[Dave Birch] We’ve long felt that the mobile phone will become the central identity device, the pivot of the emerging digital identity infrastructure. Plenty of other people seem to think the same, so it’s puzzling that organisations that need significant improvements in both the security and the convenience of large-scale identity management are taking so long to exploit the mobile environment. An obvious case in point is banks. Since, in the U.K., everyone who might conceivably bank online already has a mobile phone, one might reasonably have expected mobile phones to become a standard 2FA token for online banking and shopping. It’s not exactly hard to imagine how that might work. But instead, banks have opted for the simple, not end-to-end 2FA that uses chip and PIN cards to generate one-time-passwords (OTPs) for logging in to home banking. Now, as it happens, my bank just send me one of these and I used it for the first time on Saturday. It worked fine, and I didn’t have to remember either my numerical passcode or my secret word. But does it give me security?

Technorati Tags: identity

[Read more...]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

[Dave Birch] There are different groups vying for the “low value” payment market at retail POS. Hence there’s the potential for some real innovation. But what is the “low value” market? I was in a meeting recently where the discussion took an interesting turn. One group of retailers were unhappy with the UKP10 limit (fifteen euros on the continent) for contactless payments in London and the suggestion popped up — which I thought was reasonable — that the low value cut-off might well vary between retailers or categories. But it might also depend on the channel. In the mobile world, the Payforit scheme has a UKP5 maximum purchase value but some operators are already saying that this should be raised to UKP10 (as I’m sure it will be soon) because the fiver limit doesn’t cover a broad enough range of content. We don’t want to end up with a confusing landscape for consumers though: it would, surely, be more sensible to have a universal definition of low-value payment across all channels and categories so that both customers and shopkeepers knew exactly where they stood: if the payment is under X then there’s one set of rules and rights, above X then there’s another set of rules and rights (eg, Consumer Credit Act-style rights). This would also simplify implementation and customer education at the same time.

Technorati Tags: cashless, contactless, retail, SEPA, smart cards

[Read more...]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

[Dave Birch] Solving the real-world problem of identification and authentication is, as we know, difficult. Not simply because we need to find mechanisms for implementing these concepts that are both convenient and cost-effective but because their real-world use is messy. Digital identity has to be able to deliver more than workable home banking login for people like me. In the real world, demands are more complicated. Here’s a good example, put forward by Chris Skinner. He was trying to help is elderly father-in-law sort something out with his bank, so he phoned and told the bank just that. They refused to deal with him on the phone and insisted that his father-in-law write a letter to change the repayments or whatever it was he wanted. So Chris just called back and told them that he was his father-in-law. He was easily able to answer the “security” questions and so got things sorted out quickly. But how will this work in the world of identity cards and biometrics? Or consider a similar, more prosaic case. I’m sure many people use their partner’s ATM card from time to time. Not for any illegal withdrawals, but because they are lazy, or can’t find their own card, or they left it at work or whatever. I’d hate to run round the to ATM at the supermarket because we need some cash only to be told by the machine, “Sorry Mrs. Birch, face recognition failed” (which it would do, by the way).

Technorati Tags: identity

[Read more...]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.