Slashdot Mirror
Mastercard is Building Fingerprint Scanners Directly Into Its Cards (fastcompany.com)
Mastercard said on Thursday it's beginning trials of its "next-generation biometric card" in South Africa. In addition to the standard chip and pin, the new cards have a built-in fingerprint reader that the user can use to authenticate every purchase. From a report: Impressively, the new card is no thicker or larger than your current credit and debit cards.
I think that's where the whole "trials" thing comes in....
I've been wondering for quite a while when we could have something like this. The question is how the processing works for the card, for example
a) Does it process against a chip in the card which allows the card to pass information to the pin-pad or not (good to prevent use of stolen cards)
b) Does it process against the pin-pad allowing a transaction to be verified (good to transactions from cloned cards)
The first choice is good to reduce the more immediate impact of card theft, and better from a privacy perspective. The second is more effective against somebody cloning your card - which around here is more common - but it means that your CC company presumably needs your biometric info. It also allows the use of fingerprints as a password replacement (pin-pad)
In an area where cutting off arms doesn't give some people pause - what could go wrong??
There are other things you can comment on like above, but I there are other ways this can go wrong as well.
I have been diagnosed with bad eczema on my hands recently, and it mostly affects the tips of my fingers. The sensor on my Nexus will now periodically stop accepting my fingerprint scans until I log in with another authentication method and rescan them.
If you don't have any backup ways to provide authentication there are cases where people will get locked out for medical reasons. That won't be extremely common I guess, but fingerprint biometric will, like all systems, not solve all problems.
I think the point is that they're making it much harder for a typical wallet thief to go to town on your credit card before you can report it stolen. By the time they create a false print, it may be too late.
I'm still waiting for the version of the mastercard that includes a holographic AI assistant, that we were promised in the early 90s
Wouldn't the thief still need your PIN? And the physical card? And a fake fingerprint sticker of your finger? (And which finger did you register with the card?)
In order to authenticate each transaction: A retina scan, voice sample, blood sample, semen sample and lock of hair.
I'll see your senator, and I'll raise you two judges.
because online shopping doesn't exist?
because card readers with finger print tech will be every where just like chip-card readers are every where
One day they'll discover the folly of using biometrics for authentication or authorization, but then it will be too late. Let's all tie everything to a password that we can never change right? Great idea! Sigh
When will fingerprints die? All fingerprint technology can't check if a human finger is actually what is being read.
Too many designers watching James Bond films . . .
-- Mean People Suck
I've always wondered why they don't use some form of cryptography to authenticate the card. Skimming seems to be more prevalent than someone physically having a card, though perhaps theft is more common in South Africa.
In unrelated news, Lloyd's Of London sees spike in finger insurance.
Touch-activated sphincter rod sensor is much more secure and this is what they should go with for biometric authentication.
Okay, it's amazing how many "mickey's" the public has been swallowing in the name of "security" be it national or individual. This is basically a way of fingerprinting everyone in a private database. We all know of ways this can be bypassed (you can lift finger prints from anything someone has touched (doorknob, glass, whatever), so the only one who benefits are private corporations who want to sell that data, and governments who want to obtain it by buying it. We are treating the public as criminals by default or worse...cattle with a brand that is pre-applied. That will be one card I will not use. guess cash is king again for those of us who believe we should formally convicted of something before we have biometric data collection by agencies.
"Imagination is more important than knowledge" - Einstein
...note to thieves: now you need to remember to bring a sharp knife to your muggings. A gun alone simply won't do.
-Styopa
As far as I'm aware, the fundamental idea behind breaking chip/pin is to exploit the fallback system to bypass the need to actually know the pin and make the system believe that it fell back to signature based authentication. it seems me that similar vulnerabilities would exist here.
File under 'M' for 'Manic ranting'
Sure, it will help thwart common pickpockets.
On the other hand, violent muggings will be escalated.
Here we are in the US with chip and signature, much less chip and biometrics. And not all all retailers have chip readers, including Costco, at least the one I shop at. My one man barber shop has a chip reader POS terminal. And what about using stolen cards with on line retailers before the owner knows about the theft? I'm not sure how the interface would work.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Next up, the mugger takes your wallet AND your fingers.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Because increased 'card present' security is important, especially outside the US where there's no such thing as zero fraud liability.
