The path for the USA to EMV

http://www.finextra.com/community/fullblog.aspx?blogid=5875

EMV: Let the planning begin

Original 30 Sep, 2011 16:23 updated 02/22

There’s no way around it – EMV transition planning will be complicated. However, while EMV is a complex specification, the good news is that it can grow over time. Thus the key is to implement an infrastructure that lets you start with a simple, single portfolio that can expand and mature with you. Looking forward, the goal is to do it once, do it properly and avoid the pain of re-doing it when it’s time to move into mobile payments

I agree totally with this sentiment. Mobile is here. EMV addresses the requirement to include Dynamic data in a payment transaction to address questions of identity and irritability.

Update 02/22/2012

Having had a chance to sit inside EMVCo working group meeting and being fully aware of those words read every time that reminded us of our confidentiality and sharing of patent and secrets that might jeopardize the future of EMV.

What I saw was the successful release of the EMV contactless specifications and type approval processes capable of testing tap if one remembers the distance has to be 2 cm instead of 10. Otherwise the protocol and security will last us until 2025. Plans where underway as I left that where focusing on expanding the standardization of mobile and the development of a next generation or EMV 2.0. They are talking about 2015 and 2017 for probably dates that these new specifications and processes would be in place to allow widespread adoption so that circa 2030. If hey are right we have a new and transparent solution that opens and never hinders access to whatever we have the right to access. what about the next 17 years,

Well, EMV works. It already includes mobile and contactless.

Visa and MasterCard have said yes. Amex is OK, discover has had lots of ads for payment people with EMV knowledge and such titles.

The Federal Reserve seems to be on-board and Global Platform, NFC and Mobey forum seem to be OK.

Looks like a plan to me.

Payment – Mobile Payments – Connectless payments and an opening to further discussion

Each day I receive a variety of articles on the subject of mobile payments and find countless opinions about the evolution, risks and capabilities of mobile payments.

As is always good form a definition is in order. I could begin by suggesting a mobile payment is any time that while moving about I can purchase something from someone using some recognised means of payment or currency. So at the most basic level of understanding carrying cash in our pockets was and still remains a form of mobile payments. Yet this is not what we mean when we discuss mobile payments. What we have done is combined two words from two worlds into a new thought. Mobile emerging from the arena of telephony and the use of the concept of a phone that does not need to be connected with a piece of wire. Wireless, cellular and mobile all are terms that we associate with the use of radio waves to connect a telephone to a network allowing us to make phone calls from someplace that is in proximity to a receiver or cell tower or satellite. Now I’m sure all of my readers know these things and are wondering what is the point.

The point is that we also talk about contact-less payments that concept of waving a card in front of an antenna, thus allowing the card to receive power through induction and then communicate with the device controlling the antenna. Some people call it that “Tap and Go” feeling others refer to it a PayPass, Visa Wave, Express Pay card and if we travel the world we will find an assortment of other brand names such as Dexit. In many cities transit agents discovered that by employing contact-less cards interfacing with – terminals they could create efficiencies, improve information about ridership and maybe even reduce fraud.

So now we have to discuss the application of the technology. This brings us to the idea of closed loop and open loop systems. Neither are new thoughts, charge cards issued by department stores are closed loop they only work at that companies stores. Open loop refers to systems that are widely accepted because someone has gone out and branded a concept, convinced merchants it is convenient and then offered a “Card” to you and I so that we can be identified and employ this “Means of Payment”. Classic brands that we think of as Open Loop systems include money, MasterCard, Visa, Interac, PIN, eurocheque and an assortment of national brands.

Yet all of these systems have inherent inefficiencies. Inefficiencies that some see as benefits and others see as highway robbery. Then there is that class of people who enjoy getting something for “nothing” they like the idea of counterfeiting money, replicating credit and debit cards, capturing our PIN and ultimately stealing our identity and more importantly our hard earned money. I could also mention merchant discounts, late fees, interest charges, interchange but those are all for another day.

The operators of these systems understand or learn about these various methods of “Stealing” identity and money and have built systems to mitigate the risk, eliminate no minimize yes. In Europe and throughout the world (except the USA) the members of MasterCard, Visa and the various domestic systems are working to reduce these threats by introducing Smart Cards or Chip Cards all cards employing the EMV specification that have a computer embedded within. The benefit is that PIN can easily be introduced on credit cards, the cost of telecommunications can be reduced by allowing the computer in the card to make intelligent decisions when ever that card is used to effect a payment.

This movement to secure payment cards with the technology and specifications defined within the EMV specifications began first in France where they went out on their own developed their own specifications and proved to the world that smart cards or chip cards can and will reduce the level of card present fraud and can if employed properly also reduce the cost of telecommunications. their success can easily be seen in this chart that tracked their progress and success.

