Slashdot Mirror
Unresolved Issues Swirl Around Securing Mobile Payments
CowboyRobot writes "While many mobile payments startups are using both traditional and nontraditional authentication methods, regulatory uncertainty still exists around liability for fraud attacks on customers using mobile payments. Although there haven't been any public attacks from fraudsters on alternative mobile payments providers such as Square, LevelUp or Dwolla, anecdotal stories are already circulating among security experts and regulators of such attacks. One thing that still has to be worked out in this area is regulatory oversight. 'The regulators are not yet clear who owns the regulatory oversight for these environments. These technologies tend to fall through the cracks even in terms of card-present or card-not-present.'"
I await Frist PS0t crunchiness - especially with a gimmee, like "Swirl", in the post title!
"Flyin' in just a sweet place,
Never been known to fail..."
Under communism it will no longer be necessary, and humanity will for the first time be allowed to develop its full potential in freedom. Viva Trotsky!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
That means it’s becoming increasingly difficult for the world to meet its professed goal of limiting global warming to 2C (3.6F) above pre-industrial levels.
Funnyhacks - Wierd, unusual, and fun hacks
Phones aren't secure because most people don't put a password on them, and any app you run for mobile payments on top of that can be hacked, since once you have physical access to the phone, you're pretty well doomed.
Just stick with the damn cards. If you lose it, your bank will send you a free replacement, and it's instantly disabled. The same cannot be said for access to your accounts with your phone, for which you will not receive a free replacement, and you may have to close your account since unlike a card, your login, password, social security number, date of birth, access to e-mail account, oh... and probably the phone number the bank would call you back at to verify your identity... are now all in the hands of the criminal.
#fuckbeta #iamslashdot #dicemustdie
Who's liable for bitcoin fraud? Oh, right, nobody. Legal problem solved.
Read Marx, Engels, Lenin and Trotsky.
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
it can be hacked.
cash is probably safer carry these days than your iphone, ipad or ipod....
A recent article in the Communications of the ACM pointed out that the banks have massive expenses securing and paying for failed security in ATM payments, so expect it to be much worse with mobile.
See Simons and Jones, "Internet Voting in the U.S.", CACM October 2012, p 68, "However, banks routinely and quickly replenish funds lost to online fraud in order to maintain public confidence". This was part of a discussion of why voting is claimed to be safe, based on the fallacious assertion that online banking is safe.
--dave
davecb@spamcop.net
There is no reason to have any government regulations around mobile payment systems at all, the providers are interested in making sure that they have customers and customers are interested in not being scammed, and thus the providers have to figure out how to ensure safety and security and customers and clients have to make sure that they check that the company they are dealing with has good ratings by the public (and today it's a much easier thing to do than ever before in history).
I actually read TFA and nowhere there it mentioned just what exactly the regulators are interested in doing, but it is obvious that their concern is not actual safety of consumers and clients, obviously their main concern is that they may not be able to track transactions that they want to track, and they want to track all transactions.
They'll tell you anything, it's about drugs, it's about pedophiles, it's about terrorists.
You know what it is about? It's about money and your ability not to be scammed by the very government that pretends it has your 'best interests' in mind. Do you know what they say about best intentions? Well, that's what it is when the intentions are 'good', what about the time when the intentions are actually not good at all in the first place?
MY OTHER COMMENTS
From TFS:
These technologies tend to fall through the cracks even in terms of card-present or card-not-present
The only way to perform a card-present transaction and get the better discount rates and lower fraud liability is to provide the magnetic strip data. Anything typed in is considered card-not-present, even when you type it in when the card is in your hand (otherwise merchants would just lie and get the better rates).
What this brings about is the question of how merchants are verified as the line between consumer and merchant is blurred... there's no significant change in how things are actually processed behind the scenes, no matter how pretty the UI. It's a bunch of cryptic nonsense based on IBM mainframes from the '70s. Ever seen the integration spec on one of those bad boys? It's nasty - to the point where going truly direct requires a PCI-certified dial-up modem or dedicated leased line installed in your locked cage in your datacenter. Thought using a SOAP API sucks? Try translating your ASCII to EBCDIC before sending it over protocols that predate TCP/IP.
How are sites slashdotted when nobody reads TFAs?
AT&T 4nd Berkeley
Just like every networked computer, really. The interesting thing is that for phones that could actually have been done, as they are closed system and can be remotely administrated. Turns out, a) the providers are not that competent themselves, b) things like "app stores" are far more important that mere security of a device many people store their whole life on. I also have observed that app developers are typically clueless about security and development environment makes it even harder to secure things properly. (The latter from an evaluation we did that was implemented by developers that really understood what they were doing. Even they had huge security gaps, but at least they knew and understood them.) And no, iOS is not better than Android either.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I'm posting anonymously due to the potential implications of my comments, but the government is trying to figure it out too. Things are springing up so quickly that it's not altogether clear what regulations apply and where. Regulation takes a long time to craft, so the government is sometimes YEARS behind the curve when it comes to applicable regulation and guidance. The most pertinent issue for consumers is clarity on who is liable in event of a dispute, which is a fairly murky area right now. The saving grace in many cases is that these transactions are being completed by credit card, which means that the protections offered by the credit card regulations apply in many cases.
The biggest regulations that currently apply to these types of transactions are Federal Reserve Regulation E (http://www.federalreserve.gov/bankinforeg/regecg.htm) and Regulation Z (http://www.federalreserve.gov/bankinforeg/regzcg.htm).
Exploring the security of the Square reader unearths interesting results. Using their reader (and presumably PayPal's, BoA's) as a basis for a credit card skimmer isn't easy, but it sure is straightforward. That leads to an interesting set of "plays", like playing the audio of the credit card read back into Square. Technical details here: https://theotigerblog.wordpress.com/2012/04/07/squareskimmer/
Theo
So payment security comes down to insurance and legal liability? Fuck that. Truly secure transactions are well within or means, and have been for decades. I want neither to lose my money, nor to funnel billions to criminals through insurance premiums.
Try again, you jokers.
hint: chip and pin, two factor authentication, and private keys for cardholders are good starting points.
1^2=1; (-1)^2=1; 1^2=(-1)^2; 1=-1; 1=0.