Slashdot Mirror
MasterCard Rolls Out 'Selfie' Verification For Mobile Payments (thestack.com)
An anonymous reader writes: MasterCard has announced plans to invest in facial recognition technology in the UK, in a push to reduce false decline transactions and increase security for mobile payments. Following trials in countries including the U.S. and the Netherlands, 'Selfie Pay' will be introduced in Britain this summer as part of the financial services company's identity validation process. Users will be able to choose between finger scanning and face recognition for verification, instead of traditional passwords or PIN numbers. Consumers will be asked to upload their pictures to be stored on MasterCard servers [paywalled]. These registered images will then be used as a reference every time a user opts for facial verification during a transaction.
Which will make things really awkward at the store.
What prevents the bad guys from taking a selfie of your picture?
Is this really more secure? Or is it just more convenient?
Per apps, per apps not
Suppose it's as secure as a password.
A password can be changed/revoked when you think it's insecure.
Suppose we also had this kind of protection from photos. I wonder what it would look like.
"He's smiling but didn't shave but looks bored" therefor it's authorized? "Wait, he revoked that as well" "umm, let's go with unshaven, fluffy bunny hat, asymmetric smile..."
I know it's easier but it is not a password.
Every time my friend tries to use Apple Pay with his iPhone, his bank automatically deactivates his debit card and he has to call in explain what the fraudulent activity he was trying to commit.
Will this also replace PIN numbers at ATM machines? /grammar
Nope, no sig
...Mastercard is going to consider a selfie run through facial recognition to be as good as a fingerprint. So in order to be able to steal, say, Jessica's money, you need to have her card number and a large photo of her face you can hold up in front of your own face. Or if the transaction is monitored by a clerk who might be marginally competent, you can be more subtle and wear the the photo on a tee-shirt, taking a photo of your chest to pay. Maybe the phone itself is the ID, and the selfie just supposed to be proof that you are in possession of the phone? And all of this assumes that you have to upload the photo through an app and can't just text a saved image. If that's not true it's yet another point of failure.
I supposed possessing a card and a photo (or card and phone?) is marginally better security than just card. But my PIN isn't on Facebook, or in my phone's camera folder, so this is worse than just entering a PIN on your phone. The only value of the scheme is in using the phone as a side channel (harder to snoop on than a public keypad), or a as form of ID all it's own. So why not just put the existing identifier (the PIN) on the side channel, and not introduce novel way to fail?
This feels like when banks started letting you check your account over twitter because they just "didn't get it."
The future is stupid.
Convenience, convenience, convenience. That is what sells to the majority.
Why not just an app on your phone that you click accept or denied? No need to enter a pin...
I'm sure part of the 'privacy' agreement that will go along with this, is the 'sharing' of the exemplar photo and/or fingerprints with their 'partner' companies, which no doubt will also include the government. For safety purposes, of course. Really, the government only wants to know where you are at all times and everything you're purchasing for your own safety, really they do!
Bollocks.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Now that they got your features, they are likely to mint a currency in your honor, aka facecoin.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Will work on Halloween unlike face recognition. But you'll have to stop using chat roulette or your bank account will be drained. I
Some drink at the fountain of knowledge. Others just gargle.
Here's hoping the algorithm is good enough to pick up the fear in someone's eyes that have a knife held up against to them out of camera view.
This technology is certainly meaningful, but could easily be bypassed by twins or worse, casual photographers. My solution is both elegant and simple.
whenever asked for photo confirmation, unfold my patented visual verification sheet. The sheet, which is a visual depiction of george W bush and the words, "War Criminal," will quickly identify your presence for a transaction. For those wondering about the security of this system I can assure you, each VV sheet is unique. For example, one may contain a depiction of Hillary Clinton and the words "Corporate Citizen" to help distinguish unique transactions for a customer.
Good people go to bed earlier.
Yeah you noticed this too? What were they thinking? It's not an eternity but it really slows down what used to be a quick transaction when you buy a cup of coffee or something quick and easy. For you an extra thirty seconds might not matter but for the vendor it will add up. If they were doing 30 transactions an hour it will have an impact. Drive throughout aim for twice that.
Some drink at the fountain of knowledge. Others just gargle.
But what if you're really a doge ?
I've been saying this for years but the major challenge is allowing the transaction to go forward when that is not available like travelling to another country with roaming off or simply in the middle of nowhere with no access to data all together.
I think there's a way to make this work and considering the big CC companies have plenty of resources at hand I'm surprised things are moving quicker.
Yeah, but what if you don't have a passport?
I'd dare say most US citizens do not have a passport, and never have had one....so, not really a common denominator.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
The good old SMS works pretty much everywhere
I've been saying this for years but the major challenge is allowing the transaction to go forward when that is not available like travelling to another country with roaming off or simply in the middle of nowhere with no access to data all together.
I think there's a way to make this work and considering the big CC companies have plenty of resources at hand I'm surprised things are moving quicker.
The app can keep a set of one-time-use codes for times when your phone is off the network. Use of such codes could trigger more stringent fraud protection for those transactions.
I've been saying this for years but the major challenge is allowing the transaction to go forward when that is not available like travelling to another country with roaming off or simply in the middle of nowhere with no access to data all together.
I think there's a way to make this work and considering the big CC companies have plenty of resources at hand I'm surprised things are moving quicker.
The app can keep a set of one-time-use codes for times when your phone is off the network. Use of such codes could trigger more stringent fraud protection for those transactions.
Or it can just keep a private key for each user and generate codes with that private key on its own when it's off network -- the bank can validate those offline codes against their copy of the public key. They can rekey periodically so even if someone compromises the app, the key has a limited lifetime.
"RAID array" is ... redundant.
Mind. Blown.
Nope, no sig
How are they going to cope with the problem that biometric credentials cannot be revoked once they have been compromised?
I've always used a simple, foolproof method of my own invention.
"Can you identify yourself, sir?"
*Pulls out small pocket mirror*
"Yep, that's me all right."
I think "foolproof" is the right word...
Garry Knight
was beatable by a photo on my iPhone of the same person. I doubt that these "facial recognition" banking apps will be any more secure.
That's a great idea!
That's hackable. The other solution has codes generated by the servers. I think it's safer.
Trust me when I say it DOES NOT!
Just travelling up north between towns you lose signal for kilometers.
That's hackable. The other solution has codes generated by the servers. I think it's safer.
Both solutions are hackable. If someone can hack the app to get to the private key, they can hack the app to get to the set of pre-generated codes. I'm assuming that you're not suggesting that public key cryptography itself is hackable.
But the nice thing about PKI is that the app doesn't have to set an upper bound on how many transactions can be completed offline, while if a static set of single-use codes is downloaded, that puts a hard cap on how many transactions can be completed offline.
Anything that can protect the list of single-use codes (i.e. only generated when I request it, expired and replaced daily, etc) can also be used to protect the private key.
The bank can chose to put their own cap on the number of offline PKI transactions, but it doesn't have to be baked into the app based on how many codes it downloaded, and if I call the bank from Bagladesh and say that I'm stranded there and I *have* to use my card, they can lift the cap for me.
I think your solution works good as long as the key is re-generated on a regular basis. The problem with a static keys stored locally on a device is that a copy of the device = ability to generate transactions at will. Obviously we can keep finding loop holes until we lose the will to live but what you and the other fellow suggested makes it such as smaller problem than it currently is.
So now, lets get coding and push this. Sounds like we have enough brain power and ideas to go make tones of money and become one of these evil corps /. users love to rant about. :)