MasterCard to launch biometric checkout tool for retailers
retaildive.com
retaildive.com
More secure? More hygienic? Come on...
It's comically bad. Stuff like "oh, it's cool, we'll just trust the device to auth the user", allowing NFC to have a higher spend limits, readers using the same seed for encrypted sessions...
I also don’t see the problem with your own device authenticating you - I trust my device more than a random terminal onto which I’m supposed to type a PIN.
When it comes to spend limits, this is primarily down to merchants - they are in control of their terminals and can choose to reject (or ask for additional auth - mobile contactless + PIN is technically possible for example) any method if it doesn’t fit their risk appetite. Most merchants choose to allow even completely insecure methods (card-based contactless with no CVM) because in practice the convenience for the prospective shoppers offsets the cost of fraud.
The difference between "please drink the verification can" 4chan copypasta and real life is a few years apparently.
As long as there's a choice to use cash, digital alternatives will have to compete against reality rather than narratives.
USD in circulation continues to increase: https://fred.stlouisfed.org/series/CURRCIR
It’s not exactly a realistic threat that someone steals your phone and builds a model of your face to use at a retail checkout.
I could see biometrics being used as an alternative to card pins where you tap your card and then scan your hand. This would be more secure than the current system where you can tap under $200 with no authentication.
These were all non realistic threat.
This makes me very conservative with all these integrations and more software running and databases to just make it more convenient than a 4 digit PIN.
They still are. How many stories are there of people actually having their cars stolen via remote relay attacks? It gets demoed a lot in proof of concepts but I have never heard of it being actually executed. Why on earth would someone build fake fingerprints when they can just walk in to a designer handbag store with a knife, grab a few bags, and resell on facebook market place.
Credit cards don't _need_ bulletproof security, they just need to be secure enough. Fraud can often be reversed and fraudsters don't get away with it many times since there is CCTV in every location that takes card. The card companies would rather opt to eat the losses on any non reversible fraud because the profits of a friction less user experience is worth more.
I have a hard time believing that the gas station down the street is going to adopt high quality scanners that can process my handprint faster than I can type my PIN.
I don't know how 'leaky' the hand print scan is meaning how much MasterCard learns from the scan. But imagine if they could figure out which people were more susceptible to buying say alcohol or coffee when they examine the hand print and then displaying an ad to get the person to make a last second purchase that is targeted to that person.
MasterCard can already track your location by seeing where you are buying things and they can watch your purchases which is a lot but who knows what can be learned from a hand print scan. But I think also hackers are very motivated so the security issues are probably understated.
Don't have your card/phone on you? No worries! We can still force your hand to withdraw money
If it's just that they hold a gun to your head and make you authenticate with your palm, then they can do that right now. Once the gun is to the head you're kinda compelled to do what they're saying regardless of whether you authenticate with biometrics, password, whatever.
…does that not seem incredibly convoluted? And not even that damaging for you, it’s obviously and clearly fraudulent, you’d have no issue getting the chargeback.
Worse is if everyone uses the same hash as MasterCard. Say, the IRS, or the passport office, or the police. That's outside the scope of your question, though, which was if only MasterCard had the hash.
[1] https://www.theguardian.com/us-news/2021/sep/16/geofence-war...
I tell you, this biometrics stuff, we need to watch out...
A 1/1,000,000 chance of falsely matching a face is a non-issue for payment validation. For a law enforcement search, it means the computer will auto-fabricate local suspects.
Prosecutors in the US are judged on conviction rates. They have no incentive to worry about bogus matches. (And the ones that don't let such things slow them down tend to be promoted.)
- The US Supreme Court (more or less)
Facial recognition, on the other hand, is annoying as hell. Apple Face ID is seemingly one of the better systems, but I’ve used Windows Hello as well as Face ID and I can honestly say I hate both of them. They’re both solutions to problems I really do not believe anyone had. Like a lot of other “magic” security primitives such as passive proximity keys, facial authentication systems fail to validate intent. Fingerprint sensors are also a lot worse than passwords in this regard, but facial recognition authentication is absolutely ridiculous. I can accidentally unlock Windows Hello from halfway across the room. If my cat is about to walk on my laptop, I would like to lock the screen, but if Windows Hello is enabled, tough shit, as the moment keys are pressed it will try to find your face and unlock. At least Face ID tries very hard to ensure you’re looking at the device; if Windows Hello is trying to ensure that, it is not doing a good job. There’s hardly anything I can do to prevent the laptop from accidentally unlocking.
Fingerprint authentication is still not ideal, so I think it should be limited to things that don’t need as much physical security. I think that it’s fair to say sudo prompts and screen unlocking are decent candidates. Even in the case where you have very advanced adversaries, at a certain point I wager the weakest link is going to be something else, and you are going to want to try to keep them physically separated from the machines if you want to stand a chance.
Then again, I’m not a security person.
That said, I think anti-virus is still a bigger meme.
* it doesn't work if your finger is even slightly wet, so using it while in the kitchen is annoying (like when trying to consult a recipe.) Even if you wipe your hands on a towel or your pants, it still might not work
* it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc.
* it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike.
To be fair, this one genuinely varies per fingerprint sensor. Some of them work under surprisingly bad conditions.
> * it doesn't work if you're wearing latex/nitrile gloves, like when cleaning, or doing car work, etc.
True.
> * it doesn't work if you're wearing gloves, which is a borderline necessity 3-4 months out of the year if you're planning on being outside for more than 5-10 minutes, or if you plan on using your hands for anything while outside. 6+ months out of the year if you're on a bike.
This is really the same thing as the last one, but it depends on where you live. Also, gloves tend to not be great on touchscreens anyways.
My issue with Face ID in particular is that it does not immediately show a PIN unlock, which means when it isn't working quite right you might fumble for a little bit trying to figure out how to get it to stop trying. Also, while it is again totally possible to accidentally unlock with fingerprint if you are not careful, it is hard to _not_ unlock with facial recognition on accident.
(Not to mention, compounding on the problem, the fact that a whole lot of us are wearing face masks in public places right now, and therefore unable to easily unlock our phones with Face ID. Not having a convenient unlock option in public is quite a problem; PIN works, but for example, for payments I'd argue it really isn't ideal, and in public everyone can easily see your PIN when you type it.)
Because of those issues, to me, fingerprint authentication feels like it's mostly a UX positive over PIN alone, whereas facial recognition + PIN is actually worse than just PIN because I legitimately can't avoid a lot of the awkwardness. I mean, anyone can get used to it and deal with it, but I absolutely felt a lot better with Touch ID than Face ID, and I doubt I'm alone on that one.
Same with supermarkets pushing card and having 1 tile (out of 10) for cash.
its tied to your mobile number AND your phone so it "might" not appeal to everyone but still, there are banks who offer it over their internet banking channels so the tech can be used in a browser setting which does help. There is already existing "fraud protection" mandated to banks so its not like the whole "mastercard does that so they need their share". they don't and india is slowly transitioning AWAY from plastic.
this is a "gimmick" i suppose because UPI apps already support using your phone authentication to confirm a payment so yeah...... mastercard does not get this data and they want to make it "cool" to lull banks into shoving the cards down their customers' throats
And What Could Possibly Go Wrong?