Category: Uncategorized

Not really a classic

15th August 2008by Consult Hyperion1 Comment

[Dave Birch] The ramifications of the MiFare classic shenanigans that we have discussed here before continue to widen.

NXP said that the decision meant that affected parties such as system integrators and operators using MIFARE chips would likely want to review their systems, but that October was not long enough to deal with the problem properly.
[From Oyster card ‘free travel’ hack to be released | IT PRO]

NXP were right to point out that not every single card everywhere in the world needs to be replaced instantly, but our original conclusion that many schemes would need to start planning their upgrade route right away has turned out to be entirely justified. The story is a salutary parable about the benefits of “open” versus “closed” security, with a dash of hubris thrown in, and the need for long-term planning with these kinds of secure transaction systems. You might, by the way, be interested in this Channel 4 News segment on the Oyster card in London, which includes interviews with our friends from Royal Holloway and The Smart Card Group.

Continue reading “Not really a classic”

Economical summit

7th August 2008by Consult Hyperion2 Comments

[Dave Birch] I’m very proud to say that the Digital Money Forum has become an associate of Economist Conferences and we’ve been helping them to put together The Digital Money Summit at The Dorchester in London on 25th November 2008. The folks there have kindly invited a number of Forum friends — including Sandra Alzetta, Jack Selby, Susie Lonie and Diane Coyle — to come along and address a business audience on the state of the digital money marketplace now that more and more consumers are experiencing new ways to pay.

Naturally, there are some obvious areas for them to focus on: The arrival of contactless and mobile payments in the mainstream and the potential for the two them to transform retail payments through the magic of NFC. They’ve asked me to present a reasonably strategic overview of the topic to kick the conference off and I’ve started to put together a few ideas (based on the Digital Money 3.0 discussion we had before). The conference will chaired by Tom Standage of The Economist. You may remember that we gave out a copy of Tom’s excellent book the Victorian Internet to delegates at the Forum a few years ago so it will be real pleasure to meet him and learn from his perspective.

We’re hoping it will become an annual cycle, with the 2-day Digital Money Forum that you know and love in the spring and the 1-day Digital Money Summit targeting a narrower selection of content at a wider business audience in the autumn. I look forward to seeing you there in November and getting your feedback on how we can work most effectively with the Economist guys in the future to deliver a great service to the digital money community.

Continue reading “Economical summit”

Lighthearted? You can judge!

11th July 2008by Consult Hyperion2 Comments

[Dave Birch] Digital Money denizens will undoubtedly have been following the evolving MiFare security story (basically, researchers discovered the secret algorithm used in MiFare Classic products — in quite a clever way, it has to be said) with great interest. The details are not relevant to this post, but you’ll recall that the essence of the story is that some researchers reverse-engineered a MiFare chip to discover the hiterto secret algorithm used to protect chip contents and discovered a weakness that enabled them to obtain keys. NXP were not terribly happy about this, as you might imagine. This problem is potentially serious, because millions of MiFare chips are used for applications ranging from public transport tickets to corporate access control. There is no arguing with their findings, and the inevitable consequence is that the MiFare Classic implementations will need to be replaced with the new MiFare Plus chips when they reach commercial shipment volumes next year sometime. MiFare Plus differs from MiFare Classic in that it uses standard AES encryption: The algorithm is public, and the security of the system relies on keeping the keys secret, which is the preferred way of handling transaction security nowdays. Anyway, last week we heard that

Chipmaker NXP, formerly Philips Semiconductors, is taking Dutch Radboud University to court on Thursday to prevent researchers publishing their controversial report on the Mifare Classic chip.
[From NXP sues to silence Oyster researchers | The Register]

We don’t yet know what the outcome of this was, and I have no idea of the legal rights and wrongs, but I did notice this response this morning:

Dutch semiconductor manufacturer NXP is making a mistake suing Radboud University Nijmegen in the Netherlands, says Karsten Nohl, a University of Virginia graduate student who worked with others to break the MIFARE cryptographic algorithm.
[From Nohl: NXP making ‘terrible decision’ : Contactless News]

I’m very interested in Karsten’s opinions, especially because we’re going to be having a little chat in Vienna at the end of September at Mobile Banking Security. As the brochure says,

In this interview style session, chairman David Birch, Consult Hyperion, will lead a more light-hearted and informal discussion with Karsten Nohl, University of Virginia, about his research team’s experiences of cracking the security of the MiFare chip.

I’m not sure either NXP or Karsten will be especially light-hearted if they are still in court, but I’ll do my best to help.

Continue reading “Lighthearted? You can judge!”

