices available *much* cheaper than a Xoom that wouldn't have the same issues...

... you've done well to get a refund from the guys at beeline tbh, certainly not a fault of them but they seem to have picked up where the other two fell...

I've noticed that there's been a few stories around recently on these "problems", and in most instances the devs / publishers have responded very reasonably - the good will (or rather, lack of bad will) being much more valuable to them than a single in-game transaction. I think these smaller companies probably understand the power of the internet a lot better than google - rather ironically - and would prefer to keep negative press down to an absolute minimum.

[mikerr]

This device is the only instance in my entire life that I can think of, where verification is only ever required once (in this case in October) and that is accepted forever more without any further re-verification.

Paypal/ebay always requires re-entry of a password for each individual purchase. At least they do for me.

I was disagreeing with your "one time verification", not per purchase.

(variable) Ebay fees come out of paypal every month without any extra verrification,

Same with 123reg. They email me and I have to confirm that I wish to renew (and pay for) my domains. In fact 123reg has one of the strongest password requirements of any site I use (mixed case and numbers are required).

123-reg send me an email, then take the money anyway without any password entry.
Granted I've authorized them at one time in the distant past, and happy for them to do so, but just making the point its not uncommon.

Check your preapproved companies in your paypal account:

profile->my money->My pre-approved payments->Update

You might be surprised how many are in there.

The old version of Google Market along with Google Checkout allowed repeated purchases, with different retailers, for different products without having to provide any proof (i.e. a PIN) that I am the authorised card holder.

You used to have a generous 24 hours to refund, but now its a (too low) 15 minutes it is much more of an issue.
There are various PIN protector apps though for older marketplace versions, removing cc details also means it will prompt for every purchase on old versions.

[billythewiz]

Have you upgraded the device as per my post?

Hi Trig,

I don't remember the exact sequence of events, but I'm pretty sure the first time I looked at the "About Tablet" it was showing Android 3.2. Whether it came with that or had upgraded itself in the few hours since I first switched it on, I do not know. I did a "system update" and it downloaded something very small (it took a few seconds).

5 days later my kids bought the smufberries with v1.0.27 of Android Market. I upgraded that manually by downloading the APK.

[billythewiz]

I was disagreeing with your "one time verification", not per purchase.

Hi Mikerr,

for the sake of argument, I'll agree with your points. It seems to me that the key difference between your examples and what happened to me with Android Market is that your examples are re-current business with a company that you are continuing to do business with (very much like a subscription).

My Market experience was the very first interaction "I" (well actually my kids) had with those companies.

I did think of an example that it was very similar to. Amazon's "one click purchase". I've never actually used that (I think it's an insane idea), but I imagine that it still requires a password once per session and once logged on, a single click buys the product (like Market did for my kids).

This evening I watched a recorded copy of Iceage 3 with my kids. It was recorded after 9pm and so I had to enter a PIN. Interesting that a PIN is needed for that and yet not for access to my credit card. That kind of puts it into perspective for me.

[mikerr]

It seems to me that the key difference between your examples and what happened to me with Android Market is that your examples are re-current business with a company that you are continuing to do business with (very much like a subscription).

My Market experience was the very first interaction "I" (well actually my kids) had with those companies.

I agree its bad not requiring authorisation per sale, I just disagree with the way you're separating your interaction with the device and the google account tied to it.

You may have never entered credit card details on the device, but you did tie your google account to the device, and at some point enter details into your google account.

BTW exactly the same scenario happens on Amazon Kindles - pick up your kindle and buy books without any further authorisation needed. (users have pre-authorised when buyng the kindle - no details ever entered on the kindle device).
Kids don't play on kindles, so its less dangerous...