CSFI Identity and Financial Services

It is a crisis

[Dave Birch] I referred in a recent post to a comment by Adam Banks, the Chief Technology Officer for Visa Europe, that

There really is, as Adam Shaw, the Visa Europe CTO says, a crisis in identity.

[From CSFI Identity and Financial Services]

Given that I'd mentioned this, I thought I'd explain further. Last year, Adam wrote a report on "The Future of Technology and Payments" [PDF, 200Kb] intended as, as he put it, to be a conversation opener to highlight seven technology-related trends that he thinks will have a major impact on the payments business in the medium term (i.e., over the next three to five years). The first six are (my labels and paraphrasing):

1. The continuing inexorable pressure of Moore's Law.
2. The device-formerly-known-as-the-mobile-phone.
3. The ubiquity of networks.
4. The rise of the virtual world.
5. The practical panopticon (and a point about the value of payments data).
6. The global village shop.
7. The crisis of identity.
   

Adam puts these points over clearly and I'm sure that no-one could disagree with his summary of the opportunities and implications (although, to be honest, I did slightly because I used a five-way rather than seven-way categorisation at the Visa Europe Bank Card Business School last year!). But it's is last, and to my mind most powerful, point that I want to focus on. And here I'm using his label and description.

• Crisis of identity. Adam says that traditional identity management models are becoming increasingly unsustainable and there is an opportunity for a collective industry solution and the need for a trusted partner.

To my mind, one of the key reasons why the identity management paradigm needs resetting is that we are taking mundane conceptions of identity and translating them into what Adam calls the "parallel" virtual world. But the virtual world isn't parallel to the mundane: it's different, and notions of identity in that space are not reflections or projections of mundane identity but more powerful, more nuanced and more complex. Adam's conclusions, though, are spot on: if some sort of robust personal identity management (PIM) solution were to be adopted then the implications for the payment industry would be "profound" (not my words: Visa Europe's).

This is why the technologies associated with identity and authentication are so critical, why their exploitation will be disruptive. Visa Europe and its members have to disrupt themselves because of this, and I am convinced that if they don't do it them someone else will. If you've cracked identity and have established a value network around identity management, then payments become, frankly, easy. Identity, though I hate to chant the mantra, is the new money.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Tenth roundtable in the series on Identity and Financial Services

The tenth and final roundtable in the Visa Europe CSFI Fellowship series on "Identity and Financial Services" will be held at the Waterman's Hall, 16-18 St. Mary-at-Hill, London EC3R 8EF, from 12.30pm-2.15pm on 21st February 2012. Download Invitation [PDF 123K].

A number of the earlier workshops in this series have touched on the British (and some other governments) preferred model for public and private co-operation in the identity and authentication space. Broadly speaking, it looks as if the government Is going to create a framework for mass-market identity management and then hope that private industry will step into a vibrant market for identity and attribute provision, multi-level authentication and value-added services. This is an appealing vision, but how is going to work? Can we conclude that there any plausible ideas around about the business pull from financial services (if there is one), the technology push from the IT sector and the legal environment for developing a win-win?

For this final round table in the series we will once again bring together some different perspectives to explore the subject still further and, importantly, to test one or two of the potential conclusions from the programme. Around the table will be:

Travis Spencer is from PingIdentity, a well-known vendor in the space who work with banks to exploit the social networking identities of customers.

David Nordell is from New Global Markets and is an expert on know your customer (KYC), anti-money laundering (AML) and counter-terrorist finance (CTF) thinking, the sharp end of banks and identity.

Riten Gohil is from Visa Europe, is an expert on identity and authentication in the consumer mass market and is currently responsible for the Visa CodeSure product.

Attendance is free, but space is limited. So if you or a colleague would like to join us, please let us know as soon as possible by e-mailing sophie (at) csfi.org.uk or by phoning the CSFI on +44 (20) 7493 0173 as soon as possible.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Slebs

[Dave Birch] You might well ask why misery guts like me keep going on about identity infrastructure in our cold, calculating plan to impinge on the gaiety of the nation by consigning stories like this to the dustbin of history.