John Letizia, BBA

9th July 2008by Consult HyperionLeave a comment

[Dave Birch] John Letizia is the Director of Government Affairs and Special Assistant to the Chief Executive at the British Bankers Association (BBA). He joined the BBA in July 2005. He is responsible for building strong relations with key people at all levels across UK Government, Parliament and other key stakeholders, and to build and maintain a pro-active representation programme. Prior to joining the BBA, John was Political and Regional Affairs Adviser at a leading manufacturing employers’ organisation. John has also worked for a number of consultancies and has been an Adviser to a Government Minister. In this podcast, John reflects on the BBA’s views of the proposed UK national identity card. Since banks are seen as being key users of such a scheme, these views are important.

Continue reading “John Letizia, BBA”

Laundry bills

19th June 2008by Consult Hyperion1 Comment

[Dave Birch] I’m looking at the tension between financial inclusion and KYC/AML (financial exclusion), specifically in the context of launching new mobile payment schemes in developing countries. My thinking is summed up well here:

Strict KYC norms present a big hurdle: The very people who have most to gain from mobile banking are excluded because they don’t have identity cards, proof of address and other credentials.

One way to deal with this problem would be to allow “KYC- lite” that restricts the amounts per transaction to minimize risks while ensuring that the poor aren’t left out.
[From Bloomberg.com: Opinion]

I’ve argued before — in other fora — for a much stronger KYC/AML break at the low end of the market since it would provide a low-cost means to improve the lives of a large number of the poorest people. The main argument against this, naturally, is that the break might then be exploited by criminals, terrorists and so on. I don’t buy this at all, but do need to address it.

Continue reading “Laundry bills”

It’s crazy, but it might just work

18th June 2008by Consult Hyperion7 Comments

[Dave Birch] Let’s create a vision for a 21^st-century identity card. Let’s create a vision that we can communicate effectively. Let’s create a vision that is founded on minimising the storage of personal data. Let’s create a vision that the public and the government can understand. Let’s create a vision that contains some genuine innovation, some excitement, some potential. But most of all, let’s create a vision that is founded in mass media, because that’s where the British public get their science and technology education from. I would suggest that, as in so many things, Dr. Who should be our guide.

You’ll be familiar, of course, with Dr. Who’s psychic paper. As any devotee of the BBC’s wonderful series knows, the psychic paper shows the “inspector” whatever it is that they need to see. If the border guard is looking for a British passport, the psychic paper looks like a British passport. If the customs officer on Alpha Centuri wants to see a Betelguesian quarantine certificate, the psychic paper looks like a Betelguesian quarantine certificate.

Now that is what I call a vision for an ID card. And what’s more, it will work.

Continue reading “It’s crazy, but it might just work”

Converging world views

11th June 2008by Consult Hyperion1 Comment

[Dave Birch] It looks as if the wider world is finally catching up with the Digital Money Forum’s view of the future. Take a look at these “Top 10 Trends” that I came across while searching for something else. They were put together by market research heavyweights A. C. Neilson, presumably a couple of years ago. Some of these trends may be rather familiar to digital money denizens, but they are still worth surveying…

1. Digital money
According to AC Nielsen, 90% of transactions in the US will be cashless by the year 2020. PayPal already has 63 million accounts, which makes it larger than most national banks,while in Korea during the month of June 2004, 300,000 people purchased cellphones into which you can insert a memory card containing all your financial data. So will physical money soon be a thing of the past? Most observers say yes, but don’t underestimate the power of human nature and tradition.

2. Contactless payment
McDonald’s is testing ‘contactless’ payment technologies in the US (and elsewhere). Just drive-in, grab your goods and drive off. Payment is made automatically by a wireless device on your windscreen linked to your bank account. Mobile phones can and will do much the same thing.

3. Pre-pay and stored value cards
10 million households in the US don’t have bank accounts and many of these use their pay cheques to buy pre-paid credit cards. Around 8.5% of households without bank accounts own pre-paid credit cards but this figure is expected to rise to 25% by the end of 2006. This is one reason why companies like Visa and MasterCard are getting into the act by signing up Rap moguls and singers like Russell Simmons and Usher to put their names on prepaid cards.

4. Private currencies
Pre-pay is a type of private currency in that you can restrict where people spend their money, in some cases to a single brand, outlet or service. This is good news for loyalty and also good (or bad) news for privacy depending on your point of view. For example, parents can give their children pre-paid cards with certain categories or locations locked off. However, the big news in private currencies is what’s happening in the air and in cyberspace. According to the Economist magazine, airmiles are now technically more valuable than the US dollar while over in cyberspace gamers are exchanging cyber dollars for the real thing.

5. Debt
The level of credit card debt in Britain has increased by 73% since 1997. The UK now holds 60% of all credit cards issued in Europe and has 75% of all European credit card debt. Spending on credit cards now represents 11% of GDP and 40% of people say they expect to use their cards more with the advent of new technology. Meanwhile, the amount owed to credit card companies in the UK now stands at GBP £53 billion. Figures for other countries such as the US and Australia are following a broadly similar trend. So what happens if (when) interest rates really go up? Trouble, that’s what.

