Slashdot Mirror
Mastercard is Building Fingerprint Scanners Directly Into Its Cards (fastcompany.com)
Mastercard said on Thursday it's beginning trials of its "next-generation biometric card" in South Africa. In addition to the standard chip and pin, the new cards have a built-in fingerprint reader that the user can use to authenticate every purchase. From a report: Impressively, the new card is no thicker or larger than your current credit and debit cards.
http://gizmodo.com/these-fake-fingerprint-stickers-let-you-access-a-protec-1788710313
Good think you don't leave your fingerprint on the card or anything. And even if you take care to wipe your card regularly it's not like they'd take your thumb. Right?
Incidents of missing fingers on the rise. South African police are baffled. News at 11.
I've been wondering for quite a while when we could have something like this. The question is how the processing works for the card, for example
a) Does it process against a chip in the card which allows the card to pass information to the pin-pad or not (good to prevent use of stolen cards)
b) Does it process against the pin-pad allowing a transaction to be verified (good to transactions from cloned cards)
The first choice is good to reduce the more immediate impact of card theft, and better from a privacy perspective. The second is more effective against somebody cloning your card - which around here is more common - but it means that your CC company presumably needs your biometric info. It also allows the use of fingerprints as a password replacement (pin-pad)
In an area where cutting off arms doesn't give some people pause - what could go wrong??
There are other things you can comment on like above, but I there are other ways this can go wrong as well.
I have been diagnosed with bad eczema on my hands recently, and it mostly affects the tips of my fingers. The sensor on my Nexus will now periodically stop accepting my fingerprint scans until I log in with another authentication method and rescan them.
If you don't have any backup ways to provide authentication there are cases where people will get locked out for medical reasons. That won't be extremely common I guess, but fingerprint biometric will, like all systems, not solve all problems.
We're edging towards a complete surveillance society.
And we're asking for it as a feature.
The government may not be recording my every move but my neighbor may and can. And after that, there's nothing to prevent others from accessing it.
Same goes for biometrics. Or sales data.
Amazon is adamant that they keep their sales data private and share it with no one.
I believe them.
But when Bezos leaves?
What then? After Bezos is gone, some dipshit MBA wanting to make a name for him/herself by selling that data....there is NOTHING to prevent that.
And in this world of BIG DATA I can connect your Amazon purchases, browsing habits, facebook page, credit card data, credit bureau data, MIB - Medical Information Bureau data, motor vehicle data, tax data, census data, GOOGLE SEARCH data, yak, yak ,yak .....
I have a dossier on you that would make an East German Stasi agent cream his pants.
Be good! Better not shout! Better not pout! Better not laugh (at the wrong things) or cry! Or Stazi (Corporate) State will come!
I'm still waiting for the version of the mastercard that includes a holographic AI assistant, that we were promised in the early 90s
Does no one see the potential problem of fingerprint collection?
One day they'll discover the folly of using biometrics for authentication or authorization, but then it will be too late. Let's all tie everything to a password that we can never change right? Great idea! Sigh
When will fingerprints die? All fingerprint technology can't check if a human finger is actually what is being read.
Too many designers watching James Bond films . . .
-- Mean People Suck
I've always wondered why they don't use some form of cryptography to authenticate the card. Skimming seems to be more prevalent than someone physically having a card, though perhaps theft is more common in South Africa.
In unrelated news, Lloyd's Of London sees spike in finger insurance.
Protection levels only need to be appropriate for what they are protecting. When you're authenticating a sub-$1000 transaction then fingerprints are fine.
And if you need to authenticate a $5000+ transaction then you can do like Japanese ATMs have done for years and require a finger vein check instead http://www.bbc.com/news/business-29062901
Touch-activated sphincter rod sensor is much more secure and this is what they should go with for biometric authentication.
Okay, it's amazing how many "mickey's" the public has been swallowing in the name of "security" be it national or individual. This is basically a way of fingerprinting everyone in a private database. We all know of ways this can be bypassed (you can lift finger prints from anything someone has touched (doorknob, glass, whatever), so the only one who benefits are private corporations who want to sell that data, and governments who want to obtain it by buying it. We are treating the public as criminals by default or worse...cattle with a brand that is pre-applied. That will be one card I will not use. guess cash is king again for those of us who believe we should formally convicted of something before we have biometric data collection by agencies.