A transsexual Jordan fan who stalked the glamour model is facing jail after admitting to stealing thousands of pounds from [Katie Price] using identity theft. Kerry Marshall, 18, who is currently undergoing a sex change to become a woman, managed to con a series of bank tellers into believing she was the television star.

[From Teenage transsexual tricked bank staff into thinking she was Katie Price to steal thousands of pounds from the model | Mail Online]

Amazing. Absolutely amazing. Note for foreign viewers: "Katie Price" is the pseudonym of a female English topless model in her mid-30s called Jordan. She is famous for having enormous fake breasts and better known to the average Brit than the Prime Minister (you think I'm joking - sadly I'm not), which is why the story is so staggering. Although I would be hard pressed to tell Jordan from last year's Big Brother runner-up or employee of the month at Spearmint Rhino, you would have thought that bank staff charged with KYC responsibilities might have done.

But then perhaps I'm being too harsh. Even when you make people jump through hoops to "prove" who they are (in the absence of any actual working identity infrastructure), you can still get it wrong.

the administrator of an account allegedly belonging to Wendi Deng Murdoch, which briefly received the Verified Badge after launching on Sunday, admitted that she was not, in fact, the wife of News Corp. Chairman and CEO Rupert Murdoch

[From Fake Wendi Deng account casts doubt on Twitter verification | FP Passport]

Wendi would never suffer the indignity of someone tweeting on her behalf in China. For one thing, Twitter is banned, and for another you can't pop down to the cybercafe and log in without an identity card.

I'm not condoning pretending to be other people (although I wholly condone pseudonymous access). In fact, giving a fake name may sometimes have disastrous consequences, especially in environments where semi-automated systems are put on top of an unsuitable infrastructure.

She gave Houston police a fake name. When police in Houston ran that name, it belonged to a 22-year-old illegal immigrant from Colombia, who had warrants for her arrest… News 8 has learned [officials] took the girl's fingerprints, but somehow didn't confirm her identity and deported her to Colombia, where the Colombian government gave her a work card and released her.

[From Dallas teen missing since 2010 was mistakenly deported | wfaa.com Dallas - Fort Worth]

Reading this reminded me, as so many stories about identity, of the fabulous Terry Gilliam film "Brazil". There's a big difference between using a false identity, using a pseudonym and using multiple identities. I must say, I have occasionally been tempted to use a false identity, generally in the queue for immigration at Heathrow airport. I thought that claiming to be an asylum seeker from Norway and getting myself sent to the Home Office in Croydon might be quicker than waiting in line.

Alvarado told Salt Lake City police, a Utah state courts judge and federal immigration officials that he was actually Saul Quiroz and had emigrated from Mexico illegally. At the time, Alvarado was facing up to 15 years in prison for the possession of cocaine and heroin with the intent to distribute. Instead of going to prison, Alvarado was deported to Mexico based on his false identity, according to court records. But he then returned to the United States using his American passport

[From Man Avoids Jail By Faking Illegal Immigrant Status | Fox News]

Maybe the thing to do is to fingerprint everyone entering the US. After all, Japan is very happy with its system for fingerprinting non-citizens.

As a result of the collection of this personal data, which began at the inception of this program, the number of foreigners who were issued deportation orders or became targets for the implementation of compulsory deportation orders exceeded 1,600 before the end of February 2010.

[From Fingerprint all Japanese, for safety's sake | The Japan Times Online]

Oh wait, I just remembered that the US does fingerprint all of us foreigners who enter the country.

A doctor from the Dominican Republic was convicted and sentenced in Boston on Thursday of offering to surgically alter the fingerprints of illegal aliens, the Department of Justice said.

[From Doctor convicted of surgery to alter immigrant fingerprints | Reuters]

As a corollary, if you did base security on fingerprinting everyone entering the US, you would naturally be very suspicious of anyone who didn't have one, and suspect them to be a drug-smuggler from the Dominican republic.