French Success Story

Remarkable success, yet they were now faced with an issue. First the criminals understood if they disabled the chip (computer) the merchant could still swipe the card and read the magnetic stripe. This one easily could be solved by eventually not allowing cards that should have a chip to be swiped through the magnetic stripe reader. But what about when these cards were used in Holland, England or anywhere that had not, and at the time no one had, adopted the same means of defense. The net result fraud migrated from being a domestic issue to the cards being used in neighboring countries. Obviously the French became proponents of a global migration to smart cards and convinced Visa, MasterCard and Europay to develop the EMV specifications, recognising that they would have to eventually convert.

I could continue to digress from my main theme and talk about how each country went through its decision making process. I could then go on and talk about how far along they are in their implementations. Suffice it to say some are finished, others are diligently working towards completion and others are moving at a pace that does not cause undue expense and allowing natural replacement cycles to drive the timescale for implementation.

Here in the country where I live they also have a Chip Migration strategy. Canada is inpilot or a trial depending on how the lawyers interpret the efforts of banks potentially colluding together. By the summer cardholders in the Kitchener Waterloo area will be using these chip cards and the media, banks, merchants, processors and associations will be monitoring and learning how the Canadian’s feel about and their willingness to embrace the change.

The following chart outlines Interac’s schedule for deployment. MasterCard is playing along without committing. Whereas Visa has stated that they will push the liability for fraudulent transaction not protected by EMV to the Acquirer if their merchants are not compliant by October of 2010. Canadian Chip Migraation Interac's EMV Timeline

So how does all of this affect the introduction of Mobile Payments or Contact-less Cards. A mobile payment is simply, today, a contact-less payment performed using a mobile phone with the contact-less interface inside as apposed to to using the card as the form factor.. Well some will say not at all, the drivers are different the business case is not the same. Yet the core technology is a computer in the card. So why worry, eventually all of this could come together. Or will the USA decide to take another path all together.

So to end this particular blog I ask a simple question, based on the premise that the mobile and contact-less payments that we see emerging are all about speeding up low value <$25 dollar transactions. What happens when I want to use my contact-less mobile phone for a payment for say a $1,500 hotel bill. Will I tap my contact-less device “mobile phone”. Have to find a place to put it while I either enter my PIN or sign the receipt. Today the clerk typically holds the card for me while I sign the receipt tomorrow what. Or will they decide to merge contactless and EMV creating a more interesting problem. I’ll need to keep that phone near the antenna while my PIN is verified and the transaction is authorized.

Or should we go on and talk about the security concerns that everyone has described in countless articles and numerous logs. The idea that the criminal will walk down the street reading the content of your purse or wallet with their hidden antenna.

Or should we talk about who is going to pay the price of adding the contact-less antenna to the merchants point of sale equipment.

Let me hold those for another day and another flow of thought.

NSTIC and EMV should merge

October 03, 2011

Cyberspace trust: Proving you’re not a dog

A very real discomfort underlies the classic joke: “On the Internet, nobody knows you’re a dog.” How can you prove your own identity and confirm the identity of others during virtual interactions? Every time you reach out to a friend on Gchat, post on a classmate’s Facebook wall, or send money to a colleague via PayPal, you are relying on a key assumption: that the person you’re reaching out to behind that Gmail address, Facebook profile, or PayPal screen name is who they say they are. Without this baseline confidence, online interactions and commerce would be paralyzed.

http://portalsandrails.frbatlanta.org/2011/10/cyberspace-trust-proving-youre-not-dog.html

Philip thinks:

The next step is to merge the identity sought by everyone and easily relegated to the Banks to manage. Facebook and GMail offer an option if their KYC can be improved. With face to face meeting it is possible to truly prove identity, requiring a branch network.
Transaction processing is legacy in the developed world while the emerging economies offer an opportunity to build new. Existing standards and processes need to be respected as they transform to absorb the new information attachments and Internet offers we now need to cope with.
The Wallet forms the basic unit to create a trusted network employing smart cards, trusted computing, persistent computing and inteligence to enable the consumer experience.
Privacy and integrity of that trust is essential to the system
The individual is key
Respect rights and obligations

Legacy infrastructure impedes truly innovative disruption

An interesting thought – Is the USA behind in adopting payment technologies.

Areas that one could ponder are:

* Payment Card Security
* P2P Mobile Payments
* P2P and P2B Electronic Funds Transfer as part of Home/Mobile Banking
* Elimination of Checks including Check images
* A/R and A/P electronic payments integration
* …

What would be interesting is to eventually be able to catalog the global differences and define the ultimate payment capabilities a country should adopt.

Please let’s share and explore.

Are the Pundits over thinking the ISIS proposition

Mobile payments is being discussed in the context of “creating” a new “means of payment” or in other words a new “Payment Brand”. I would suggest the expense and time it takes to create a new “Payment Brand” is significant not to ignore expensive.

