Apple's fingerprint scanner may be the biggest leap in payments since the C-Card • Hacker News Board

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#11

Post by wmf » Tue, Sep 10, 2013, 9:23 PM UTC

EvanAnderson wrote: post #7

This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that…

It's not always that bad. For example, Google Wallet doesn't run on Android; it actually runs on a separate secure chip. I don't know what Apple is doing but I wouldn't be surprised if it's similar.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#12

Post by cremnob » Tue, Sep 10, 2013, 9:23 PM UTC

EvanAnderson wrote: post #7

This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that…

This is the argument people made against Chip and PIN credit cards yet they are widely used all over the world with no problems. You don't use them, that's cool. But a lot of people do and it works great, and more importantly it's more secure than the pure magnetic stripe cards.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#13

Post by iand » Tue, Sep 10, 2013, 9:23 PM UTC

wmf wrote: post #6

mrt0mat0 wrote: post #4

I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.

Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.

Once your fingerprint is compromised, you can never rely on it again.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#14

Post by mrt0mat0 » Tue, Sep 10, 2013, 9:24 PM UTC

wmf wrote: post #6

mrt0mat0 wrote: post #4

I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.

Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.

"What the fingerprint sensor may actually deliver is the biggest leap forward in mobile payment technology that we’ve seen since the credit card."

This article is saying that though that's all it does now, it will be the new payment process. I just don't see that happening.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#15

Post by swamp40 » Tue, Sep 10, 2013, 9:32 PM UTC

iand wrote: post #13

wmf wrote: post #6

Earlier quoted context omitted.

Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.

Once your fingerprint is compromised, you can never rely on it again.

But you have ten fingers...

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#16

Post by swamp40 » Tue, Sep 10, 2013, 9:36 PM UTC

sjtgraham wrote: post #5

I don't know why people think Apple will i) add NFC support to iPhone or ii) enter the payments space. - iBeacons are much more versatile than NFC and Apple owns and drives the specification. - CC processing is a ultra-low margin business and there are other more lucrative markets they should address before considering payments.

I've been watching this space like a hawk for years now.

How did I miss the iBeacon?

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#17

Post by NTDF » Tue, Sep 10, 2013, 9:37 PM UTC

swamp40 wrote: post #15

iand wrote: post #13

Earlier quoted context omitted.

Once your fingerprint is compromised, you can never rely on it again.

But you have ten fingers...

All of which have an impression on the phone, that someone could duplicate.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#18

Post by conductor » Tue, Sep 10, 2013, 9:41 PM UTC

I wonder, are there some kind of hashes for fingerprints or one should store the whole fingerprint in order to reliably match it with another one?

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#19

Post by hornbaker » Tue, Sep 10, 2013, 9:42 PM UTC

iamshs wrote: post #8

mrt0mat0 wrote: post #4

I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.

The sensor is epi-dermal, which means reads underneath the skin, so it does not solely rely on seeing the prints. There is a steel ring, which probably senses capacitance. Will there be exploits? Probably. Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO. In any case, I would like to see the evolution of this tech.

The prefix "epi" means above or on top. Perhaps you're thinking of "hypodermal," which means underneath the skin.

Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card

#20

Post by nicholassmith » Tue, Sep 10, 2013, 9:43 PM UTC

That's a pretty smart argument, must say I agree and it's along the lines of a train of thought I had afterwards. It's all about friction, and how they can minimise it, take the iTunes Store for example and how people used it. We know they sell a lot of music through it, most likely to people who pirated because who wants to buy a CD and rip it, and make sure it has the right tags and art when it's there for a reasonable price. They decreased the friction and it paid off. They did it again with the App Store, and created an ecosystem that allowed a cottage industry for indie developers that only vaguely existed 8 years ago.

Apple excels at reducing friction for users to achieve what they want to achieve, I wouldn't be surprised if they had this in mind even more so than improving security.