Your secret PIN may not be so secret

TalkBack 34 of 34:

« Previous

• Thread View
• Flat View

Biometrics?

The problem is securely associating a person with a link to the system. The real question is "Is this person the account holder?" which decomposes into two questions, "prove yourself" and "what account?". Currently the first is done by PIN, which has been shown to be compromised. Any other password system suffers from the same fundamental weakness, so ultimately we need some unique ID on the Card to test against something unique on the user: biometrics. At that point, the proving status becomes "The user matches the card": the second question then comes into play, "does this card match the account?" Here, I'd prefer a moving target: the client card should carry a code changed by the server each time it's used, so there's no possibility of cloning it. If the two get out of step, then the card's temporarily invalidated until the user can prove his identity at his bank again.
The alternative is that users will end up distrusting all electronic payment systems: they were brought in for the safety of the retail arm, but the risk has been passed to the user, which is unfair. Each time one of my banks starts suggesting it doesn't trust its password systems, I personally already revert to manual rather than upgrading to their key-generators etc whch are functionally no more secure at a systemic level.

Posted by: JelMin   Posted on: 08/26/09 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now