Slashdot Mirror
MasterCard Rolls Out 'Selfie' Verification For Mobile Payments (thestack.com)
An anonymous reader writes: MasterCard has announced plans to invest in facial recognition technology in the UK, in a push to reduce false decline transactions and increase security for mobile payments. Following trials in countries including the U.S. and the Netherlands, 'Selfie Pay' will be introduced in Britain this summer as part of the financial services company's identity validation process. Users will be able to choose between finger scanning and face recognition for verification, instead of traditional passwords or PIN numbers. Consumers will be asked to upload their pictures to be stored on MasterCard servers [paywalled]. These registered images will then be used as a reference every time a user opts for facial verification during a transaction.
Which will make things really awkward at the store.
What prevents the bad guys from taking a selfie of your picture?
Is this really more secure? Or is it just more convenient?
Per apps, per apps not
Suppose it's as secure as a password.
A password can be changed/revoked when you think it's insecure.
Suppose we also had this kind of protection from photos. I wonder what it would look like.
"He's smiling but didn't shave but looks bored" therefor it's authorized? "Wait, he revoked that as well" "umm, let's go with unshaven, fluffy bunny hat, asymmetric smile..."
I know it's easier but it is not a password.
...Mastercard is going to consider a selfie run through facial recognition to be as good as a fingerprint. So in order to be able to steal, say, Jessica's money, you need to have her card number and a large photo of her face you can hold up in front of your own face. Or if the transaction is monitored by a clerk who might be marginally competent, you can be more subtle and wear the the photo on a tee-shirt, taking a photo of your chest to pay. Maybe the phone itself is the ID, and the selfie just supposed to be proof that you are in possession of the phone? And all of this assumes that you have to upload the photo through an app and can't just text a saved image. If that's not true it's yet another point of failure.
I supposed possessing a card and a photo (or card and phone?) is marginally better security than just card. But my PIN isn't on Facebook, or in my phone's camera folder, so this is worse than just entering a PIN on your phone. The only value of the scheme is in using the phone as a side channel (harder to snoop on than a public keypad), or a as form of ID all it's own. So why not just put the existing identifier (the PIN) on the side channel, and not introduce novel way to fail?
This feels like when banks started letting you check your account over twitter because they just "didn't get it."
Why not just an app on your phone that you click accept or denied? No need to enter a pin...
I'm sure part of the 'privacy' agreement that will go along with this, is the 'sharing' of the exemplar photo and/or fingerprints with their 'partner' companies, which no doubt will also include the government. For safety purposes, of course. Really, the government only wants to know where you are at all times and everything you're purchasing for your own safety, really they do!
Bollocks.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
Will work on Halloween unlike face recognition. But you'll have to stop using chat roulette or your bank account will be drained. I
Some drink at the fountain of knowledge. Others just gargle.
They don't need it and I don't want them to have them.
Fuck it, if they try to force this in the US, I'll cancel my cards and just do all cash...which I try to do more and more every day anyway.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
My objection to using my fingerprints as a means of authentication is that they're permanent and irrevocable. If someone gets ahold of my passwords, I can change them. My fingerprints, not so much.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
That's not poor design, that's deliberate design.
Too many people left things behind when it happened at once. So now the card doesn't come out until AFTER you take the money.
(At least if you forget the card, its probably not that big of a deal); since it's useless without the pin.)
Plus doing multiple things at once leads to much more difficult to handle error conditions; which is something you don't want to do when dealing with money. So each step is an atomic transaction. Don't do X until we know that Y was actually successful.