Category: Uncategorized

[Dave Birch] Solving the real-world problem of identification and authentication is, as we know, difficult. Not simply because we need to find mechanisms for implementing these concepts that are both convenient and cost-effective but because their real-world use is messy. Digital identity has to be able to deliver more than workable home banking login for people like me. In the real world, demands are more complicated. Here’s a good example, put forward by Chris Skinner. He was trying to help is elderly father-in-law sort something out with his bank, so he phoned and told the bank just that. They refused to deal with him on the phone and insisted that his father-in-law write a letter to change the repayments or whatever it was he wanted. So Chris just called back and told them that he was his father-in-law. He was easily able to answer the “security” questions and so got things sorted out quickly. But how will this work in the world of identity cards and biometrics? Or consider a similar, more prosaic case. I’m sure many people use their partner’s ATM card from time to time. Not for any illegal withdrawals, but because they are lazy, or can’t find their own card, or they left it at work or whatever. I’d hate to run round the to ATM at the supermarket because we need some cash only to be told by the machine, “Sorry Mrs. Birch, face recognition failed” (which it would do, by the way).

Technorati Tags: identity

Continue reading “Making digital identity solve real-world problems”

[Dave Birch] Payments, just like every other business, are acquiring a green tinge as the marketing folk get to grips with the low carbon economy. There have been some efforts before — some of you may remember that “Visa Swap” earlier in the year — and I’m sure there will be more of these (rather limited) initiatives to come. It’s not transparently obvious to me that this sort of thing makes much of a difference to consumer behaviour but I’m sure every little helps. Consumer research from PricewaterhouseCoopers found that more than half of respondents would be likely to replace their existing credit card with a ‘green’ credit card if it helped them tackle their carbon footprint and two in five said they would give up an existing loyalty programme or cash reward card in favour of a green alternative. I know consumers’ revealed preferences may be at variance with their environmental aspirations but you can see the trend building. Surely, a truly green credit card would be one that allowed you to buy organic tomatoes but not a flight to Spain. We haven’t got that far yet, but Barclays has launched a carbon-offset corporate card. Barclaycard Business manages the process on behalf of corporate customers by providing them with commission-free access to the Certified Emission Reduction Market via Barclays Capital’s Emissions Trading Desk. So Barclaycard tell you how much your employees have been spending on air travel and then you can buy carbon offsets to match them and assuage your environmental guilt at allowing them to fly so much.

Technorati Tags: cashless, green, payments

Continue reading “Greens back”

[Dave Birch] I went to Dublin for a client of ours to give a talk about the future of payments. One of my favourite sites for helping me to think about such things is Paleo Future. It’s a super blog all about past views of the future, if you see what I mean. Not only is it fun, but it contains some tremendously relevant information that ought to help us (by which I mean people trying to understand the relationship between technology and business) improve and refine our own views of the future A great example was the recent posting about a New York Times Magazine advertisement from 24th May 1964 about the “credit card ring”. It’s actually an advertisement for Sheaffer Pens, but it features a ring that projects and American Express card. The gist of the advertisement is that your credit card of the future may not actually be a physical card any more, but you will still need to sign for it. It’s fascinating to reflect on how wrong this is: my credit card still looks like a credit card, but I haven’t signed for it in a couple of years (except in, if I remember correctly, Tunisia and the USA: no, wait, the hotel in Tunisia had an EMV terminal).

Technorati Tags: credit cards, future

Continue reading “Future imperfect”

[Dave Birch] Apart from having one of the best URLs on the interweb, xmlgrrl Eve Maler also has a splendidly useful PDF containing a set of diagrams that give an overview of the relationship between SAML, Liberty, Cardspace and so on. Well worth downloading.

Technorati Tags: identity, management

Continue reading “The Tr* scheme”

[Dave Birch] As I’ve constantly complained, what should one do if one is (broadly speaking) in favour of some form of smart identity card to bridge the worlds of physical and virtual identity, but one is (broadly speaking) against the government’s proposed system? Well, one policy might be to stop reading the newspapers and hope it will all get better. Consider, for example, the Department of Work and Pensions’ attempt to salvage a viable system from the Child Support Agency catastrophe, the Child Maintenance and Enforcement Commission (CMEC), which adds several sticks to beat recalcitrant parents with. There is going to be a ‘name and shame’ web site, credit blacklisting, monitored curfews (possible including electronic tagging) and the confiscation of passport and/or ID card. That’s joined-up government at work, presumably. The Child Maintenance & Other Payments Bill includes powers for the CMEC to disqualify an individual from “holding or obtaining travel authorisation”, with a travel authorisation being defined as a UK passport or as “an ID card… that… has been issued to a British citizen.” This kind of predictable — and tragic (in the sense of inevitable) — mission creep is an consequence of an ill-thought out identity infrastructure that is not up to the demands of a modern society or modern economy. And even if you think that taking away some ID-related privilege is the right thing to do to a deadbeat Dad, the use of the word “confiscation” reveals the basic mindset problem: “they” won’t stop you from renewing a public key certificate, delete an application from the card, change a security level or anything else that might smack of the 21st century, “they” will confiscate the card. Hey, Parliament, I’ve got 1952 on the line and they want their ID card back…

Technorati Tags: ID cards, management

Continue reading “Giving identity cards a bad name”

[Dave Birch] I’ve been reflecting on a very thought-provoking post on Linkdump. It concerns the attempts by some governments to stop ‘unlawful betting practices’ by demanding that the banks that execute the payments block them. Now, obviously, I don’t want to get into the moral or political aspects of this issue (which are not the concern of the Forum or this blog) but I do want to draw your attention to Linkdump’s perspective:

Well, if we go down this road and allow our governments to dictate which payments which customers may send/acccept (and instruct our banks to act accordingly), we may as well make the Treasuries our single national payment institution. This is what in my view will happen.