A cancer patient was detained for hours at the US Customs because a cancer drug he was taking had caused his fingerprints to disappear.

[From The curious case of the missing fingerprints]

I know, I know, these are rare cases. As a general rule, the easiest way to stop people from impersonation topless models and accessing their bank account is not, as deluded technologists might think, to have a working national identity infrastructure with federated identity and two-factor authentication, but to demand biometric identification documentation.

A German manager with Mercedes-Benz is free after being arrested for not having a driver’s license with him under Alabama’s new law targeting illegal immigrants… an officer stopped a rental vehicle for not having a tag Wednesday night and asked the driver for his license. The man only had a German identification card, so he was arrested and taken to police headquarters, Anderson said.

[From Mercedes manager from Germany arrested on Alabama immigration charge | timesfreepress.com]

Setting aside Jordan, Mexican immigrants and Dominican finger fakers, what do we need to do? I ran into a problem the other day in the US because I always leave my "valuable" documents locked up in the safe in my hotel - I never carry either my Passport or driving licence around with me. For goodness' sake, it isn't North Korea. But I couldn't buy something in a store because I had to show ID in order to use my credit card. There really is, as Adam Shaw, the Visa Europe CTO says, a crisis in identity.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Digital

Ninth roundtable in the series on Identity and Financial Services

The ninth, and penultimate, roundtable in the Visa Europe CSFI Fellowship series on "Identity and Financial Services" will be held at the Innholder's Hall, 30 College Street, London EC4R 2RH from 12.30pm-2.15pm on 26th January 2012. (Download invitation PDF (125K).)

We’ve got to the penultimate roundtable in the Visa Europe Fellowship Programme where we must begin to think of practical recommendations on “identity” for organizations in the financial services sector. Given the excellent discussion and debate at the previous roundtables we think we understand the basic models, the size of the problem, the potential benefits of a solution and even have some ideas about the technologies. Now it’s time to start integrating the thinking into some practical suggestions for stakeholders: what should banks and other financial institutions, their suppliers and partners, their customers and the sector has a whole do about identity in 2012? Are there plausible strategies for them or are they doomed to see Google, Facebook and iTunes take over the customers’ identities in day to day transactions?

Richard Martin is from the UK Payments Council, which has convened a project team called Operation Gaia (Government Authentication & Identity Assurance), to assess the case for banking involvement in government-sponsored ID initiative.

Sarah Greasley is an IBM Distinguished Engineer and has specific expertise in enterprise cloud applications for large financial institutions

Nicky Hickman is an expert on customer-facing service delivery and has been working with some of the world’s biggest mobile network operators on identity management applications and services.

Attendance is free, but space is limited. So if you or a colleague would like to join us, please let us know as soon as possible by e-mailing sophie (at) csfi.org.uk or by phoning the CSFI on +44 (20) 7493 0173 as soon as possible.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Corporate, Roundtables

Seventh roundtable in the series on Identity and Financial Services

The seventh roundtable in the Visa Europe CSFI Fellowship series on "Identity and Financial Services" will be held at the Innholder's Hall, 30 College Street, London EC4R 2RH, from 12.30pm-2.15pm on 3rd November 2011. Download invitation (125K).

We moved from examining aspects of the different identity problems that abound in the financial sector and started to look at potential solutions, but before we can come close to recommending particular approaches or technologies, we need to explore the business models. We need to understand who pays and gets paid around Europe and we need to come up with a sensible business model for UK plc. This may not be the same as either the northern or southern European - that is, bank-led or government-led - because, as we discussed earlier in the year, the UK is looking at a framework developed by government but delivered by private sector identity and attribute providers. We've brought together a terrific panel to discuss these issues.

Jerry Fishenden is the chair of the Cabinet Office's Identity Assurance Privacy and Consumer Group, working to create the UK's new identity infrastructure.

