Vietnamese Bank Issues Fingerprint-Enabled Debit Cards

Great by Antipater · 2012-08-07 04:17 · Score: 5, Funny

Now I can't even eat cheetos anymore without giving away my bank pin!

--
Everything is better with chainsaws.

Re:Great by ColdWetDog · 2012-08-07 04:23 · Score: 4, Interesting

So now, instead of just having to worry about your card getting lifted they will also want to chop off your fingers?
No need for the violence. You don't even need to have the victim in the room.
(Do not attempt. Professional Driver on a Closed Course. Do Not Try This at Home. Your Mileage May Vary. Do Not Taunt Happy Fun Ball.)

--
Faster! Faster! Faster would be better!
Re:Great by TheCarp · 2012-08-07 05:00 · Score: 2

A few assumptions there, not the least of which is intelligent criminals.
That said, I think both this and the original post miss the point. I doubg jacking people's fingers for card robberies is going to happen. It requires the criminal to not only be willing to steal a card and info, but, to actually harm someone who is complying with them.... less people will be willing, especially isnce it will be a more heinous crime if they are caught.
What this really does, and I think will do well, is put a stop to wholesale theft. This doesn't foil the guy who robs you at gun point, he will ALWAYS get what he wants (even if it means you personally withdrawing the cash, and keeping your finger).
who it foils is the guy who disguises a card reader and camera to steal your stripe info and pin. Now get can get the mag stripe but the pin is your fingerprint. Can he recreate it from video? Maybe, sometimes. It wont be as fast, or easy.,..and will require him to retool to do it... it probably kills his business.
I doubt it totally kills the fraud and theft...but raises the bar on bulk theft.

--
"I opened my eyes, and everything went dark again"
Re:Great by Anonymous Coward · 2012-08-07 05:04 · Score: 0

If he can hide a card reader then he can have a duplicate fingerprint reader.
Re:Great by dark12222000 · 2012-08-07 05:57 · Score: 1

Fingerprint readers are a lot more expensive then a card reader. It's also trivial to install a second magstripe in an existing card reader, but it's a lot harder to mess with a fingerprint reader. Fingerprints aren't perfect (and fingerprint readers can certainly be broken), but they are a big step up from 4 or 6 numbers.
Re:Great by TheCarp · 2012-08-07 05:58 · Score: 1

Thats a really good point, I hadn't thought of that. Perhaps the card needs the card reader? Smart card, with built in finger print reader, and using a challenge/response authentication, so that a sniffer in the middle can't just grab static data and reuse it?
Huge increase in complexity and cost, but, I don't know if there is a way around it for this problem set.
Well... at least in terms of shutting it down. In terms of keeping them away from your bank, it probably works very well. Why would you produce such a device if only one or two banks even use it?
Of course, that means its like the old platform/virus debate. "I use X platform because there are no viruses, or very few". "There are very few viruses for X platform because so few people use it, if more people thought like you, then the virus writters would change targets, because it would become worth it to do".

--
"I opened my eyes, and everything went dark again"
Re:Great by mcgrew · 2012-08-07 06:24 · Score: 1

A few assumptions there, not the least of which is intelligent criminals.
Since nine out of ten crimes go unsolved, I'd say 90% of the criminals are smarter than the cops.
What this really does, and I think will do well, is put a stop to wholesale theft.
Unless the technology has improved greatly in the last few years, it can be defeated with a gummy bear. IMO the best tech, from a consumer point of view (not from a bank, obviously) is the old fashioned paper and carbon with a signature. They have the added advantage of working when there's no electricity; a few stores were open after the tornados here and you can still use that tech (my then-girlfriend needed cat food, the pet store took her card after digging out an old reader).
Of course, again, this will slow down the process and the banks won't earn as much money, so don't count on going back to that old tech.