"Imagination is more important than knowledge" - Einstein
...note to thieves: now you need to remember to bring a sharp knife to your muggings. A gun alone simply won't do.
-Styopa
As far as I'm aware, the fundamental idea behind breaking chip/pin is to exploit the fallback system to bypass the need to actually know the pin and make the system believe that it fell back to signature based authentication. it seems me that similar vulnerabilities would exist here.
File under 'M' for 'Manic ranting'
Sure, it will help thwart common pickpockets.
On the other hand, violent muggings will be escalated.
Here we are in the US with chip and signature, much less chip and biometrics. And not all all retailers have chip readers, including Costco, at least the one I shop at. My one man barber shop has a chip reader POS terminal. And what about using stolen cards with on line retailers before the owner knows about the theft? I'm not sure how the interface would work.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Instead of entering the PIN into the merchant's terminal, the terminal should just power the card, and I enter the PIN into the card. That way the merchant doesn't get my PIN. This was proposed in the 1990's and deemed impossible because nobody had chip cards and the technology would have been too expensive. Now that the government finally mandated chip cards, they are suddenly realizing all the features that we could have had long ago. It's probably too late. We will all pay with smart devices in another decade.
How will this work with contactless cards?
How many times in the last decade has it been shown that finger print readers are neither secure nor reliable? Most sensors are easier to circumvent than my bicycle's 4 digit combo lock.
“Common sense is not so common.” — Voltaire
Armed gangs have been roving the streets of Pretoria with pliers and garden shears; local hospitals are being overwhelmed with victims of these drive by finger amputation muggings.
This is quite deliberate. It doesn't matter that it's sold as "for your protection", for it doesn't do that. It makes you less of a liability, since biometrics are "foolproof" and therefore any fault is the consumer's. It doesn't matter, though it's a nice side effect, that it makes the consumer expendable. The consumer is just the consumer. The company, now, that biometrics will handily protect. Or at least gives the company plausible deniability since it's the consumer's biometrics that plausibly point to the consumer as the culprit, no matter what really happened. So the company approves.
Hate them all you want, but they're the only thing bridging the gap between cash and "nifty" tattoos. We all know the only reason for the fingerprint is so your government can get a copy, criminal or not. Wouldn't it be easier just to put RFID chips in them and make it so it doesn't work when a certain distance from your phone?
Great. So some criminal scum with their skimmers will now steal my fingerprint, as well as my credit card/debit card information.
Fingerprints are no panacea, but let's be realistic. We are dealing with a financial scheme where they currently publish the passwords in plaintext right on the card. 16+3 digit password is far less secure than the same thing plus my fingerprint. Today, I can use anyone's fingers to pass that 16+3 digit password (they call it an "account number" but really it's the authentication token aka password.) With this new scheme, my finger, and a few moderately difficult to make copies can pass the account number. Yes, a hard core dude can get my print. But I am guessing NONE of you on this board can do it (do ALL of the Anon users use the same print!?). Yet ALL of you could use my card willy nilly without the print in today's system. So stop thinking about it as all or nothing, and realize that security is incremental, and when it sucks as bad as it does today for VISA and MC, adding a print really helps.
How convenient... Let's use a fingerprint, the one that you left not he glass, table, or even better right on the credit card you're using.
Honestly I wish they would let us disable the mag stripe and require PIN's, or at least require the transaction to be done in person (which probably means require the PIN). I know I wouldn't mind. Some waiter swiped/photo'd my card a couple weeks ago. Luckily Fraud Protection caught it, but it was still annoying.
They can put a fingerprint reader without thickening the card, so they should be able to put a thin display (OLED? e-Ink?) and integrate OTP into the cards and do away with bulky card readers for online banking. Do that and then they can add OTP to 3D Secure (Verified by VISA, MasterCard SecureCode) in a jiffy, and we'll all be finally out of the 20th century.
We now have to push 4 buttons for our pin code. This is obviously way to difficult. Especially for people that use Imperial instead of Metric. (Remember: Causation is similar to correlation)
Don't fight for your country, if your country does not fight for you.