Alistair Gates is from PayPal, where the relationship between identity, authentication and financial services in the cloud is a day-to-day topic.

Douwe Lyklama is from Innopay, the Dutch consulting organisation that was commissioned by the government their to suggest an identity infrastructure for the Netherlands.

Attendance is free, but space is limited. So if you or a colleague would like to join us, please let us know as soon as possible by e-mailing sophie (at) csfi.org.uk or by phoning the CSFI on +44 (20) 7493 0173 as soon as possible.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Corporate, Roundtables

The future of "identity" is going to be very different from the past

[Dave Birch] Having had the sixth roundtable in our series and started to prepare for the seventh, I'm beginning to think that one of the reasons why it is proving difficult to iterate towards solutions for the "identity problem" in financial services is that it is hard to think about the future of identity because it is going to be so different from the past. I've said before that

we need to develop more sophisticated notions of identity in our post-modern paradigm and that trying to shoehorn entirely new concepts like a social networking identity into either pre-modern notions of what might or might not constitute real identity or modern notions of some kind unique state-delivered identity is going nowhere.

[From Digital Identity: Bring it on]

When we're trying to imagine how identity infrastructure might work for the financial services world, there's no point looking backwards and imagining that making people carry either bits of cardboard or the electronic equivalent of bits of cardboard (like the proposed UK national identity card was) will help. In the new economy, where online and offline begin to merge, we need to find some kind of identity infrastructure to support individuals, organisations and governments in their interactions and transactions spanning the virtual and mundane. At the heart of this is some kind of concept of digital identity.

The sector should demand a 21st-century infrastructure founded on digital identity because you can do things with digital identity that you can't do with analogue identity: digital identity isn't simply an electronic representation of analogue identity. It can do things that have no analogue analogue, so to speak. This is because digital identity is built on mathematics and cryptography, not our "common sense" notions of what an identity is. When you digitise something, you have the opportunity to unpick it and rebuild it to be better. Identity is no different.

Consider the prosaic case study at the heart of goodness knows how may discussions about identity in the UK. You go into a pub and they ask you to prove you are over 18. You show them your driving licence. Now, assuming they believe it's a real driving licence (they have no way of checking, of course), they now know your name and address as well as your age. That was none of their business. Actually, your age is none of their business either, because all they need to know is whether you are over 18 or not. Digital identity can do that: you could easily imagine an Oyster-like button on the bar: you touch a card or your phone to it and the barman sees either your picture (if you are over 18) or a red cross if you are under 18. He doesn't have to judge whether your papers are real or not: unforgeable digital signatures do that for him.

This is a general point: digital identities are better because they can be checked. Your phone will be able to tell you whether the guy at the door really is from British Gas. But they can be discreet: if the pub asks for your address, your digital identity can check and see whether to give it to them or not. This has been possible online for years, but it's about to enter the mass market because of the mobile phone.

The transition to digital identity and the use of mobile phones also means an integration of logical and physical identity. Instead of carrying a key fob that gets you into your office and an ID card that gets you into the building and a dongle for logging into to your PC, your digital identity (almost certainly embedded in your phone) will do all of these things. This isn't theoretical. RIM have just announced that the new versions of the Blackberry that include contactless technology will integrate the HID iClass physical access system. This means that you can touch your Blackberry to your office door to open it as well as read your e-mail.

The new BlackBerry Bold 9900/9930 and BlackBerry Curve 9350/9360 smart phones activated with iCLASS digital credentials will be compatible with the installed base of iCLASS readers that are used for applications ranging from physical access systems in buildings, to student IDs, to applications that track time and attendance.

[From NFCNews | NFC-enabled Blackberry devices supporting HID iCLASS]

The new generation of mobile phones that have this Oyster-like "tap and go" technology built in to them -- like the Google phones that recently launched in the US -- mean that the use of digital identities can be made quick and convenient. If you want a snapshot of how this bridge across the real and virtual might work, have a look at the pilot project at the Clarion Hotel in Stockholm, where frequent visitors were given a mobile phone equipped with NFC ("near field communication") contactless interfaces so that they could check in on their phones and then go straight to their room to tap and enter.

