4 ms·

In 1998 Bill Gates (American Banker article, and elsewhere) said that the future of ecommerce was based on replacing passwords with smart cards....hmmm how did

In 1998 Bill Gates (American Banker article, and elsewhere) said that the future of ecommerce was based on replacing passwords with smart cards....hmmm how did that work out :) Remember AMEX Blue? they stopped sending out card readers almost immediately, but continued sending the smart cards out and running TV ads with all sorts of Terminator like special effects to promote how secure its smart cards were. It was a huge marketing success, but the smart card part was never used. Security is an illusion. Actual conversation.... Naive dev: Hey Big Bank, we invented this revolutionary perfect authentication technology! no more hacks! Big bank: why would we want to redirect the hackers to a new attack that we don't understand, cannot model, cannot assign a stable cost to, and would almost certainly expose even worse flaws in other parts of our systems? as long as fraud is between X and Y %, we WANT the attacks to use the current vector. Naive dev: ooooooooooooooohhhhh (world view changes)

martinced 14y ago
...said that the future of ecommerce was based on replacing passwords with smart cards....hmmm how did that work out :) You're totally wrong. Probably because you're living in the U.S., where it's still the stone age from that standpoint. http://en.wikipedia.org/wiki/Smart_card http://en.wikipedia.org/wiki/Smart_card Here in several european countries people are doing just that: - using a Java SmartCard (your identity card) + a card reader (not hooked to the computer) + a PIN to connect to your online bank but ALSO to challenge/response any VISA/credit card transaction. If I'm not mistaken there are about 200 millions citizen in Brazil who have a Java SmartCard as their identity card (as a medical care card I'm sure, identity I don't know for sure). I think it's a bit early to decide that it failed and that it's an illusion. There are probably hundreds of millions of people who are carrying daily a Java SmartCard and using it to perform kinda safer online transactions. MITM attacks over unsuspecting users are still possible using "mocking birds", but it's becoming harder and harder to game the system.
- rficcaglia 14y ago
  Well since it was an article in American Banker, yeah, I'd say that he was referring to the US. Also, thanks for the down vote based on hard facts: "probably hundreds of millions", "kinda safer". http://www.techspot.com/news/51037-trojan-bypasses-two-factor-authentication-steals-465-million.html http://www.techspot.com/news/51037-trojan-bypasses-two-facto... An identity card is not a commerce solution -- there is no cost/benefit analysis for governments, they just decide which vendors should get lots of money (I know, I was one of them! Thanks governments!) We did this in the US and now there are no fake passports here in the US, we win! Ooops... http://www.schneier.com/blog/archives/2006/08/hackers_clone_r.html http://www.schneier.com/blog/archives/2006/08/hackers_clone_... A card reader not hooked to the computer --- nah ,that can't be hacked: http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_... smart card PINs, those can't be hacked: http://blogs.gartner.com/mark-diodati/2012/01/15/deja-vu-%E2%80%93-the-sykipot-attack-on-smart-cards/ http://blogs.gartner.com/mark-diodati/2012/01/15/deja-vu-%E2... For a thoughtful presentation of both sides, try: http://www.kansascityfed.org/PUBLICAT/econrev/pdf/3q08sullivan.pdf http://www.kansascityfed.org/PUBLICAT/econrev/pdf/3q08sulliv... I think you'll see that it concludes much the same thing as I mentioned the banks (here in the US anyway) conclude: the costs are not worth the theoretical "kinda safer" gains in security. Security is a nuanced, no-one-solution-fits-all, dynamic, evolving systems engineering problem. The adversaries are smart, but more importantly have common sense (unlike governments and consumers) - they will exploit weaknesses in the weakest link. Replace passwords with smart cards, no problem - they will go after the next link. The (US and EU) banks know this -- they all employ layered fraud and security measures --- despite consumers who may have unquestioning faith in the perfect security of smart cards. And when you come back in 5 years and payment cards are still NOT being used in the mainstream (US anyway where cost vs. benefit is important), please have the courtesy to up vote.

martinced 14y ago

...said that the future of ecommerce was based on replacing passwords with smart cards....hmmm how did that work out :) You're totally wrong. Probably because you're living in the U.S., where it's still the stone age from that standpoint. http://en.wikipedia.org/wiki/Smart_card http://en.wikipedia.org/wiki/Smart_card Here in several european countries people are doing just that: - using a Java SmartCard (your identity card) + a card reader (not hooked to the computer) + a PIN to connect to your online bank but ALSO to challenge/response any VISA/credit card transaction. If I'm not mistaken there are about 200 millions citizen in Brazil who have a Java SmartCard as their identity card (as a medical care card I'm sure, identity I don't know for sure). I think it's a bit early to decide that it failed and that it's an illusion. There are probably hundreds of millions of people who are carrying daily a Java SmartCard and using it to perform kinda safer online transactions. MITM attacks over unsuspecting users are still possible using "mocking birds", but it's becoming harder and harder to game the system.

rficcaglia 14y ago
Well since it was an article in American Banker, yeah, I'd say that he was referring to the US. Also, thanks for the down vote based on hard facts: "probably hundreds of millions", "kinda safer". http://www.techspot.com/news/51037-trojan-bypasses-two-factor-authentication-steals-465-million.html http://www.techspot.com/news/51037-trojan-bypasses-two-facto... An identity card is not a commerce solution -- there is no cost/benefit analysis for governments, they just decide which vendors should get lots of money (I know, I was one of them! Thanks governments!) We did this in the US and now there are no fake passports here in the US, we win! Ooops... http://www.schneier.com/blog/archives/2006/08/hackers_clone_r.html http://www.schneier.com/blog/archives/2006/08/hackers_clone_... A card reader not hooked to the computer --- nah ,that can't be hacked: http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_12_Miller_NFC_attack_surface_WP.pdf http://media.blackhat.com/bh-us-12/Briefings/C_Miller/BH_US_... smart card PINs, those can't be hacked: http://blogs.gartner.com/mark-diodati/2012/01/15/deja-vu-%E2%80%93-the-sykipot-attack-on-smart-cards/ http://blogs.gartner.com/mark-diodati/2012/01/15/deja-vu-%E2... For a thoughtful presentation of both sides, try: http://www.kansascityfed.org/PUBLICAT/econrev/pdf/3q08sullivan.pdf http://www.kansascityfed.org/PUBLICAT/econrev/pdf/3q08sulliv... I think you'll see that it concludes much the same thing as I mentioned the banks (here in the US anyway) conclude: the costs are not worth the theoretical "kinda safer" gains in security. Security is a nuanced, no-one-solution-fits-all, dynamic, evolving systems engineering problem. The adversaries are smart, but more importantly have common sense (unlike governments and consumers) - they will exploit weaknesses in the weakest link. Replace passwords with smart cards, no problem - they will go after the next link. The (US and EU) banks know this -- they all employ layered fraud and security measures --- despite consumers who may have unquestioning faith in the perfect security of smart cards. And when you come back in 5 years and payment cards are still NOT being used in the mainstream (US anyway where cost vs. benefit is important), please have the courtesy to up vote.