Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
1–10 of 64 posts
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#2No.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#3will Android platforms move to similar technology or find an easier way through NFC to make mobile payment security relevant
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#4I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#5I don't know why people think Apple will i) add NFC support to iPhone or ii) enter the payments space.
- iBeacons are much more versatile than NFC and Apple owns and drives the specification.
- CC processing is a ultra-low margin business and there are other more lucrative markets they should address before considering payments.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#6I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.
Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#7This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that the banks will jump on this as a way of limiting their fraud liability. (I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer.)
To dumb it down: I'm envisioning a crappy future where you'll end up with fraudulent charges on your credit card (via your Apple account) that you can't contest because the credit card company will say "Hey-- your fingerprint was used to authenticate this charge. Therefore you did it." I don't think that line of thinking is too cynical.
No quantity of assurances from Apple about how the fingerprint reader will be "firewalled" from third-party access will convince me. If the hardware and software were opened up for third-party analysis I might be convinced, but I really don't think that's going to happen.
This fingerprint reader amounts to a complex hardware and software system with a lot of moving parts. It will have exploitable bugs and will be hacked. I think it will ultimately used to defraud, too. Thinking about the mass harvest of fingerprint data from the public by an attacker (like, say, the NSA) also gives me the willies. Will it be possible for an attacker to steal fingerprint data and use it to compromise other biometric authentication systems? Will it be possible to use stolen fingerprint data to plant your fingerprints at a crime scene? How do you recover from the theft of biometric data? Are you issued a new thumb?
To be clear: I hate the current system of "secret numbers" embossed on plastic cards and encoded on magnetic stripes as a way of authenticating payments. At least, though, the plastic cards aren't battery-powered general purpose computers with radios attached to them. Bad as little bits of plastic and "secret numbers" are, my credit cards themselves can't betray me. A phone (or other sufficiently complex computer system) acting as my payment token most certainly could (and will).
As an aside: I don't have any RFID-chipped credit cards, nor will I. When I end up having no choice in the matter I'll microwave the cards before using them.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#8I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.
The sensor is epi-dermal, which means reads underneath the skin, so it does not solely rely on seeing the prints. There is a steel ring, which probably senses capacitance. Will there be exploits? Probably. Are Apple engineers incompetent to think of obvious exploits? I would put my money on NO.
In any case, I would like to see the evolution of this tech.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#9This fingerprint sensor and its potential use for payments is rather disturbing to me. I am (rightly, I would argue) apprehensive about general purpose computers acting in a "trustworthy" manner. I hope that this fingerprint sensor, which undoubtedly will be incorporated into authentication for payment systems, doesn't usher in a future of reliance on a fundamentally untrustworthy device. I really, really worry that…
> I'm thinking about how chip and PIN has been cited as a way to move fraud liability to the consumer.
Banks can't do this. Since security researchers managed to fool they bank into believing a transaction was PIN verified while not actually being the case, banks have to prove that a transaction was PIN verified, and I believe physical access to the card is required to do this.
> To dumb it down: I'm envisioning a crappy future where you'll end up with fraudulent charges on your credit card (via your Apple account) that you can't contest because the credit card company will say "Hey-- your fingerprint was used to authenticate this charge. Therefore you did it." I don't think that line of thinking is too cynical.
This is not going to happen unless there is an unimpeachable way to prove that the transaction was signed with a fingerprint. Since Apple have said that fingerprint data will not leave the device and is stored separately in a HSM-esque manner, I'm interested to know how this could be done.
Re: Apple's fingerprint scanner may be the biggest leap in payments since the C-Card
#10I think security via fingerprint may be a mistake. What happens if someone gets a copy of your fingerprint, what do you do for security at that point? get a new fingerprint? The NFC Ring is a better idea than fingerprint security. i think the idea will fall short of good security quickly. This is all speculation, and I am by no means an expert on security.
Many people have proposed using biometrics to authenticate people to servers, but that's not what Apple is doing. Your fingerprint only authenticates you to your phone. So someone would have to copy your fingerprint and steal your phone to commit fraud. And if your phone is stolen, the fingerprint just needs to secure your phone long enough until you can remotely wipe it.
A stolen phone is likely to be covered in fingerprints. A small piece of sellotape and the thief has your world at their fingertips.