A world’s first pilot is starting at the Clarion Hotel Stockholm in Sweden. ASSA ABLOY, Choice Hotels Scandinavia, TeliaSonera, VingCard Elsafe and Venyon, a fully owned subsidiary of Giesecke & Devrient, have joined forces to replace hotel room keys with NFC-enabled mobile phones.

[From NFC mobile phones replace hotel keys | Clarion Hotel Stockholm]

The guests said using the NFC-enabled phone to check in, enter their room and check out made their stay more pleasant, saved time and inspired them to use the service again. Ease of use counts, especially in identity where the underlying concepts of keys and certificates are opaque to the general public, and for the foreseeable future it's the mobile phone that can deliver this ease of use.

You can see what Nokia, RIM and Google are moving towards. When you meet someone on business, a quick tap of the phones will exchange contact details and make a LinkedIn connection. Digital signatures will mean the information can be trusted. When you're waiting for a train, you'll be able to tap your phone to an advert for a film and find yourself connected directly to the ticket office.

For financial services to use this quick, convenient and simple interface, it needs an infrastructure that means the things you're interacting with can be trusted and that they can trust you. In the US, the Department of Commerce has launched their National Strategy for Trusted Identities in Cyberspace (NSTIC) and the Cabinet Office are working on something similar in the UK, as discussed in our second workshop: a framework for private sector identity providers to work in.

I think that NSTIC isn’t bad at all. As I’ve noted before I’m pretty warm to it. The “identity ecosystem” it envisages is infinitely better than the current ecosystem and it embodies many of the principles that I regard a crucial to the online future.

[From Reflecting on NSTIC]

I think our final workshops should focus on defining the financial sector's requirements for this framework: looking forward to exploiting new technology to make life both simpler and more secure at the same time.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Digital

The current situation is a joke

[Dave Birch] We have a Visa prepaid card. The kids use it when they go to the supermarket to get shopping or if they are buying school supplies and that sort of thing. I logged on to top it up. Luckily, it's easy for me to remember my username and passoword for this because they are on my top secret sticky note next to my screen. I do have problems with the "captcha" code that the site makes you enter, and sometimes it takes me two or three attempts to get in. But I got it right, and looked at my account. Right, the card needs topping up, because no.2 son needs to go to Waitrose to buy ingredients for cooking lesson at school tomorrow. I use my MasterCard to top up, but the transaction is rejected. What!

Then I remember: I've already set up the card payment for later in the week, but in the meantime I put some expensive car servicing on the same card, as well as big airfare for work. Better log on to John Lewis and pay off some of the card. Luckily, I can remember my John Lewis log in because it's on the same sticky note. I select payment, and enter my debit card details (for the Nth time). The system asks me for my "internet security code". I have no idea what it's talking about, I think it means CVV, so I enter the card CVV. Doesn't work. I try another couple of plausible numbers, but they are both wrong, and John Lewis tell me that they are locking me out. I have to waste my time and their money by calling the call centre, which I don't have time to do right now.

Oh well, I'll use my Barclaycard instead. This time I get redirected to a 3D-Secure log in (which John Lewis doesn't appear to use) and am challenged for the first, third and tenth letters of my password. I rack my brains as to what 10-letter password I might have used, and guess wrong. Oh no. I have a sip of coffee and try to think harder. Inspiration! I guess again, and this time it's correct. Phew.

I think that I'd better look at my bank account to double check that the MasterCard bill will be paid tomorrow, so I take my debit card and put it in my Barclays "PIN Sentry" device to get a code to enter log myself in. Why I couldn't use the same PIN Sentry for the Barclaycard 3D-Secure I don't know. And couldn't John Lewis accept home banking log ins as well. Surely they trust Barclays Bank, don't they? While I'm doing this, I go to check the mail and there's a letter about car insurance. I go to the insurance company and try to log in, but I haven't the slightest idea what the username and password I chose last year were, so temporarily give up - I'll call them at the weekend.

