5 ms·

For those who wonder why Mastercard would look at biometric options when we already have things like NFC based payments, here’s a reason: Most payments require

For those who wonder why Mastercard would look at biometric options when we already have things like NFC based payments, here’s a reason: Most payments require at least two factors, e.g. you must be in possession of a card AND know the PIN. Or you must be in possession of a phone AND have it unlocked with your passcode or FaceID, etc. It works well but it’s not perfect. Biometrics like unique vein patterns give you two factors in one. You must be physically present and alive, otherwise your veins would have no blood flowing and there was nothing to capture and secondly your vein pattern must match the “fingerprint” which is you. That’s much stronger authentication than many other schemes and if it was linked to some sort of payment method and potential even identity service then you could not only pay with your biometric but you could also pay for age restricted goods such as alcohol since it would be physically impossible for someone else to use your hand to buy stuff. It’s possible for a kid to use your card and pin or phone and passcode though. So there’s the case for biometrics in the future. EDIT: Also something like a vein driven biometric would also solve the problem of proving that the person was physically at the point of sale and could hugely reduce disputes and fraud. There’s loads of value in these new biometrics if they turn out to work well.

octocop 7y ago
Yeah.. It's most definitely to protect their customers from kid-thieves. The biometric data will certainly be used only for authentication and nothing else.
- dustinmoris 7y ago
  To be fair some biometrics give you the same level of privacy as your bank card. Mastercard doesn’t know any less when you pay by card or NFC. They know where you were, what you buy, how frequently, etc., it doesn’t give them any more or less “tracking” information wether you paid with chip and pin or my scanning your hand. The latter just gives you as a consumer more fraud protection, something which can’t be stolen or forgotten and something which is more convenient. For example you can go to the beach without your wallet. I personally think there is a future in here which is a win for both parties.
  - phkahler 7y ago
    >> I personally think there is a future in here which is a win for both parties. Let's hope that is the future they're after.
  - deleted 7y ago
    [deleted]
  - deleted 7y ago
    [deleted]
m463 7y ago
> There’s loads of value in these new biometrics For consumers, not so much. (consumers are already protected from fraudulent charges, and decreases in fraud will not pay off monetarily for them).
- hrasyid 7y ago
  the cost of that protection is passed over to the consumers one way or the other, I'm sure
  - TeMPOraL 7y ago
    Costs of ubiquitous surveillance will be passed too, as it already is, in a more insidious and harder to track way.
maximente 7y ago
> You must be physically present and alive nice, this will finally solve that extremely awkward present-but-dead user flow.
- onetimemanytime 7y ago
  That was never an issue with credit cards. With their margins they could easily afford a fraud here and there, instead of making card usage more burdensome.
sixhobbits 7y ago
So passwords are also two factors because you must be physically present and have a text input device? Most people I know now access their phone with fingerprint and can transfer fairly significant amounts of money from a banking app on that phone by doing a second authorisation with the same fingerprint. I'm honestly surprised that I've yet to read an account of this attack vector being exploited, but it doesn't seem safe to me.
- dustinmoris 7y ago
  > So passwords are also two factors because you must be physically present and have a text input device? No, password is 1 factor. An input device <> YOUR input device which you had to specifically configure/authorise to enable for NFC based payments or banking on your app. You cannot log in with your FaceID on any iphone which has your bank’s app installed and then do payments. You must have the app on your device and initially authenticate with much stronger credentials before your phone is then permitted to use FaceID subsequently. This is only allowed on the premise/assumption that you would have never done it on a stranger’s device and therefore your personal device or to say the possession of it is seen as an additional factor after initial setup.
- filoleg 7y ago
  Someone could find out your password and use your card. Doubt someone can perfectly steal and use your vein pattern and gait. Remember, biometrics are not supposed to be a replacement for passwords, they are supposed to be an extra auth factor.
hanniabu 7y ago
This exists, it's called BiyoWallet: https://biyowallet.com/ https://biyowallet.com/
- dustinmoris 7y ago
  And here, it’s called Fingopay: https://fingopay.com https://fingopay.com
  - _nhynes 7y ago
    And, more generally, one specific instance is called UnifyID: https://unify.id/ https://unify.id/
zaat 7y ago
I guess that the two factors requirement depends on location, as here I can swipe my card anywhere, and at most I need to do a small squiggle and I'm good. Also, on the net I'm free to use my card, no squiggle required. I do have to provide PII beyond what's on the card, but nothing that is really secret to anyone but me.
- dustinmoris 7y ago
  There’s 3DS and other secure schemes to move away from weak card payments such as the one which you described. Merchants are being penalised with fees for accepting non 3DS or Verified by Visa secured cards at the moment.
  - zaat 7y ago
    I had to search for what 3DS means. You can see in the Wikipedia article that the protocol is still far from being implemented globally . https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure
pritovido 7y ago