6. Everyone is a bank
If everyone from supermarkets and search engines to phone companies and airlines offer banking services where does this leave the banks? The answer could be as back office low margin sub-contractors or maybe banks will re-frame themselves as ‘wealthcare’ businesses.

7. Micropayments
Once upon a time people used credit cards for big purchases like holidays. Not any more. Now you can buy a 99cent song on i-Tunes with your credit card or charge your hamburger at McDonald’s to your plastic. In 2004 the average credit card transaction in the US was $67.81. Back in 1999 it was $72.83. Add to this the possibilities created by contactless payment, stored value cards and pre-pay and you have a recipe for radical change in the financial services sector.

8. Proof of identity
With cases of identity theft going through the roof in most countries, there will be a boom for companies and technologies offering electronic and other forms of identity verification. There will also be an increase in products and services aimed at helping people get their identify back after its been stolen.

9. Mobile phones becoming wallets
Have you noticed how fewer people are wearing watches these days? Under the age of 21 a watch is almost a novelty as people use their mobile phones to tell the time instead. And so, the theory goes, phones will replace wallets too as people find it more convenient to carry their cash digitally inside their phones.

10. The death of cheques
Seriously, who under the age of thirty uses cheques these days?
[From What’s Next – Top Trends in Money, banking & insurance]

Yes!

Continue reading “Converging world views”

There’s going to be a BarCampBank London

5th June 2008by Consult Hyperion1 Comment

[Dave Birch] There’s going to be a BarCampBank in London on 5th July 2008 at Sun Microsystems’ offices in the City. The full details are below. I’ll be there — although I’ll be over at OpenTech later in the afternoon — and look forward to seeing you there to. I’ve been looking forward to BCBL and was really pleased to hear from Frederic that it’s all going ahead.

Continue reading “There’s going to be a BarCampBank London”

Silver lining

3rd June 2008by Consult Hyperion1 Comment

[Dave Birch] I happened to be at an IT industry gathering with a question and answer session with someone from the British Bankers Association (BBA). It wasn’t about payments, directly, but about the legislative fallout from the current rash of bank debacles. The session concerned the government’s plans for something called the “The Financial Stability and Deposit Protection Bill” which went out for comment earlier in the year…

Banks have 12 weeks to persuade the Treasury to drop the idea or face a bill that investment bank UBS has estimated at up to £3bn a year for several years.
[From Banking reforms ‘to cost £3bn a year’ – Telegraph]

The government is proposing that deposits will be safeguarded up to some figure — maybe 50K or 100K for individual personal accounts and half a million or so for small business accounts — but we were discussing yesterday, a limit of £35K would cover almost all depositors (save for very rich people such as M.P.s). So, what has this got to do with payments?

Continue reading “Silver lining”

Next generation platform

29th May 2008by Consult HyperionLeave a comment

[Dave Birch] With the U.K. newspapers focussing on ID cards again, now that the shortlist of the only suppliers who wanted to be on a shortlist has been announced, I wonder if it isn’t time to abandon even talking about ID cards, when the practical implementation of identity for the foreseeable future is going to be centred on mobile phones. Since mobile phones can do a great many things that cards cannot, they provide an obvious means to deliver some useful identity services to both individuals and to organisations. Examples might be simple, secure authentication for online services.

Forrester Research analyst Bill Nagel claimed that mobile authentication has taken hold in many countries, and that mobile signatures are a "logical extension… Nearly all of the banks and operators we spoke to said that the technology operates flawlessly and that the experiences of customers who use the system are very good," he said.
[From Mobile signatures given the thumbs up – WhatPC?]

This is an attractive vision. The idea of making the Internet more secure sounds promising at first, but it has many negatives as well. If we make the Internet more difficult to connect to and harder to use, we lose the creative dynamic around it. Therefore, it kind of makes sense to leave the Internet cheap, flexible and insecure and kick the security layer off the end of the Internet and into the phones. Phones start off from a more secure base, because they already have tamper-resistant hardware (ie, the SIM) in place and since this hardware is a general-purpose computer, there is plenty more it can do. This idea fits rather well with the identity-as-utility view that we have been putting forward for some time. The mobile phones works perfectly as the "identity gadget", the universal faucet that we will all use to turn identity on and off (emergency stop: bad analogy detected). We’re hardly the only people working along this line of thought.

From Marco, a great HP paper on Identity-Aware Devices, describing some PoC work HP did with Intel around the Liberty Alliance’s Advanced Client specifications.
[From ConnectID: Identity-Aware Devices]

In the HP paper, they talk about "identity-aware devices", which I rather like as a way of thinking about practical solutions. They point out that in order to function in a sophisticated environment (in this case, a federated identity environment) the identity-aware device needs some kind of trusted module that can function as an identity provider. This is exactly how I see the SIM: there’s no need to invent anything new, just use find a way to get the mobile operators and others to co-operate to implement the kind of ideas that we can all already see are the way forward.

Continue reading “Next generation platform”