Meanwhile, I get an e-mail telling me that my new mobile phone bill is ready and that I can log in to look at it. I need it to fill out my expenses, so I'll go and log in, just as soon as I can remember what my username is. They wouldn't let me have "davebirch", so it's something stupid with some numbers in that I can't picture. It'll come to me in a minute...

Right back to work. Let's think about the next roundtables in the Visa Europe / CSFI series. Now, what is the problem with "identity and financial services" again?

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Authentication, Passwords

Third roundtable in the series on Identity and Financial Services

The third roundtable in the Visa Europe CSFI Fellowship series on "Identity and Financial Services" will be held at the Innholder's Hall, 30 College Street, London EC4R 2RH, from 12.30pm-2.15pm on 10th February 2010. Download invitation (123K).

When we talk about “identity”, we’re generally talking about our own identity as individuals. But when I log on to our business banking account, I’m not logging on as Dave Birch but as Dave Birch, an executive officer of Consult Hyperion. Does this make me a different person? Is Consult Hyperion a person, for identity purposes? And it’s one thing to ask me to prove that I’m an executive officer of Consult Hyperion to Barclays, but how does Barclays prove who it is to Consult Hyperion? Are corporate frauds (eg, VAT fraud) helped or hindered by the lack of infrastructure? Could banks do more to help customers? SMEs? What are the responsibilities and liabilities that go with a corporate identity? How can I prove that I’m employed by my employer, that my employer banks with its bank and that it is owed money by a supplier? Can we really envisage a future in which the transactional cycle (from offer to contract to warranty, and so on) is online, digitally-signed and processed automatically

The issues around identity and authentication for financial services in the corporate sector have been touched upon during the first two roundtables and now it’s time to open them up and explore them using international, expert perspectives. The panelists for this roundtable will be:

• Karen Wendel is the San Francisco-based CEO of IdenTrust, which has been working with banks to deliver identity solutions into the corporate space.
• Barbara Quiroga is Treasurer at Delta and a corporate user of bank-provisioned identity and authentications solutions in the corporate space.
• Peter Wilson from the National Fraud Authority who has to manage the identity fraud problem for UK plc.

Attendance is free, but space is limited. So if you or a colleague would like to join us, please let us know as soon as possible by e-mailing sophie (at) csfi.org.uk or by phoning the CSFI on +44 (20) 7493 0173 as soon as possible.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

Corporate, Roundtables

Second roundtable in the series on Identity and Financial Services

[Dave Birch] The second roundtable in the Visa Europe CSFI Fellowship series on "Identity and Financial Services" will be held at the Innholder's Hall, 30 College Street, London EC4R 2RH, from 12.30pm-2.15pm on 13th January 2010. Jon Shamah from BankID, Frank Leyman from the Belgian government e-ID scheme and David Rennie from the Cabinet Office will be on the panel and we will be trying to understand what the "identity problem" is: Download invitation (146.5K).

There is no European standard for how identity and authentication might be arranged between the government, the financial services sector and others. In some countries, the government provides this infrastructure. In Germany, for example, customers are given free USB smart card interfaces so that they can use their new national ID card to log on to their bank account. In contrast, Scandinavian customers use the ID provided by their bank to log in to government services. In many countries, customers use dongles, tokens and other devices, but they need different tokens for different accounts and can’t use these tokens to log in to other businesses.

We won’t concentrate on the technology, but on the organizational structures and institutions. There is an opportunity for the financial sector to turn identity from a cost (and a hassle) into a revenue stream by solving problems for other private and public sector providers. But does this make sense? Or would the best approach be to create a single government electronic identity that is used not only by the financial sector, but by others as well?