>There’s loads of value in these new biometrics if they turn out to work well. And terrible consequences if it is used badly, AND IT WILL BE USED BADLY. Basically is the barcode tatoo of the Nazis. Something that serves to identify you when they want(on the street, bus station, even using telescopes or 500 Megapixel aerial cameras) without you giving your consent, all the time, but automated with computers. I have actually worked on systems like that, IKEA for example tracks their customers with cameras, and it is extremely creepy. I am from Spain and I was drinking moderate alcohol since I was 11 years old, like wine and Cider on the table with my parents. not a big deal. Most of my friends did the same and none of them is alcoholic. On the contrary, we did not need to get drunk in order to feel adult, like all the UK, french, American and german kids(18-22 years old) drinking and fucking in Magalluz like there is no tomorrow because they were repressed all their lives. Your comment portray two main ideas: 1.This is good because "Think of the children". 2.All the problems are technical. Idea number 1 is consequence of a puritan idea of the world, that is debatable. Idea number 2 is the CSI idea, totally wrong. Having worked in security, most security problems are not hackers cracking codes from their computers, but social engineering. Things that happened to us: The boss of a company telling us to improve the security of the company, then this boss using sticky notes with the passwords. Someone telling his-her lover. Prostitutes being hired as spys. Bad people disguised in order to access the system. People on payroll coming from bad guys giving access. In the real world, most problems are not technical. If a kid wants access pornography or alcohol, he will find a way. Like drugs, if demand exist, supply will appear.
- scrollaway 7y ago
  France and Germany have pretty healthy relationships with alcohol. America yes, because of the 21 year old thing and college campus environments. But I'm French and had the same experience as you: drinking red wine at the table once in a while, a sip of this and that, never felt the need to get drunk, alcohol was never a big deal as I grew up.
whiddershins 7y ago
Although you are making great points I think you are double counting. Vein biometrics aren’t any more “two” things than most other biometrics.
danShumway 7y ago
I'm not a security expert, but I really don't think "a living thing walked through the ticket stall" counts as a second metric. A couple of more general objections: First, you're assuming that biometrics can't be faked. This is not a safe assumption to make -- most biometrics can be faked: DNA, fingerprints, even facial recognition. It is entirely possible that gait recognition and vein patterns also fall into that category. In a world where biometrics can be faked, they are strictly worse security than a near-range NFC device, because your biometrics get broadcast all over the place all the time, you can't turn them off, and you can't easily change them if they get compromised. Think about why social security numbers are so bad for security. That same reasoning is why stuff like fingerprints are not a good authentication method except as a (very limited) second-factor. Second, security is only as good as its weakest link. Even if biometric authentication was more secure than an NFC chip, it doesn't matter, because you can't get rid of the NFC chips. Biometric authentication like gait analysis fails for people in wheelchairs, it fails for people wearing dresses, and it fails for anyone who stubs their toe or gets new shoes with different support. Regular people will need to regularly fall back on another authentication method, which is probably still going to be NFC. Biometric authentication works well when it's provided as an authentication shortcut. The real authentication on my phone is the password, but because I'm not too worried about my phone security, I let myself bypass that password with a (less secure) fingerprint reader.
- loa_in_ 7y ago
  You can 3d print vein patterns trivially
kohtatsu 7y ago
I'm comfortable with Apple implementing biometric authentication, for convenience, because I trust them to let me retain control over my data. FaceID data doesn't leave the secure enclave. The For Convenience part is essential: FaceID is a liability to security. It improves usability of the security, which means people will actually use it, but it does not improve the security itself. It does mean that you can use a longer passcode (encryption key) because you only need to enter it on reboot and after enough negatives. (You can also squeeze both top buttons to disable FaceID)
- titzer 7y ago
  > because I trust them to let me retain control over my data. Don't. Any corporation is an unaccountable leadership change away from a total 180 on privacy, and they absolutely will do it if they start to miss their growth targets consistently.
  - kohtatsu 7y ago
    Sure. I won't buy an iPhone without first understanding how it handles my biometrics. Right now they are trustworthy, and I'm happy to hand them my money and use FaceID. Though I'm an optimist in general; I do expect morality of Apple as a corporation. They have shortcomings there, particularly around iCloud backups and China. I wouldn't say I'm naive, I research this stuff a lot, and Apple in particular is a different breed than the likes of Microsoft. Microsoft being a distinctly amoral corporation like a lot of others, as evidenced by not being able to do an offline install of Windows 10 after you've taught it your wifi password (you have to turn off your router or take the computer out of range). Amazon is an example of an even more fucked up corporate organism. Capitalism has morphed into something awful after we stopped expecting morality. I think your pessimism is useless, and serves as an indulgence.
    - titzer 7y ago
      Please don't take my previous comment as some kind of indictment. I appreciate you being conscientious about your decision. > I think your pessimism is useless, and serves as an indulgence. Nah, it's a defense mechanism, and a simplification of my life. One less thing to worry about. I got enough things to worry about, so this actually saves me mental load and reduces the number of dependencies in life.
sailfast 7y ago
Maybe? I would actively resist any attempt and/or never use a thing that required my biometrics to a private party without good reason. Once somebody has them, you're screwed. For life. You can't change that about yourself. Why are we incentivizing people to spoof / fake them? Why are we encouraging people to use these things? Please no. No more biometrics. I will not do it.

