3 ms·

For traditional banks and credit unions, a physical branch is a major component in their 'anti fraud' device and systems. Trained human experts will review doc

For traditional banks and credit unions, a physical branch is a major component in their 'anti fraud' device and systems. Trained human experts will review documents and establish an identity. However those systems also have financial hurdles to access. Someone with a very thrifty banking service, or someone with very little money (paycheck to paycheck poor) would have trouble utilizing such a resource. This is unfair and systemically disenfranchising. I would really like to see a solution to this issue from another part of 'the system' which must already validate someone's identity. A nominal and small fee should be attached, but it should be paid for by the corporation that wishes to ensure anti-fraud activity. In such a circumstance the corporation would be compelled to also accept this validation, or optionally offer others that may be faster if a consumer agrees. An individual under such suspicion would visit a nearby police department. Depending on the level of validation asked for said department might also try to actively contact the individual in other ways to cross-validate. If someone happens to be on vacation at the time this check would necessarily involve two departments (the place the person is at and their home area). Such a system is costly in time for the consumer, and some money for the company. Ideally solutions that don't result in account suspension would be developed to prevent reaching this state; but a good standard for last resort default is necessary to ensure any other solution that survives is better.

3np 5y ago
If we’re talking radical changes, I’d really like to move from authentication-by-flesh to authorization-by-cryptography. Basically as opposed to have party A present identifying and (supposedly) hard-to-know information and biometrics until party B is sufficiently confident that they map to the same physical person.. authorization by cryptographic keys. Like using metamask for authenticating. There will still need to an ecosystem of companies with the kind of services you’re talking about, but there would be a clear distinction between the “vouching” part (attest to a bank that you are who you say) vs “access” part (multi-party key custody and recovery services) So many hairy problems (online payments fraud for example) stop existing in the same way if we move payments from pull to push and access control to utilizing cryptographic signatures. I shouldn’t have to expose my entire identity in order for an online merchant to be sure I won’t bounce the payment. And the scenario OP is describing would never happen.
- notreallyserio 5y ago
  That solves the problem to one extent and makes it worse to another, and definitely doesn't solve fraud to any degree. With crypto, if a scammer cons my parent to hand over their private key, every company that relies on that key can claim that whatever account action occurs is perfectly legitimate and ignore attempts to correct problems -- after all how would you prove the transactions are illegitimate if they're signed? More to the point: how would we prove they're illegitimate better than we can now?
  - 3np 5y ago
    I think that for most people, they would not be directly exposed to key material. They would rely on an enclave in their smartphone, and/or separate tokens a la yubikey. The actual private key used for each company would probably also be different.
  - mjevans 5y ago
    The way I've heard Europe handles banking (debit like) transactions with a monthly settlement list (default approval) comes to mind. Everyone involved in a transaction would declare the perceived value of the transaction (which should agree within fuzzing to account for currency exchange). Everyone would also declare their risk aversion thresholds in advance, publicly (pushed through their bank). A maximum accepted threshold would also be declared by each party (E.G. must settle before X). An agreement of contract would involve the maximum thresholds being less than the cross-referenced risk level. E.G. Seller [ (< 3 days && RANGE_INCLUSIVE 0 USD TO 24.99 USD) || (< 7 days && RANGE_INCLUSIVE 25 USD TO 99.99 USD) || (< 14 days && RANGE_INCLUSIVE 100 USD TO 999.99 USD) || (<33 days && GREATER_THAN 1000 USD) ] Buyer (happens to use the same default list as above because it's popular) Purchase: 105 USD (laptop power adapter) Among both lists that would fall into the 14 day category, so it would go on the books and 'clear' (like a check in the US today, but with a longer time period) in 14 days. That gives someone 14 days to discover an identity compromise, publish the revocation certificate, and this SUSPENDS all contracts made by their key within the published clearance time windows. They may re-sign the transactions they approve with the new "key" (accredited by certificate issuing authorities such as a state or federal government). For any items / services not yet fulfilled suspension of delivery or limited use might be imposed if the contracts are not reauthorized. All of the others would be part of a fraud case (or cases). IMPORTANTLY: to change the published duration of a contract expiration to shorter would require waiting out the whole period, while lengthening it would be 'instant' as soon as the lending institution involved witnessed with their signature (and thus also published the new value).

3np 5y ago

If we’re talking radical changes, I’d really like to move from authentication-by-flesh to authorization-by-cryptography. Basically as opposed to have party A present identifying and (supposedly) hard-to-know information and biometrics until party B is sufficiently confident that they map to the same physical person.. authorization by cryptographic keys. Like using metamask for authenticating. There will still need to an ecosystem of companies with the kind of services you’re talking about, but there would be a clear distinction between the “vouching” part (attest to a bank that you are who you say) vs “access” part (multi-party key custody and recovery services) So many hairy problems (online payments fraud for example) stop existing in the same way if we move payments from pull to push and access control to utilizing cryptographic signatures. I shouldn’t have to expose my entire identity in order for an online merchant to be sure I won’t bounce the payment. And the scenario OP is describing would never happen.

notreallyserio 5y ago
That solves the problem to one extent and makes it worse to another, and definitely doesn't solve fraud to any degree. With crypto, if a scammer cons my parent to hand over their private key, every company that relies on that key can claim that whatever account action occurs is perfectly legitimate and ignore attempts to correct problems -- after all how would you prove the transactions are illegitimate if they're signed? More to the point: how would we prove they're illegitimate better than we can now?
- 3np 5y ago
  I think that for most people, they would not be directly exposed to key material. They would rely on an enclave in their smartphone, and/or separate tokens a la yubikey. The actual private key used for each company would probably also be different.
- mjevans 5y ago
  The way I've heard Europe handles banking (debit like) transactions with a monthly settlement list (default approval) comes to mind. Everyone involved in a transaction would declare the perceived value of the transaction (which should agree within fuzzing to account for currency exchange). Everyone would also declare their risk aversion thresholds in advance, publicly (pushed through their bank). A maximum accepted threshold would also be declared by each party (E.G. must settle before X). An agreement of contract would involve the maximum thresholds being less than the cross-referenced risk level. E.G. Seller [ (< 3 days && RANGE_INCLUSIVE 0 USD TO 24.99 USD) || (< 7 days && RANGE_INCLUSIVE 25 USD TO 99.99 USD) || (< 14 days && RANGE_INCLUSIVE 100 USD TO 999.99 USD) || (<33 days && GREATER_THAN 1000 USD) ] Buyer (happens to use the same default list as above because it's popular) Purchase: 105 USD (laptop power adapter) Among both lists that would fall into the 14 day category, so it would go on the books and 'clear' (like a check in the US today, but with a longer time period) in 14 days. That gives someone 14 days to discover an identity compromise, publish the revocation certificate, and this SUSPENDS all contracts made by their key within the published clearance time windows. They may re-sign the transactions they approve with the new "key" (accredited by certificate issuing authorities such as a state or federal government). For any items / services not yet fulfilled suspension of delivery or limited use might be imposed if the contracts are not reauthorized. All of the others would be part of a fraud case (or cases). IMPORTANTLY: to change the published duration of a contract expiration to shorter would require waiting out the whole period, while lengthening it would be 'instant' as soon as the lending institution involved witnessed with their signature (and thus also published the new value).