It makes sense to compare and contrast some different approaches and learn from existing schemes so and this discussion will do just that. The panel for this second roundtable will be:

• Jon Shamah from Nets, which was formed from the merger of BBS and PBS and is the leading Scandinavian PKI provider.
• Frank Leyman is Manger, International Relations, at Fedict which runs the Belgian government's eID card scheme.
• David Rennie from the Cabinet Office is helping to develop the UK's new strategy in identity.

Attendance is free, but space is limited. So if you or a colleague would like to join us, please let us know as soon as possible by e-mailing sophie (at) csfi.org.uk or by phoning the CSFI on +44 (20) 7493 0173 as soon as possible.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

European, Roundtables

Customers can see the problem

I've just been filling out a form for my bank -- why isn't relevant, except to say that every single item that I was required to fill in was something that my bank of 33 years already knew -- and I decided to drive round and drop it off later in the week rather than post it, because I'm starting to become slightly paranoid about identity theft. Unlike half the population, who are seriously concerned.

The poll of 970 UK adults, part of the bi-annual global Unisys Security Index, reveals that cyber-security is the public's chief concern, with 85% of respondents worried, and over 50% "seriously concerned", about bank card fraud and identity theft.

[From Finextra: Brits switching banks over security and privacy concerns - Unisys]

This is an odd result, I think. I couldn't care less about bank card fraud, since it's the banks' problem and not mine. I never use a debit card for anything, offline or online, so I'm totally protected by the legislation around credit cards. I'm much more worried about identity theft, because it's more time consuming to put right.

New figures from the National Fraud Authority [NFA] estimate that every year in the UK identity fraud costs more than £2.7billion and affects over 1.8million people.

[From UK Attorney General]

So what is being done about that? Well, banks in particular are trying hard to have better identity management. The results are, I think, often negative. Phil Windley explained how one of his bank accounts got frozen and what a complete hassle it was to unfreeze. The details aren't germane, but his conclusion is succinct.

Clearly what banks are doing now to prove identity online is not convenient and doesn’t scale.

[From Phil Windley's Technometria | The Problem with Identity Proofing]

I think it's important to draw attention to both of these issues: the convenience and the scale. My Barclays PINSentry is tolerably (but not entirely) convenient but it doesn't scale: I can't use it for logging in to Barclaycard, let alone another bank. As a consequence, countless hours are wasted in call centers and on web sites, transactions are abandoned and customers find themselves inconvenienced and alienated.

Convenience is hardly worth remarking on: clearly, if an identity and authentication mechanism isn't convenient, then people won't use it. Or, at least, they will only use it in proportion. This is why I tend to think that mechanisms that are based on things that we already have that have secure elements in them (eg, mobile phones, chip and PIN cards) are better than special-purpose devices. But we still have to have convenience in another sense: a common interface with a well-understood grammar. This is why I rather like using OpenID to log in to things.

The second characteristic is just as important. The financial sector needs a solution that scales. It cannot require a phone call for every log in and nor can it result in a torrent of phone calls back in to call centres. This is why a highly-distributed solution is necessary. In many countries, this means two-factor authentication (2FA) using one-time passwords (OTPs) or dynamic passcodes.

Effective Jan. 1, banks in India must decline any transactions initiated by phone, including those using automated Interactive Voice Response systems, if the customer does not have and use a one-time passcode, according to the Reserve Bank of India. Cardholders will have to register for the service with their bank, which will send requested passcodes only to the customer’s registered mobile-phone number and e-mail address.

[From india-require-passcode-phone-transactions - PaymentsSource Article]

This seems reasonable to me: perhaps the European financial services industry should set a deadline for mandatory 2FA for access to financial services and stick to it. Whether OTPs are the best implementation is not clear to me at all, but that's another topic we'll be exploring in the round table series.

Who steals my purse steals trash; 'tis something, nothing;
'Twas mine, 'tis his, and has been slave to thousands;
But he that filches from me my good name;
Robs me of that which not enriches him, and makes me poor indeed.
William Shakespeare, Othello (Act 3, Scene 3).

[posted with ecto]

2FA, OTP, Authentication