Slashdot Mirror
Debit Card With Built-In Fingerprint Reader Begins Trial In the UK (theverge.com)
British bank Natwest is trialing the use of a new NFC payment card with a built-in fingerprint scanner. "The trial, which will include 200 customers when it begins in mid-April, will allow its participants to make NFC payments (called 'contactless' in the UK) without needing to input a PIN or offer a signature," reports The Verge. "The standard [30 British pound] limit for contactless payments will not apply when the fingerprint is used." From the report: Currently, anyone can make a contactless payment in the UK by tapping their card on the terminal to make a payment. As a result of this lack of security, a [30 British pound] limit is applied to such payments, with retailers requiring you to place your card into the card reader and enter a PIN for more expensive purchases (commonly referred to as the "Chip and PIN" method). Although mobile payments require authentication, customers often find they're subject to the same [30 British pound] limit. The fingerprint data is stored locally on the card, meaning there's no security information for a hacker to be able to steal from a bank's central database. It's not foolproof -- there's always the risk a sufficiently determined thief could steal and imitate your fingerprint -- but it's much more secure than a PIN that someone could learn by simply looking over your shoulder as you enter it.
Possibly this is some kind of training issue. Given there have been no issues here, I don't think it's unreasonable. Who asked me? Nobody.
My biggest issue with card payment is the multiple points of attack. They can physically steal your card, steal your number + 3 digit code, install a MITM card reader, install hacked or modified terminal or card reader or simply walk down the high street with a terminal in a bag and wave it at people's pockets collecting hundreds of contactless payments.
I will NEVER use a debit card; i only ever use my credit card and if i'm in ANY doubt i'll use a pre-paid credit card loaded with the required amount instead. And that is only for when it's not possible for me to use cash.
Nobody ever asks you anything you demon of the forest
But I blather anyway. I can't control myself nor do I even slightly attempt it.
I am... the nigh-stupid overpinionated consumer fecklessness, personified.
But you can call me Kendall.
It's more succinct, to the point.
captcha:ostrich
Putting on airs, eh? That's why nobody wants your opinion in any situation
Bigno! This dude gets it. Can't steal lunch out of Putin's ass when Trump Jr's on the job already, yowza.
A worse outcome is a low-tech hacker stealing my fingerprint, with a hatchet.
I hope these scanners check for a pulse or other signs of life.
I often like tech advances, but in this case, I'm fairly happy to just lean over the pin-pad so no-one else can see.
Also, for small purchases (£30) we can use contactless with no verification, if our card is stolen, the bank promises to refund misuse (perhaps requiring timley reporting of loss to them and police)
This type of 2FA relies on the two factors being (1) something you have, and (2) something you know. In the case of Chip and PIN, the chip (embedded in the card) is something you have, and the PIN is something you know. The orthogonality of these two factors means scenarios which result in the loss of one are unlikely to result in the loss of the other, and vice versa. Even if someone steals the card, they cannot use it because you have not revealed our PIN. Even if you tell someone your PIN, they cannot use it without physical possession of the card.
This new card they're trying changes the two factors to two things that you have. That makes fraud far more likely, because things which result in the loss of one are likely to result in the loss of the other. If you lose the card, a thief may be able to lift your fingerprint off the card itself. If someone dies and a person runs across the body, they have access to both the finger and the card.
That's really the whole point of 2FA. It's not "throw a couple roadblocks in the way of thieves and hope one of the works." It's designing the two roadblocks so there's minimal intersection of their weaknesses. Switching it to two physical factors results in a system that's not much more secure than having just a single factor.
BIometrics should never be used in place of a password, they should only replace the identification, userID, Login, etc. It should never ever replace the password.
And there is one simple reason for that, biometrics can't be changed, and they are for the most part trivial to obtain. For example you leave your fingerprints on everything you touch. These very things make them good for identification and absolutely awful for authentication. Authentication should always be something in your head (password) and verified with something you have (OTP, etc).
