Pay By Touch Goes Online

Max Fomitchev writes to tell us that Pay By Touch, the biometric identification service, has announced an online version of their service. While currently the only implementation of this service is in the brick-and-mortar storefront of Star Markets grocery stores, the company hopes that online vendors will start signing up soon.

Comments

Dumbasses.

[wfberg]

They say: "Your finger is unique to you, which means only you can access your financial accounts. The Pay By Touch service helps protect you from physical or identity theft. Because there's nothing to carry, there's nothing to be lost or stolen."

Really?

What about the fingerprint information you're evidently (there's nothing to carry) sending over the wire? No way to intercept that huh? How about the fingerprints you leave on just about everything you touch? No way to lift those off of that surface and to use them on a scanner, in the case of on-line purchases, a scanner that's right there beside you without anyone looking over your shoulder to see you're actually using your own finger and not some copy made out of gummy bears.

Re:Dumbasses.

[Rich0]

Agreed - a biometric authentication needs to run on trusted hardware. I could use one safely to let people into my computer. However, I wouldn't tell my fileserver to serve up my files to any computer that claims I stuck my finger onto their scanner.

The reason is simple - whoever controls the hardware can tell the scanner to report whatever it wants, mount data replay attacks, etc.

Even if the scanner this company is using is ultra-strong and can tell fingers apart from gummy-bears, who is to say I'll even use their scanner. All I need to do is take one apart, figure out how it works, remove any embedded encryption keys, and then create my own "virtual" scanner that reports whatever finger-prints I want it to. As the parent mentioned, there is a ready supply of fingerprints - I might start with my mailman who leaves his on my front porch every day.

And even strong biometric systems have problems (inability to change compromised credentials for one). This system isn't even remotely strong from the start.

Here is an idea for a payment system that would work. Credit card with no mag stripe - just a smart-card interface, a small LCD display, a small PIN entry pad, and a small acoustic modem (possibly an external device that the card can be attached to easily), and a tiny USB interface. Card contains SSL key known to nobody, but the cert is signed by the bank issuing the card (with CRL available). I walk up to a check-out counter, and insert my card, and then remove it. The card displays the transaction amount on the display, and I enter my PIN on the card. I re-insert the card, and the transaction is complete. Transactions are time-stamped and cannot be replayed (unless the transaction is a subscription which would be noted on the display). PINs are entered on the card itself - so no capturing these unless you have a camera overhead. SSL key never leaves the card, so without physical card presence you can't make transactions. Acoustic modem / USB can be used for online or phone transactions - again with full security.

This would resist just about every form of fraud that is common today. Without the card and the PIN you can't make a transaction. Sure, you could steal the card and force somebody to enter a PIN at gunpoint, but this is not a significant source of fraud (and while we're at it we could have a 2nd call-police PIN that still makes transactions appear to work). The only downside is the implementation cost - but I wonder if it wouldn't pay for itself pretty quickly...

Re:Never leave home without it

[Noxal]

Actually, there is a PIN that you have to put in after you scan your finger. They call it a "search number" and recommend that you make it your phone number...crappy, but you can still set it to whatever you want.

Re:Finally!

[JanneM]

Not sure how hard that really is, but I'm sure it can't be too out of the question, specially if some con artists wants to pull it off that badly.

Fingerprints are not hard at all; it's been done, and done well already. You can google for detailed instructions.

Basically, you scan the fingerprint by any means you have (it depends on how and where you could lift it). Print it on transparent OH film, then use it to etch a negative print on circuit board - this just requires standard stuff you can get in any electronics store of course. Use that negative as the mold for a latex positive; in the simplest case, just dab a solid layer of latex on your fingertip and press on the mold until the latex hardens.

The beauty, if that's what you want to call it, is that once you have one scanned print, you can trivially duplicate and send it as a black and white image to anybody, anywhere who wants to use your print.

Fingerprints very seriously suck for identification nowadays.