--
Free Martian Whores!
Re:Great by TheCarp · 2012-08-07 07:13 · Score: 1

I think the other poster who pointed out that finger print readers wouldn't be hard to add, if they are already doing hidden cameras and card readers, really hit the nail on the head.
Gummy bears are fine, but realise, the "gummy bear" trick is still a lot more effort than watching a video and seeing what numbers someone hit. I would bet you could review 10s of videos in the time it would take to produce 1 good fingerprint from any of these methods.
I don't mean it will never happen. Everything will happen. Somebody WILL use a gummy bear to copy a finger print.
The thing is.... the few people doing that, whether they get caught or not, probably are not an issue. They are putting effort into single robberies. They suck, and stopping/catching them would be great but... they don't effect nearly as many people or as much money overall as a systematic skimmer.
Who cares about the one off, who maybe hits one a day or every few days, when there are people skimming 10s or 100s in a day, every day?
Or to put it another way from an old systems security discussion we had at an old job. "If we have a knowledgable attacker going after us personally, we already have bigger issues than we can deal with or prepare for in this discussion".
That is... one guy, who puts effort into a target and wants to steal from that target, he is going to find a way. Maybe he uses gummies, maybe he enlists an unknown to take it by force, maybe he does any number of things. He chooses the time, the place, the action.
However, you CAN much more easily take steps to protect yourself from the "script kiddies", or anyone who just casts a wide net and trolls for hits.... and given how the numbers work, that tends to be a good starting point....because its unlikely that any individual gets the attention of a determined, intelligent attacker.... but nearly everyone ends up running into some manner of wide net phishing attempt.

--
"I opened my eyes, and everything went dark again"
Re:Great by mrmeval · 2012-08-07 10:03 · Score: 1

Yes as I've said before and I'll say again the hard part about biometrics is keeping the body parts alive.

--
I'd go on a Vegan diet but the delivery time from Vega is too long. --brownkitty
Re:Great by AmiMoJo · 2012-08-07 10:09 · Score: 1

Don't worry, the card will be covered in your prints anyway. They are not hard to lift and clone.
Years ago I had a work laptop where they insisted I used the fingerprint reader. Then I cut my finger and was forced to go back to a password. It would suck if I couldn't access my money.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC

Great by NettiWelho · 2012-08-07 04:20 · Score: 4, Insightful

So now, instead of just having to worry about your card getting lifted they will also want to chop off your fingers?

Biometrics are not secrets by dido · 2012-08-07 04:22 · Score: 4, Informative

I do hope that they back it up with a PIN, making it full three-factor authentication. While biometrics are useful in being unique identifiers, they are not secrets. An attacker could use the gummi bear fingerprint technique using latent fingerprints extracted from a stolen card...

--
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.

Re:Biometrics are not secrets by jdastrup · 2012-08-07 04:27 · Score: 1

Your're missing the point. The bank has more customers and is holding more of their customers money. Regardless of how more or less secure it is, the bank's decision is working. If it required a PIN and a fingerprint, the bank may have lost customers, but I could be wrong, don't know, market research may have already figured it out.
Re:Biometrics are not secrets by fahrbot-bot · 2012-08-07 04:33 · Score: 5, Interesting
I do hope that they back it up with a PIN, making it full three-factor authentication. While biometrics are useful in being unique identifiers, they are not secrets. An attacker could use the gummi bear fingerprint technique using latent fingerprints extracted from a stolen card...
In addition, The Mythbusters also fooled fingerprint scanners using the same techniques as the Schneier link (above), and also with a photocopy of a fingerprint:
- A 3-D thumbprint imprinted on a latex strip to be worn over someone else's thumb.
- A 3-D thumbprint imprinted on ballistics gel, which has the same viscosity and density as human tissue.
- A photocopy of a scanned image of Grant's thumbprint.
--
It must have been something you assimilated. . . .
Re:Biometrics are not secrets by fuzzyfuzzyfungus · 2012-08-07 05:03 · Score: 1

So long as liability follows responsibility... Taking calculated risks, like offering unsecured or partially/illiquidly secured loans, or going with lousy-but-convenient UX choices, is one of the things that banks do because they turn out to be profitable if you do them right. As long as they accept the downsides of that, like the occasional default or account breach, that isn't a problem and might well be a virtue.
If, however, they manage to insulate themselves from those consequences, whether by wholesale regulatory capture or routine customer service brush-offs of the suckers whose cards were skimmed and cleaned out, the rot begins.
Re:Biometrics are not secrets by TheLink · 2012-08-07 07:13 · Score: 1

The banks are just shifting more and more risks and responsibilities for losses to their customers.