Interesting idea. And once we have smart national ID cards, is may become an irresistible attractor for government. If there was something like PayPal (say UKPal or Bank of England Pal) so that everyone in the U.K. had an automatic account of the form “idnumber@ukpal.co.uk”, then the overall cost of the national payment infrastructure would surely fall? Nevermind BACS or FPS, if I wanted to send my brother fifity quid then I’d securely log in to Bank of England Pal using my ID card and instruct an instant transfer. What’s not to like?

Technorati Tags: e-purse, payments, privacy

Continue reading “Bank of England pal”

[Dave Birch] According to recent APACS figures, total card fraud losses on U.K. issued cards went up by a quarter in the first half of this year. This increase has been driven by a 126 per cent rise in fraud on U.K.-issued cards being used overseas (U.K. retail losses were down 11 per cent, U.K. cash machine losses down 57 per cent). The U.K. has long been Europe’s biggest exporter of card fraud, so it’s good to see that our smooth and successful EMV transition has helped us to remain the league leaders. Losses from online, phone and mail order shopping fraud have continued to increase year-on-year but the fraud to turnover ratio on online card transactions has continued to fall. In the U.K. it’s now down to 50 basis points. For comparison purposes, total fraud in a typical card portfolio is about 6 basis points and bad debt is about 600 basis points.

Technorati Tags: ATM, fraud, payments

Continue reading “We’re no. 1”

[Dave Birch] Biometrics continue to advance in Japan with the news that Hitachi is teaming with Japanese issuer JCB to develop a biometric payment system based on its finger vein authentication technology that can be used as an alternative to cards and cash at the point of sale. Hitachi is set to begin testing the system with 200 employees in September to determine whether the technology is commercially viable for introduction in banks and shops. The system identifies the veins on a person’s finger when it is held over a scanner and matches the image with customer data already stored in the application. The vein authentication system has been available in the Japanese market since October 2006 and has already been deployed by Sumitomo Mitsui Banking Corporation as the user ID system for ATMs located in am/pm convenience stores throughout Japan, which is why I thought the technology deserved its own podcast. Japan isn’t the only place where biometrics are being rolled out in this way. Banks in India are looking at deploying biometric ATMs targeted to reach the unbanked population in rural India. Using thumbprint and voice guidance in ATMs reduces literacy requirements to a considerable extent. Thus, establishing the identity of a rural depositor through biometrics makes it possible for illiterate or barely literate people to become part of the banking user community.

Technorati Tags: ATM, biometrics, payments

Continue reading “Fingering suspects”

[Dave Birch] One of the reasons by the British government’s IRIS scheme — which allows frequent travellers such as yours truly to enter the country via iris scanner instead of showing a passport to an immigration person (or, at least, theoretically does so: I’ve given up using it because it never works) — is so bad is because it is attempting to match against a large and growing database. This means that certain parameters have to be set to position the FAR/FRR curves in particular ways: if there’s a doubt, keep him out! If, on the other, you are matching a biometric template one-to-one against a securely stored templates, you can set the curves to be more tolerant, more workable in real world situations. An example of how the IRIS probably should have worked. Nevertheless, the biometric authentication market continues to grow steadily, with interesting new implementations coming along all the time. One that caught my eye is the system being installed at The Venetian Macao, the world’s largest casino, has deployed 13 VisionAccess 3D Face Readers in order to authenticate 12,000 employees at the front entrance when a new shift starts. Bioscrypt’s 3D face reader is a hands-free biometric solution that authenticates users in under a second by matching the structure of the person’s face against their enrolled template (ie, a one-to-one match). The readers function by shining a near infrared grid pattern on a user’s face. A camera then takes a picture of the resulting distortions in the grid pattern to match against the template, which is stored in a contactless smart card (typically kept in a hip pocket). That’s the way to do it.

Technorati Tags: biometrics, identity

Continue reading “Full house”

[Dave Birch] One reason for increased interest in identity management is the increasing interest that regulators are taking in the systems used to control information access. Yet there’s a common theme throughout many of the posts I read about identity infrastructure. No-one is really sure what identity (or management) is, they buy products hoping to solve problems that they patently weren’t designed for and then get disappointed when they don’t work. I don’t think it’s unduly cynical to suggest that some regulators may find themselves in this position, because they are too easily seduced by the promise of identity management technology: whatever the problems (ie, children, dogs or foreigners, to use current U.K. examples) the solution appears to be to build a register of them. Once they are identified, the problems will be under control.

Technorati Tags: identity, management, regulation

Continue reading “What the business school guys call “non-market drivers””