Slashdot Mirror
Unresolved Issues Swirl Around Securing Mobile Payments
CowboyRobot writes "While many mobile payments startups are using both traditional and nontraditional authentication methods, regulatory uncertainty still exists around liability for fraud attacks on customers using mobile payments. Although there haven't been any public attacks from fraudsters on alternative mobile payments providers such as Square, LevelUp or Dwolla, anecdotal stories are already circulating among security experts and regulators of such attacks. One thing that still has to be worked out in this area is regulatory oversight. 'The regulators are not yet clear who owns the regulatory oversight for these environments. These technologies tend to fall through the cracks even in terms of card-present or card-not-present.'"
I await Frist PS0t crunchiness - especially with a gimmee, like "Swirl", in the post title!
"Flyin' in just a sweet place,
Never been known to fail..."
That means it’s becoming increasingly difficult for the world to meet its professed goal of limiting global warming to 2C (3.6F) above pre-industrial levels.
Funnyhacks - Wierd, unusual, and fun hacks
Phones aren't secure because most people don't put a password on them, and any app you run for mobile payments on top of that can be hacked, since once you have physical access to the phone, you're pretty well doomed.
Just stick with the damn cards. If you lose it, your bank will send you a free replacement, and it's instantly disabled. The same cannot be said for access to your accounts with your phone, for which you will not receive a free replacement, and you may have to close your account since unlike a card, your login, password, social security number, date of birth, access to e-mail account, oh... and probably the phone number the bank would call you back at to verify your identity... are now all in the hands of the criminal.
#fuckbeta #iamslashdot #dicemustdie
That is an interesting definition of freedom: a society where the organization that replaces government will tell you what you must do and give you what you are allowed to have.
The truth is that all men having power ought to be mistrusted. James Madison
Who's liable for bitcoin fraud? Oh, right, nobody. Legal problem solved.
it can be hacked.
cash is probably safer carry these days than your iphone, ipad or ipod....
You apparently don't know human nature.
The truth is that all men having power ought to be mistrusted. James Madison
A recent article in the Communications of the ACM pointed out that the banks have massive expenses securing and paying for failed security in ATM payments, so expect it to be much worse with mobile.
See Simons and Jones, "Internet Voting in the U.S.", CACM October 2012, p 68, "However, banks routinely and quickly replenish funds lost to online fraud in order to maintain public confidence". This was part of a discussion of why voting is claimed to be safe, based on the fallacious assertion that online banking is safe.
--dave
davecb@spamcop.net
Communism doesn't define any organization replacing government... in fact, what you're thinking of is a totalitarian government (not an organization replacing government at all...), which could just as easily be happening with capitalism as communism. There's even anarchist communism, which is actually a very interesting way to live (I got to experience it for a couple of years, personally, until life took me out of that community and I went to living on my own).
From TFS:
These technologies tend to fall through the cracks even in terms of card-present or card-not-present
The only way to perform a card-present transaction and get the better discount rates and lower fraud liability is to provide the magnetic strip data. Anything typed in is considered card-not-present, even when you type it in when the card is in your hand (otherwise merchants would just lie and get the better rates).
What this brings about is the question of how merchants are verified as the line between consumer and merchant is blurred... there's no significant change in how things are actually processed behind the scenes, no matter how pretty the UI. It's a bunch of cryptic nonsense based on IBM mainframes from the '70s. Ever seen the integration spec on one of those bad boys? It's nasty - to the point where going truly direct requires a PCI-certified dial-up modem or dedicated leased line installed in your locked cage in your datacenter. Thought using a SOAP API sucks? Try translating your ASCII to EBCDIC before sending it over protocols that predate TCP/IP.
How are sites slashdotted when nobody reads TFAs?
Money is not itself contradictory with a communist system: indeed, if you have any luxury or freedom of choice you need money to ensure fairness. Let's imagine you'd like to play the violin, and I'd like to go golfing. How do we decide what golf clubs are equivalent to your violin? Clearly, it is a question of how much work went into making them, and what raw materials were required. As soon as we allocate a relationship between an hour of work and a lump of iron ore or bauxite or wood, we have money. Now imagine I like running instead: all I need are some shoes and time. Does that mean I can work less, since I am using less of other people's work? If you want lessons, do you need to work more to compensate society for the productivity you are consuming?
Even when it comes to essentials like food and housing, unless we all have the same thing or are fed out of common canteens, we run into the barter problem, so money makes it easier to get a fair distribution.
Of course, if there were no freeloaders and everyone were competent and attentive, everyone could work out the value of their consumption and self-regulate to make sure they didn't exceed their fair share, but in practice having fixed tokens or their electronic equivalent is rather simpler and more difficult to cheat.
(You also need money to mediate external trade.)
Just like every networked computer, really. The interesting thing is that for phones that could actually have been done, as they are closed system and can be remotely administrated. Turns out, a) the providers are not that competent themselves, b) things like "app stores" are far more important that mere security of a device many people store their whole life on. I also have observed that app developers are typically clueless about security and development environment makes it even harder to secure things properly. (The latter from an evaluation we did that was implemented by developers that really understood what they were doing. Even they had huge security gaps, but at least they knew and understood them.) And no, iOS is not better than Android either.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm posting anonymously due to the potential implications of my comments, but the government is trying to figure it out too. Things are springing up so quickly that it's not altogether clear what regulations apply and where. Regulation takes a long time to craft, so the government is sometimes YEARS behind the curve when it comes to applicable regulation and guidance. The most pertinent issue for consumers is clarity on who is liable in event of a dispute, which is a fairly murky area right now. The saving grace in many cases is that these transactions are being completed by credit card, which means that the protections offered by the credit card regulations apply in many cases.
The biggest regulations that currently apply to these types of transactions are Federal Reserve Regulation E (http://www.federalreserve.gov/bankinforeg/regecg.htm) and Regulation Z (http://www.federalreserve.gov/bankinforeg/regzcg.htm).
Exploring the security of the Square reader unearths interesting results. Using their reader (and presumably PayPal's, BoA's) as a basis for a credit card skimmer isn't easy, but it sure is straightforward. That leads to an interesting set of "plays", like playing the audio of the credit card read back into Square. Technical details here: https://theotigerblog.wordpress.com/2012/04/07/squareskimmer/
Theo
So payment security comes down to insurance and legal liability? Fuck that. Truly secure transactions are well within or means, and have been for decades. I want neither to lose my money, nor to funnel billions to criminals through insurance premiums.
Try again, you jokers.
hint: chip and pin, two factor authentication, and private keys for cardholders are good starting points.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.