They prefer to call stuff ID Theft rather than some sort of fraud. Since with ID Theft it's their customer's problem, whereas with fraud it might be their problem.

They also prefer debit cards. With credit cards, when "stuff happens", it's not my money that's gone, it's someone else's. They may try to get the money from me, but meanwhile I have my money. Whereas with debit cards, when "stuff happens" it's my money that's gone. In theory I might legally be entitled to get it back, but meanwhile I have lost my money.
--
- Too many replies beneath your current threshold
Re:Biometrics are not secrets by climb_no_fear · 2012-08-07 07:23 · Score: 2

The fingerprint reader at my local video store failed miserably and they had to give me a regular PIN. I do rock climb a lot in the summer and my fingerprints sort of wear off. What about people like me? Can't you bank there?

It's like writing the PIN on the card by Anonymous Coward · 2012-08-07 04:23 · Score: 1

Considering most people don't handle their debit cards with gloves, that means your fingerprints are all over it. It's like you wrote your PIN on the card, front and back.

Why "instead of"? by Picass0 · 2012-08-07 04:23 · Score: 4, Insightful

The use of a fingerprint and a pin together would raise the security further still. Many institutions are switching to two forms of authentication, which is why you're seeing more security questions. A fingerprint is a second authentication that an account holder doesn't need to remember.

Time to invest in Jello? by Anonymous Coward · 2012-08-07 04:27 · Score: 0

And expect The Department of Fatherland Security here in the US to start monitoring sales of Jell-O, Knox-Blox, and all the other gelatin products from store shelves.

http://cryptome.org/gummy.htm

Triple? and also - selection bias by thePowerOfGrayskull · 2012-08-07 04:29 · Score: 1

Not only has Mekong’s account base tripled through the use of fingerprint technology since its launch in June,

Without any actual numbers (say, for example, the number of accounts they had before introducing this), this is fairly meaningless. If you have 3 customers it's easy to triple them; if you have 3 million, not so easy.

but the deposit balance per debit card account is two times higher than a regular account.

This seems completely irrelevant; in the very best case it sounds like selection bias. The people using this technology will be more like to be tech enthusiasts. While I don't know the demographics of Vietnam, I know that in the States that kind of audience will typically have higher income levels.

But even that's a tenuous guess - my point was that the phrasing of the statement strongly implies that deposit balances are directly connected to card type (fingerprint vs pin); but there's nothing in TFA that supports that.

Re:Triple? and also - selection bias by MozeeToby · 2012-08-07 04:58 · Score: 1

This seems completely irrelevant; in the very best case it sounds like selection bias. The people using this technology will be more like to be tech enthusiasts. While I don't know the demographics of Vietnam, I know that in the States that kind of audience will typically have higher income levels.
But even that's a tenuous guess - my point was that the phrasing of the statement strongly implies that deposit balances are directly connected to card type (fingerprint vs pin); but there's nothing in TFA that supports that.
That is exactly what the point of the statement was. Banks want to have people with large accounts, implementing the print scanners on the cards increased the number of large accounts they have, therefore increasing the bank's profitability. It's probably taken directly out of a press release full of self-praise for what a great decision it was, which explains why the intent of the statement got so muddled.
Re:Triple? and also - selection bias by mkkohls · 2012-08-07 05:30 · Score: 1

That is exactly what the point of the statement was. Banks want to have people with large accounts, implementing the print scanners on the cards increased the number of large accounts they have, therefore increasing the bank's profitability. It's probably taken directly out of a press release full of self-praise for what a great decision it was, which explains why the intent of the statement got so muddled.
Exactly the point was to say that the decision was good for the bank. I've used fingerprint scanners in the past, and I have to wonder if the higher balances are from people not being able to take their money out versus actually having wealthier customers given how finkiky these scanners can be.

Why not just get rid of the card? by DeTech · 2012-08-07 04:31 · Score: 2

Finger prints and a pin should be enough to locate your account number. Not having a card to lose wold be an awesome side effect.

Re:Why not just get rid of the card? by canadiannomad · 2012-08-07 04:52 · Score: 1

Yeah, get rid of the card, use the fingerprint(s) to identify the account, change the keypad to read the fingerprints as you type, use a pin, and record the exact way that the pin is entered. As always you wouldn't have perfect security, but you could probably get a % accuracy that could be adjusted on a per user basis. Also you could weed out systems trying to game the system by honey potting them and checking for patterns that indicate automatic entry.

