MSE News: Keep forgetting your PIN? Fingerprint recognition cards on the way

http://zwipe.com/news/mastercard-and-zwipe-announce-the-launch-of-the-worlds-first-biometric-contactless-payment-card-with-integrated-fingerprint-sensor/

The name of the Norwegian bank involved, Sparebanken, doesn't fill be with confidence.

What a terrible idea. Fingerprints should be used like usernames, not passwords!

http://blog.dustinkirkland.com/2013/10/fingerprints-are-user-names-not.html

The prevailing opinion from security professionals is that fingerprints are perhaps a good replacement for usernames. However, they're really not a good replacement for passwords. Consider your laptop... How many fingerprints of yours are there on your laptop right now? As such, it's about as secret as your username. You don't leave your password on your spacebar, or on your beer bottle :-)

Mirno wrote: »

Two factor authentication is based on the idea that you're proven to be there, and proven to actively consent to the payment.
Having the card proves you're there, and the PIN proves you're giving consent.
Changing from a PIN to a finger print changes things so you prove you're there, and then the second factor proves you're there again.

It seems like they've missed the point with this idea.

How does it not prove you are consenting? Its presumably still a two step process as the Apple Pay finger print payment is? Present your card first and secondly present your thumb.

Ok, there is a slightly higher chance of you presenting your card and subsequently "randomly" resting your thumb on the reader and it being read but thats a bit of a stretch.

Obviously you could be coerced into putting your thumb on the reader but then you can coerced into entering your pin too.

There are different technologies of how "finger print" reading can work from the norm of just looking at the print itself to actually reading the blood vessels under the skin. Without knowing exactly what is being used its hard to predict its security. With the Apple Pay it uses the existing TouchID technology which has already shown to be able to be bypassed with fake prints - though those that did bypass it did say in real life situations it would be fairly difficult to get a good enough clean print from the phone itself as its normally covered in them thus damaged.