octocop 7y ago

Yeah.. It's most definitely to protect their customers from kid-thieves. The biometric data will certainly be used only for authentication and nothing else.

dustinmoris 7y ago
To be fair some biometrics give you the same level of privacy as your bank card. Mastercard doesn’t know any less when you pay by card or NFC. They know where you were, what you buy, how frequently, etc., it doesn’t give them any more or less “tracking” information wether you paid with chip and pin or my scanning your hand. The latter just gives you as a consumer more fraud protection, something which can’t be stolen or forgotten and something which is more convenient. For example you can go to the beach without your wallet. I personally think there is a future in here which is a win for both parties.
- phkahler 7y ago
  >> I personally think there is a future in here which is a win for both parties. Let's hope that is the future they're after.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]

m463 7y ago

> There’s loads of value in these new biometrics For consumers, not so much. (consumers are already protected from fraudulent charges, and decreases in fraud will not pay off monetarily for them).

hrasyid 7y ago
the cost of that protection is passed over to the consumers one way or the other, I'm sure
- TeMPOraL 7y ago
  Costs of ubiquitous surveillance will be passed too, as it already is, in a more insidious and harder to track way.

maximente 7y ago

> You must be physically present and alive nice, this will finally solve that extremely awkward present-but-dead user flow.

onetimemanytime 7y ago
That was never an issue with credit cards. With their margins they could easily afford a fraud here and there, instead of making card usage more burdensome.

sixhobbits 7y ago

So passwords are also two factors because you must be physically present and have a text input device? Most people I know now access their phone with fingerprint and can transfer fairly significant amounts of money from a banking app on that phone by doing a second authorisation with the same fingerprint. I'm honestly surprised that I've yet to read an account of this attack vector being exploited, but it doesn't seem safe to me.

dustinmoris 7y ago
> So passwords are also two factors because you must be physically present and have a text input device? No, password is 1 factor. An input device <> YOUR input device which you had to specifically configure/authorise to enable for NFC based payments or banking on your app. You cannot log in with your FaceID on any iphone which has your bank’s app installed and then do payments. You must have the app on your device and initially authenticate with much stronger credentials before your phone is then permitted to use FaceID subsequently. This is only allowed on the premise/assumption that you would have never done it on a stranger’s device and therefore your personal device or to say the possession of it is seen as an additional factor after initial setup.
filoleg 7y ago
Someone could find out your password and use your card. Doubt someone can perfectly steal and use your vein pattern and gait. Remember, biometrics are not supposed to be a replacement for passwords, they are supposed to be an extra auth factor.

hanniabu 7y ago

This exists, it's called BiyoWallet: https://biyowallet.com/ https://biyowallet.com/

dustinmoris 7y ago
And here, it’s called Fingopay: https://fingopay.com https://fingopay.com
- _nhynes 7y ago
  And, more generally, one specific instance is called UnifyID: https://unify.id/ https://unify.id/

zaat 7y ago

I guess that the two factors requirement depends on location, as here I can swipe my card anywhere, and at most I need to do a small squiggle and I'm good. Also, on the net I'm free to use my card, no squiggle required. I do have to provide PII beyond what's on the card, but nothing that is really secret to anyone but me.

dustinmoris 7y ago
There’s 3DS and other secure schemes to move away from weak card payments such as the one which you described. Merchants are being penalised with fees for accepting non 3DS or Verified by Visa secured cards at the moment.
- zaat 7y ago
  I had to search for what 3DS means. You can see in the Wikipedia article that the protocol is still far from being implemented globally . https://en.wikipedia.org/wiki/3-D_Secure https://en.wikipedia.org/wiki/3-D_Secure

