Slashdot Mirror
MasterCard Rolls Out 'Selfie' Verification For Mobile Payments (thestack.com)
An anonymous reader writes: MasterCard has announced plans to invest in facial recognition technology in the UK, in a push to reduce false decline transactions and increase security for mobile payments. Following trials in countries including the U.S. and the Netherlands, 'Selfie Pay' will be introduced in Britain this summer as part of the financial services company's identity validation process. Users will be able to choose between finger scanning and face recognition for verification, instead of traditional passwords or PIN numbers. Consumers will be asked to upload their pictures to be stored on MasterCard servers [paywalled]. These registered images will then be used as a reference every time a user opts for facial verification during a transaction.
Which will make things really awkward at the store.
I buy something. .why not?
The transaction simply stays on hold (for like 5 to 10 seconds), my phone receives a code via txt message, I enter the code to complete the transaction. What's the big deal? My banker friend tells me "no no no, consumers don't want the hassle of entering codes." . .
What prevents the bad guys from taking a selfie of your picture?
Is this really more secure? Or is it just more convenient?
some guy who looks like a mr. potato head outline with a hat? cease fire stand down all life matters in all of our towns... truth+mercy=justice.. in the moms we trust..
Modern app appers know that ONLY apps can app apps, so any app apper can take a selfie of you and app your apps using your AppsterCard!
Apps!
for those corporations to demand pictures of us. They must have a plan for making a lot of money off of them considering the huge rise in fraud this will cause. I know at the bank where I work, we often do things that screw customers and merchants just because there's a little profit in it for us. Security just isn't important to us.
Suppose it's as secure as a password.
A password can be changed/revoked when you think it's insecure.
Suppose we also had this kind of protection from photos. I wonder what it would look like.
"He's smiling but didn't shave but looks bored" therefor it's authorized? "Wait, he revoked that as well" "umm, let's go with unshaven, fluffy bunny hat, asymmetric smile..."
I know it's easier but it is not a password.
This is awesome - can they tie to my passport? - then I just need one document to live my life!!! :)
Every time my friend tries to use Apple Pay with his iPhone, his bank automatically deactivates his debit card and he has to call in explain what the fraudulent activity he was trying to commit.
...is to help the leftist statists spy on all of your activities and outlaw cash.
Just got to go all silence of the lambs on the guy whose credit card you stole.
Will this also replace PIN numbers at ATM machines? /grammar
Nope, no sig
Captain, Obviously this was predicted. here is the complete surrender of your last vestige of privacy. your images are stored on THEIR servers and tied to EVERY video camera on the planet to follow the dissenters and dissidents ... hope you enjoy this Brave New World Order that you brought upon us by sheeping up and giving away my Rights and Freedoms.
...Mastercard is going to consider a selfie run through facial recognition to be as good as a fingerprint. So in order to be able to steal, say, Jessica's money, you need to have her card number and a large photo of her face you can hold up in front of your own face. Or if the transaction is monitored by a clerk who might be marginally competent, you can be more subtle and wear the the photo on a tee-shirt, taking a photo of your chest to pay. Maybe the phone itself is the ID, and the selfie just supposed to be proof that you are in possession of the phone? And all of this assumes that you have to upload the photo through an app and can't just text a saved image. If that's not true it's yet another point of failure.
I supposed possessing a card and a photo (or card and phone?) is marginally better security than just card. But my PIN isn't on Facebook, or in my phone's camera folder, so this is worse than just entering a PIN on your phone. The only value of the scheme is in using the phone as a side channel (harder to snoop on than a public keypad), or a as form of ID all it's own. So why not just put the existing identifier (the PIN) on the side channel, and not introduce novel way to fail?
This feels like when banks started letting you check your account over twitter because they just "didn't get it."
The future is stupid.
Convenience, convenience, convenience. That is what sells to the majority.
I'm sure part of the 'privacy' agreement that will go along with this, is the 'sharing' of the exemplar photo and/or fingerprints with their 'partner' companies, which no doubt will also include the government. For safety purposes, of course. Really, the government only wants to know where you are at all times and everything you're purchasing for your own safety, really they do!
Bollocks.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Didn't some credit used to photo printed right on the credit card? I never understood why that went away.
They could have easily verify the photo hash to check the photo integrity and retail clerk can easily check if photo match the person
Will work on Halloween unlike face recognition. But you'll have to stop using chat roulette or your bank account will be drained. I
Some drink at the fountain of knowledge. Others just gargle.
Here's hoping the algorithm is good enough to pick up the fear in someone's eyes that have a knife held up against to them out of camera view.
This technology is certainly meaningful, but could easily be bypassed by twins or worse, casual photographers. My solution is both elegant and simple.
whenever asked for photo confirmation, unfold my patented visual verification sheet. The sheet, which is a visual depiction of george W bush and the words, "War Criminal," will quickly identify your presence for a transaction. For those wondering about the security of this system I can assure you, each VV sheet is unique. For example, one may contain a depiction of Hillary Clinton and the words "Corporate Citizen" to help distinguish unique transactions for a customer.
Good people go to bed earlier.
Yeah you noticed this too? What were they thinking? It's not an eternity but it really slows down what used to be a quick transaction when you buy a cup of coffee or something quick and easy. For you an extra thirty seconds might not matter but for the vendor it will add up. If they were doing 30 transactions an hour it will have an impact. Drive throughout aim for twice that.
Some drink at the fountain of knowledge. Others just gargle.
I wrote that code..
It's pretty decent and it does work towards the new specs coming in the next few years, which is to rid all banking online from usernames and passwords.
Also, the idea is 2-factor, not Just a picture. You won't even get to the picture part without the first step.
The name of the Mastercard guy who is desperately trying to push this crap is "Ajay Bhalla". He has released a series of desperate interviews with delirious statements like:
- "This thing is good 'cuz people canâ(TM)t remember passwords" (I can, IDIOT)
- "Selfies are good 'cuz millennials like them" (I'm a millennial, and I don't like selfies, IDIOT)
- And, dulcis in fundo, some self-sourced "statistics": "One third of people don't do e-commerce 'cuz they can't remember passwords" (probably that third that you come from, the IDIOTS)
Just google for all of his desperate marketing efforts to push this crap to consumers, he sounds more like a kitchen appliances' seller rather than an IT expert. Would you trust a guy like that...?
"RAID array" is ... redundant.
Mind. Blown.
Nope, no sig
How are they going to cope with the problem that biometric credentials cannot be revoked once they have been compromised?
I've always used a simple, foolproof method of my own invention.
"Can you identify yourself, sir?"
*Pulls out small pocket mirror*
"Yep, that's me all right."
I think "foolproof" is the right word...
Garry Knight
It's the Mark of the Beast!
Which actually, I'm looking forward to. All they need is a narrator with dulcet tones to assure us, "This technology will protect your family from Global Terrorism, High Gas Prices, Internet Pedophiles, and Gay Marriage."
Then the Bible-thumpers will be the first ones to get it.
was beatable by a photo on my iPhone of the same person. I doubt that these "facial recognition" banking apps will be any more secure.