Card not present security will inevitably need another form of protection, whether that's from one time keys or some kind of two factor system, but that's not what this is for.
Are you implying this is just a government effort to fingerprint everybody? Naah, it can't be.
PIN on a credit card? Honestly I've never had a bank offer the option of setting one up. And I think the reason they don't is because they want the transaction to happen quicker. With a fingerprint, it could very well satisfy both needs. I.e. press your finger on the right spot of the card just prior to insertion, and nothing else is required. Merchant can even do away with the pin pad.
Instead of entering the PIN into the merchant's terminal, the terminal should just power the card, and I enter the PIN into the card. That way the merchant doesn't get my PIN. This was proposed in the 1990's and deemed impossible because nobody had chip cards and the technology would have been too expensive. Now that the government finally mandated chip cards, they are suddenly realizing all the features that we could have had long ago. It's probably too late. We will all pay with smart devices in another decade.
How many times in the last decade has it been shown that finger print readers are neither secure nor reliable? Most sensors are easier to circumvent than my bicycle's 4 digit combo lock.
“Common sense is not so common.” — Voltaire
Armed gangs have been roving the streets of Pretoria with pliers and garden shears; local hospitals are being overwhelmed with victims of these drive by finger amputation muggings.
Great. So some criminal scum with their skimmers will now steal my fingerprint, as well as my credit card/debit card information.
Canadiam.... my Capital One catd has a pin...
Depends where you live, the American banks chose to go for chip and signature while the European banks (and afaict most other countries) went for chip and pin.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Card companies are always trying to strike a balance between security and usability. Chip and pin does pretty well but it's vulnerable to theives who shoulder-surf the pin and then steal the card. It is also relatively slow (though that is partly down to crappy terminals). Contactless is far more convenient but much less secure. Chip and signature is vulnerable to inattentive operators and modified cards.
How will this option fare on conviniance and security? presumably that is what these trials are intended to find out.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
"Depends where you live, the American banks chose to go for chip and signature while the European banks (and afaict most other countries) went for chip and pin."
Which explains why my new chip card was compromised within a week of receiving it.
One of the staff at the restaurants we frequent bought themselves a porn subscription apparently.
Text alert let me shut it down, but the card was still compromised.
Security theater is all it is.
You have to understand that these features are mainly intended to protect the bank.
For card present transactions if the merchant does everything in the most secure way the card supports the bank takes the fraud liability. If the merchant takes card not present transactions or refuses to upgrade their equipment to support EMV by the deadline the bank gives then the merchant takes the fraud liability.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
We now have to push 4 buttons for our pin code. This is obviously way to difficult. Especially for people that use Imperial instead of Metric. (Remember: Causation is similar to correlation)
Don't fight for your country, if your country does not fight for you.
My Target card has a PIN. My major credit cards with big limits have a PIN. Don't confuse PIN with the mag stripe. It's two factor identification.
1. Something you know: the PIN
2. Something you have: the card with the chip in it that is not easily forged or reproduced.
The fingerprint is the third of the three types of "factors" to authenticate you. Try as hard as you like, there are only three ways to authenticate something:
1. Something you know. (password, pin, musical notes, etc)
2. Something you have. (car key, house key, credit card with built in microprocessor and storage, a key fob device with USB connector, etc)
3. Something you are. (fingerprint, retina scan, DNA, etc.)
The fingerprint just allows the possibility of three factor authentication. There are no other ways other than something you know, you have, or you are.
BTW, that chip on the credit card is a tamper proof self contained computer with storage. (also: it runs Java.) It has a private key that was originally generated on the chip and never leaves the chip. The bank has the other key of that key pair. So the bank can be sure you really do have the actual card when the card is inserted into the POS terminal. The card can authenticate itself by signing a random token from the bank, while the card is inserted in the terminal. Only your card could do that because nothing else has that private key to do the signing.
The credit card has always been "something you have". It's just been a question of how easy is it for a crook to replicate that card and have it too. The new chip makes that cost prohibitively high.
I'll see your senator, and I'll raise you two judges.