Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

peternixey.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#21

Post by kolinko »

swamp40 wrote: post #16
sjtgraham wrote: post #5

I don't know why people think Apple will i) add NFC support to iPhone or ii) enter the payments space. - iBeacons are much more versatile than NFC and Apple owns and drives the specification. - CC processing is a ultra-low margin business and there are other more lucrative markets they should address before considering payments.

I've been watching this space like a hawk for years now. How did I miss the iBeacon?

wwdc 2013, they're in iOS7 which was not yet released - hence to real applications and just a few examples of hardware

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#22

Post by bennyg »

conductor wrote: post #18

I wonder, are there some kind of hashes for fingerprints or one should store the whole fingerprint in order to reliably match it with another one?

I'm imagining they are using a data set of fingerprint points (statistical anomalies), and then using machine learning to get a good statistical model of it when you first set it, and every time after that. I doubt they're image matching directly every time. Add some matrix math for 360˚ transforms and you're in business.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#23

Post by ars »

iamshs wrote: post #8
mrt0mat0 wrote: post #4

I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.

The sensor is epi-dermal, which means reads underneath the skin, so it does not solely rely on seeing the prints. There is a steel ring, which probably senses capacitance. Will there be exploits? Probably. Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO. In any case, I would like to see the evolution of this tech.

> Will there be exploits? Probably.

Not just probably, but definitely and easily.

> Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO.

They may have thought of them, but they didn't solve them for the very simple reason that it's impossible to solve them.

A fingerprint is only secure for causal use (someone picking up your phone), but it's worthless for any more security than that. It's like the face recognition on an android phone - good for causal use, but easily defeated.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#25

Post by fluidcruft »

iand wrote: post #13
wmf wrote: post #6

Earlier quoted context omitted.

Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.

Once your fingerprint is compromised, you can never rely on it again.

Who says you have to actually use your finger?

Why not something disposable you keep on your keychain/ring/necklace/tie/earlobe that looks like a finger to the reader?

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#26

Post by r00fus »

smackay wrote: post #10
wmf wrote: post #6

Earlier quoted context omitted.

Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.

A stolen phone is likely to be covered in fingerprints. A small piece of sellotape and the thief has your world at their fingertips.

I'd really like to see how such an exploit would work before losing sleep over it. Fingerprint tech has moved a long way forward in the past few years. If it doesn't work, we don't need to use it.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#27

Post by sp332 »

sjtgraham wrote: post #9
EvanAnderson wrote: post #7

This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that…

> I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer. Banks can't do this. Since security researchers managed to fool they bank into believing a transaction was PIN verified while not actually being the case, banks have to prove that a transaction was PIN verified, and I believe physical access to the card is required to do this. > To dumb it down: I'm envisioning a cr…

Since security researchers managed to fool the bank... banks have to prove that a transaction was PIN verified

Did banks actually make that change, though? I didn't hear about that part of the story.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#28

Post by swamp40 »

NTDF wrote: post #17
swamp40 wrote: post #15

Earlier quoted context omitted.

But you have ten fingers...

All of which have an impression on the phone, that someone could duplicate.

The scanner scans subdermally, so it's a little trickier than just lifting fingerprints.

I don't deny that it's replicable, just saying that the hacker would probably only have info on one finger.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#29

Post by gfodor »

sjtgraham wrote: post #5

I don't know why people think Apple will i) add NFC support to iPhone or ii) enter the payments space. - iBeacons are much more versatile than NFC and Apple owns and drives the specification. - CC processing is a ultra-low margin business and there are other more lucrative markets they should address before considering payments.

I think Apple's strategy won't be to just go all-in on payments out of the gate. I imagine they will seek out a handful of partners where speed and ease of payment will tangibly affect the bottom line across millions of transactions, and negotiate aggressively to get long-term and deep commitments to the Apple payments system. Think: Starbucks, gas stations, large (large) restaurant/fast food chains, etc. I have a hard time seeing a path where they take in small to mid size businesses as customers.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#30

Post by ris »

iamshs wrote: post #8
mrt0mat0 wrote: post #4

I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.

The sensor is epi-dermal, which means reads underneath the skin, so it does not solely rely on seeing the prints. There is a steel ring, which probably senses capacitance. Will there be exploits? Probably. Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO. In any case, I would like to see the evolution of this tech.

"Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO."

They certainly didn't seem to test whether a phone would get acceptable reception if held in a rather common way.

Post reply on HN