On top of that every single one of these biometric identification technologies has been shown to be trivial to spoof in time. Biometrics are far too easy to obtain and should be relegated to identification, not authentication.
>with retailers requiring you to place your card into the card reader and enter a PIN for more expensive purchases (commonly referred to as the "Chip and PIN" method)
In my country, the contactless procedure either has the transaction go through (under the limit) OR prompts for the PIN (over the limit). No need to do contactless, get denied and try again with swiping+PIN.
... from season to season for those of us who work outdoors. In the winter my fingers are swollen, broken, cracked, and cut. I have been unable to use the fingerprint feature of my pixel 2 since it was new. I have no reason to believe this card would work any better.
Let alone anyone with water retention issue.
Yup, I know... I have the key now for access to secure rooms... Fingerprint readers do not work for me, 98 out of 100 times.
With body moisture constantly changing from hour-to-hour, from dehydrated to enlarged legs, the readers frozen "picture" of my fingerprints just do not match. Most fun is showing to the security people, record in the morning, an hour later, I cannot open the door. They have tossed the hands in the air, going "this cannot be happening!".
Tech is fun.
This is completely stuid.
If you use a password, you can always change it if somebody gets it, but you can't change your fngeprint once that's out in the wild. Or your voice, or Retena or DNA.
NEVER let a bank have that kind of control over you.
is that you can't change your finger prints. It's like being locked in from birth with just 10 passwords. Unless you start scarring your finger tips to change them, but even that is not reliable.
FTFA :
Currently, anyone can make a contactless payment in the UK by tapping their card on the terminal to make a payment.
Nope, that should read :-
Currently, anyone can make a contactless payment in the UK by tapping anybody's card on the terminal to make a payment.
That the trouble : with existing cards, if I accidentally dropped one without noticing, someone might use it for weeks (keeping under £30 per purchase) before I noticed at the next statement, because I have many different cards for different purposes. UK police say that the typical use of a stolen contactless is about £100-£600 (in one bizare case it was about £30,000). Thieves act fast, and you are unlikely to get money back from the bank if you take more then a few days to report it lost.
Anyway, why not apply this fingerprinting for any purchase, not just >£30 ?
I didn't even think about it.
Someone who doesn't have the right print tries it? Does it just not work at all, or does it only allow the £30 limited option?
I know an inordinately large number of people who effectively share their contactless card with their spouse/partner (just nip into the shop and pick something up for me will you please?) and it's going to cause some major behavioural changes if they suddenly can't do this any more.
"How fine you look when dressed in rage."
So instead of just stealing your card, a thief will now chop your fingers off?
I don't know about in Britain, but here in the US there is significant more risk in using a debit card that there is a using credit card. If a debit card is misused, your money is gone or tied up until the situation is resolved, whereas with a credit card, the credit card company's money is tied up. In the case of a misuse or compromise of a card, you have a lot more consumer protection with a credit card. You have a better chance of conveniently getting a dispute resolved with a credit card. I would worry that in the case of a dispute on a card with a fingerprint sensor, you would have fewer options to contest a charge because the biometrics would be perceived as strong (even if they aren't actually.) I would hate to lose the consumer credit card protections I have due to biometrics.
but it's much more secure than a PIN that someone could learn by simply looking over your shoulder as you enter it.
Also reminds me of working retail. We got new card readers that had little covers that hid the buttons. We'd have ladies come in to use their debit card go: "WHY WOULD YOU PUT THIS ON HERE IN THE WAY ITS LIKE YOU DON'T WANT ME TO SEE THE NUMBERS WHEN I TYPE THEM IN." Never mind the fact that they were also standing almost on top of the keypad when they did this.... move back 1 foot and GASP, numbers! I told some lady it was so other people couldn't look around her and steal the PIN and her response was: "Why would I care about that?"
"...they're trying changes the two factors to two things that you have."
Nope. The card is something you have, and the fingerprint is something you are. That makes a reasonably secure 2FA system. Classic 2FA chooses from any 2 of:
1). Something you have;
2). Something you know;
3). Something you are.
You missed #3.