4 ms·

Giving away biometric data like this seems like a very poor trade-off compared to just pulling out your phone or card. More secure? More hygienic? Come on...

by dfxm12 4y ago

KennyBlanken 4y ago
Any arguments about security they make are pretty weak given how badly they screwed the pooch on NFC. It's comically bad. Stuff like "oh, it's cool, we'll just trust the device to auth the user", allowing NFC to have a higher spend limits, readers using the same seed for encrypted sessions...
- guerrilla 4y ago
  What now, this sounds terrible. I'll have to read up on it.
- Nextgrid 4y ago
  MasterCard and most other card networks are happy to shift fraud liability onto the banks and/or merchants. Why should I care as a user that the system is technically insecure if I’m not actually put at risk? I also don’t see the problem with your own device authenticating you - I trust my device more than a random terminal onto which I’m supposed to type a PIN. When it comes to spend limits, this is primarily down to merchants - they are in control of their terminals and can choose to reject (or ask for additional auth - mobile contactless + PIN is technically possible for example) any method if it doesn’t fit their risk appetite. Most merchants choose to allow even completely insecure methods (card-based contactless with no CVM) because in practice the convenience for the prospective shoppers offsets the cost of fraud.
- maccard 4y ago
  The security on a card is really via policy, not via technical security. It doesn't matter how secure your encryption is if you are susceptible to a wrench attack [0]. As long as the bank accepts liability for NFC payments while vehemently denying any liability if you share your pin, it doesn't really matter how technically good their security is. [0] https://xkcd.com/538/ https://xkcd.com/538/
- r0snd0 4y ago
- lxgr 4y ago
  What specific vulnerabilities are you referring to?
cm2187 4y ago
Plus I suspect you will still need to pull your card. Biometrics sort of work when you are trying to match one user with one face (authenticate on a computer). But if you are searching a face among a billion users, you will get false positives, not the least because of twins. So you still need a way to tell your ID to the system.

Giving away biometric data like this seems like a very poor trade-off compared to just pulling out your phone or card. More secure? More hygienic? Come on...

by dfxm12 4y ago

Giving away biometric data like this seems like a very poor trade-off compared to just pulling out your phone or card. More secure? More hygienic? Come on...

KennyBlanken 4y ago

Any arguments about security they make are pretty weak given how badly they screwed the pooch on NFC. It's comically bad. Stuff like "oh, it's cool, we'll just trust the device to auth the user", allowing NFC to have a higher spend limits, readers using the same seed for encrypted sessions...

guerrilla 4y ago
What now, this sounds terrible. I'll have to read up on it.
Nextgrid 4y ago
MasterCard and most other card networks are happy to shift fraud liability onto the banks and/or merchants. Why should I care as a user that the system is technically insecure if I’m not actually put at risk? I also don’t see the problem with your own device authenticating you - I trust my device more than a random terminal onto which I’m supposed to type a PIN. When it comes to spend limits, this is primarily down to merchants - they are in control of their terminals and can choose to reject (or ask for additional auth - mobile contactless + PIN is technically possible for example) any method if it doesn’t fit their risk appetite. Most merchants choose to allow even completely insecure methods (card-based contactless with no CVM) because in practice the convenience for the prospective shoppers offsets the cost of fraud.
maccard 4y ago
The security on a card is really via policy, not via technical security. It doesn't matter how secure your encryption is if you are susceptible to a wrench attack [0]. As long as the bank accepts liability for NFC payments while vehemently denying any liability if you share your pin, it doesn't really matter how technically good their security is. [0] https://xkcd.com/538/ https://xkcd.com/538/
r0snd0 4y ago
lxgr 4y ago
What specific vulnerabilities are you referring to?

cm2187 4y ago

Plus I suspect you will still need to pull your card. Biometrics sort of work when you are trying to match one user with one face (authenticate on a computer). But if you are searching a face among a billion users, you will get false positives, not the least because of twins. So you still need a way to tell your ID to the system.