3 ms·
> Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage! That's such a naive take on security. Re
by hbrn 4y ago
> Same thing with “pay with your face” they tried in China. They all are susceptible to replay attacks. It is garbage!
That's such a naive take on security. Reminds me of "salt shaker vulnerability": https://www.linkedin.com/pulse/hacker-restaurant-alexander-sverdlov/ https://www.linkedin.com/pulse/hacker-restaurant-alexander-s...
Today, almost any time you use your credit card online in the US, you are susceptible to replay attack. Even PCI-compliant merchant can simply save your payment method for future uses (neither SCA, nor VISA's VAU is being enforced).
What exactly is the attack vector for face payments, if they are not used for P2P payments, only happen in public places with plenty of cameras, and are capped?
Just because it's "possible", doesn't mean it introduces risks that are not acceptable. Sure, you can risk prison time and get a bag of groceries for free. But stealing groceries old-fashioned way is less risky.
- EGreg 4y agoThe same as for the credit card payments you just mentioned (which ARE insecure and naively rely on store clerks not copying your 3 digit number etc). ANY biometrics you use to pay can be easily replayed. Whatever function you derive from these biometrics can be executed when you’re not there. Not to mention that the biometrics themselves can be emulated by a device (eg voice recording) as you see in sci-movies like Minority Report (fake eyes) or that star trek clip. Sure, for smaller amounts and using copious amounts of “seller beware” chargeback protections, the system can work. And those chargebacks can be good for many things, so that is how our financial system works now. But if you want to secure thing that are valuable, like elections and many others, then what I described is the optimal solution.