pritovido 7y ago

>There’s loads of value in these new biometrics if they turn out to work well. And terrible consequences if it is used badly, AND IT WILL BE USED BADLY. Basically is the barcode tatoo of the Nazis. Something that serves to identify you when they want(on the street, bus station, even using telescopes or 500 Megapixel aerial cameras) without you giving your consent, all the time, but automated with computers. I have actually worked on systems like that, IKEA for example tracks their customers with cameras, and it is extremely creepy. I am from Spain and I was drinking moderate alcohol since I was 11 years old, like wine and Cider on the table with my parents. not a big deal. Most of my friends did the same and none of them is alcoholic. On the contrary, we did not need to get drunk in order to feel adult, like all the UK, french, American and german kids(18-22 years old) drinking and fucking in Magalluz like there is no tomorrow because they were repressed all their lives. Your comment portray two main ideas: 1.This is good because "Think of the children". 2.All the problems are technical. Idea number 1 is consequence of a puritan idea of the world, that is debatable. Idea number 2 is the CSI idea, totally wrong. Having worked in security, most security problems are not hackers cracking codes from their computers, but social engineering. Things that happened to us: The boss of a company telling us to improve the security of the company, then this boss using sticky notes with the passwords. Someone telling his-her lover. Prostitutes being hired as spys. Bad people disguised in order to access the system. People on payroll coming from bad guys giving access. In the real world, most problems are not technical. If a kid wants access pornography or alcohol, he will find a way. Like drugs, if demand exist, supply will appear.

scrollaway 7y ago
France and Germany have pretty healthy relationships with alcohol. America yes, because of the 21 year old thing and college campus environments. But I'm French and had the same experience as you: drinking red wine at the table once in a while, a sip of this and that, never felt the need to get drunk, alcohol was never a big deal as I grew up.

whiddershins 7y ago

Although you are making great points I think you are double counting. Vein biometrics aren’t any more “two” things than most other biometrics.

danShumway 7y ago

I'm not a security expert, but I really don't think "a living thing walked through the ticket stall" counts as a second metric. A couple of more general objections: First, you're assuming that biometrics can't be faked. This is not a safe assumption to make -- most biometrics can be faked: DNA, fingerprints, even facial recognition. It is entirely possible that gait recognition and vein patterns also fall into that category. In a world where biometrics can be faked, they are strictly worse security than a near-range NFC device, because your biometrics get broadcast all over the place all the time, you can't turn them off, and you can't easily change them if they get compromised. Think about why social security numbers are so bad for security. That same reasoning is why stuff like fingerprints are not a good authentication method except as a (very limited) second-factor. Second, security is only as good as its weakest link. Even if biometric authentication was more secure than an NFC chip, it doesn't matter, because you can't get rid of the NFC chips. Biometric authentication like gait analysis fails for people in wheelchairs, it fails for people wearing dresses, and it fails for anyone who stubs their toe or gets new shoes with different support. Regular people will need to regularly fall back on another authentication method, which is probably still going to be NFC. Biometric authentication works well when it's provided as an authentication shortcut. The real authentication on my phone is the password, but because I'm not too worried about my phone security, I let myself bypass that password with a (less secure) fingerprint reader.

loa_in_ 7y ago
You can 3d print vein patterns trivially

kohtatsu 7y ago

I'm comfortable with Apple implementing biometric authentication, for convenience, because I trust them to let me retain control over my data. FaceID data doesn't leave the secure enclave. The For Convenience part is essential: FaceID is a liability to security. It improves usability of the security, which means people will actually use it, but it does not improve the security itself. It does mean that you can use a longer passcode (encryption key) because you only need to enter it on reboot and after enough negatives. (You can also squeeze both top buttons to disable FaceID)

titzer 7y ago
> because I trust them to let me retain control over my data. Don't. Any corporation is an unaccountable leadership change away from a total 180 on privacy, and they absolutely will do it if they start to miss their growth targets consistently.
- kohtatsu 7y ago
  Sure. I won't buy an iPhone without first understanding how it handles my biometrics. Right now they are trustworthy, and I'm happy to hand them my money and use FaceID. Though I'm an optimist in general; I do expect morality of Apple as a corporation. They have shortcomings there, particularly around iCloud backups and China. I wouldn't say I'm naive, I research this stuff a lot, and Apple in particular is a different breed than the likes of Microsoft. Microsoft being a distinctly amoral corporation like a lot of others, as evidenced by not being able to do an offline install of Windows 10 after you've taught it your wifi password (you have to turn off your router or take the computer out of range). Amazon is an example of an even more fucked up corporate organism. Capitalism has morphed into something awful after we stopped expecting morality. I think your pessimism is useless, and serves as an indulgence.
  - titzer 7y ago
    Please don't take my previous comment as some kind of indictment. I appreciate you being conscientious about your decision. > I think your pessimism is useless, and serves as an indulgence. Nah, it's a defense mechanism, and a simplification of my life. One less thing to worry about. I got enough things to worry about, so this actually saves me mental load and reduces the number of dependencies in life.

sailfast 7y ago

Maybe? I would actively resist any attempt and/or never use a thing that required my biometrics to a private party without good reason. Once somebody has them, you're screwed. For life. You can't change that about yourself. Why are we incentivizing people to spoof / fake them? Why are we encouraging people to use these things? Please no. No more biometrics. I will not do it.