--
Hmm, the humour and sarcasm seem to have been be lost on you.
Re:Why not just get rid of the card? by Anonymous Coward · 2012-08-07 04:59 · Score: 1

This wouldn't work for the same reason magstripe cards are bad: replay attacks. Someone just needs to design a fingerprint skimmer keypad that would save your fingerprints and your pin and you would be screwed. Additionally, changing your fingerprints is not nearly as practical as getting a new bank card.
Re:Why not just get rid of the card? by canadiannomad · 2012-08-07 05:26 · Score: 1

Mostly agree, except that you can actually watch the hand, replays could be detected as replays. More advanced systems could of course be created to mimic the angles, pression, velocity, torque, etc in a human way that mimics the original without exactly repeating itself, but then they still have to know the pin, change the pin, and all other factors change. Still I agree that is is vulnerable to someone with enough resources and the same access to the the person/machine that they require now to get access to the pin in the first place. In reality "chip" technology with a pin is probably much better.

--
Hmm, the humour and sarcasm seem to have been be lost on you.
Re:Why not just get rid of the card? by Idbar · 2012-08-07 12:08 · Score: 1

What about putting for of your fingers in certain order, creating a fingerprint pin. :-)

Point / Counterpoint. by localman57 · 2012-08-07 04:45 · Score: 2

On the one hand, they may well have implemented 3 factor security. That's pretty cool. But on the other hand, you have to put your money in a fucking Vietnamese bank to get it. From Reuters in May of this year:

Last November, State Bank of Vietnam Governor Nguyen Van Binh said eight small banks were "unhealthy" while in January he said 10 percent of the country's nearly 50 banks were "ailing."

Apparently they have a deposit insurance program, but it's limited to about $3,000.

Re:Point / Counterpoint. by fuzzyfuzzyfungus · 2012-08-07 05:08 · Score: 3, Funny

Luckily, you'll presumably be moving your money out of a bank in some other country, so the risks should even out somewhat...

The finger by Anonymous Coward · 2012-08-07 05:43 · Score: 0

I can see a lot of people being forced to give someone "the finger" - which will result in a loss of appendage as well as funds from their bank account.

Re:Point / Counterpoint. by Anonymous Coward · 2012-08-07 08:50 · Score: 0

On the one hand, they may well have implemented 3 factor security. That's pretty cool. But on the other hand, you have to put your money in a fucking Vietnamese bank to get it.

Apparently they have a deposit insurance program, but it's limited to about $3,000.

$3000 is about twice the estimated 2012 per capita of Vietnam.

http://en.wikipedia.org/wiki/Viet_nam

Worked in retail banking backend's and... by twebb72 · 2012-08-07 11:49 · Score: 1

Cool that they've added additional security; but doubling the balance of the 'average' account? Sounds completely unlikely.

I've had privilege to see large amounts of transaction data from where the law of large numbers reigns supreme. The 99%ers, keep a very low to no balance, generally breaking even each month. Its insanity to look at the actual trends.

So when a bank opens a product that magically doubles the deposits, clearly they're either marketing either to a different segment, or the additional security means it costs more to keep that account, therefor the natural response is to keep a higher balance, often to avoid paying fees.

While the security aspect is notable (FYI already in R&D at many banks with fingerprint scanners becoming ubiquitous); the whole 'double their deposit' notion sounds wholly unlikely.

Compliance with the law? by Anonymous Coward · 2012-08-07 13:00 · Score: 0

AFAIK, taking a photo of a person's finger without consent and posting it on the internet is not illegal. This shit needs to go.

Why not toeprints by Anonymous Coward · 2012-08-07 17:46 · Score: 0

As has been pointed out repeatedly, your debit card will likely have your fingerprints on it and they can be lifted easily. So, to raise security, I propose to use toeprints instead of fingerprints. They are as unique as fingerprints and not likely to be on the card. There are added health benefits from this, because you are regularly forced to do light calisthenics at the ATM, not to mention that waiting in the queue will be much more entertaining.

Slashdot Mirror

Vietnamese Bank Issues Fingerprint-Enabled Debit Cards

36 comments