Just look at PayPal. How long, on the backs of eBay, did it take to reach the point where they are ready to enter into a venture with Verifone to become a “means of payment” their buyers can use at the real world stores of their sellers.

Two models for payments exist in the market today and frankly these two models have not changed, since the beginning of any form of commerce.

The three party model and the four party model.

Classically banks regulated and trusted to hold our moneys in accounts are fundamental to the act of payment. They have always been key to developing and operating the payment systems.

Unless of course we use cash.

In both models two parties always exist – the Buyer and the Seller, the Payer and the Payee or the consumer/cardholder and the merchant.

In the four party model we add two Banks who support one of these two parties. There is the bank with the relationship with the consumer/buyer/payer/cardholder, often called the Issuing Bank. On the other side of the payment there is the bank with the relationship with the merchant/seller/payee, often called the Acquiring Bank.

The three party model, simply means that the Bank of the payer and the Bank of payee are the same. The movements of funds flows from the buyers account to the sellers, as ledger entries, within a single institution.

American Express and PayPal are perfect examples of non-Banks who operate three party payment systems.

The central bank is another example of a three party system. All the banks within a country are clients of the central bank and have accounts at the central bank.

Clearly the three party model is the most efficient. But, it requires that there is a monopolist who processes payments for all buyers and sellers in order for the system to truly work. Reality dictates that a monopoly or agreement by all parties to use a single entity for their banking and payment services must exist for such a system to dominate the market.

Therefore, the payment systems have evolved cooperatively; based on acceptance by the consumer and merchant of a recognized means of payment. The banks work together to establish a set of rules and procedures they employ to transact payments. Various four party models i.e. MasterCard and Visa along with checks, electronic fund transfers, dominate the payments landscape.

Inherent to these models is a Brand (acceptance mark), a set of rules and a clearing mechanism. Everything works because there are agreed rules and procedures that govern how the two banks execute payments. To complete the cycle these two banks ultimatelyexchange real money, typically through a settlement bank or the central bank representing the total value of the payments processed.

To add complexity to the landscape, the Issuer and Acquirer often contract with processors to do the work. These to entities are identified in the graphic as the Issuing Processor and the Acquiring Processor.

Behind the term mobile payments, some think there is a more efficient method of affecting payments. They believe inserting a new player into the game will make the whole system more efficient and therefore cheaper. Or more appropriately they think that their new approach will allow them to earn a portion of the Merchant Discount (fee paid by the Merchant to the Acquirer) or the Interchange (fee paid by the Acquirer to the Issuer).

The more I think, read and discuss, the more convinced I become that creating a new payment Brand is an expensive exercise and frankly believing we can create something new and more efficient than the existing four party models is irrational.

So what does the Mobile Phone bring to the payment landscape?

Clearly ISIS understands. Mr Abbott states “We plan to create a mobile wallet that ultimately eliminates the need for consumers to carry cash, credit and debit cards, reward cards, coupons, tickets and transit passes.” Key word “WALLET” by definition “A wallet is a small, flat case used to carry personal items such as cash, credit cards and identification documents, such as a driver’s license. “ Interesting, a mobile phone is a small, flat object that can carry a digital facsimile of cash, cards, identifications documents … .

Next we think about NFC “Near Field Communications”, a method of transferring data between the content of the Wallet to the merchant’s Point Of Sale device “POS”. Tap instead of swipe. NFC replaces the read of the magnetic stripe with the transfer of the data from the Mobile Wallet to the merchant’s POS. To achieve this goal PayPass and the otehr contactless payment cards simply stores what is on the magnetic stripe and passes it via NFC to the POS. Given that a mobile phone is a computer we can introduce digital certificates and do it much more securely.

This is exactly what EMV Europay, MasterCard and Visa defined and employ. Debit and credit card issuer throughout the world are now employing the trusted characteristics of a chip card to secure their credit and debit card payments using digital certificates.

With a Mobile Wallet (remember the SIM is a chip card) a trusted component is available, inside the consumer’s wallet, capable of supporting EMV and assuring the authenticity of the content (Card) of the wallet and the identity of the owner of the wallet.

Bob Egan in a recent Forbes article The ISIS Mobile Wallet: Are Visa, MasterCard and PayPal Under Siege? writes “To me it’s quite clear the ISIS is taking matters into its own hands. I predict we will see ISIS become the issuer behind new carrier partner plastic credit/debit and prepaid cards in addition to mobile wallet capabilities for those cards become resident as applications on mobile phones.” This suggests that Isis is going to compete with Barclaycard. If this is the case then what does the following statement in the Isis release mean “Barclaycard US, part of Barclays PLC, is expected to be the first issuer on the network, offering multiple mobile payment products to meet the needs of every customer. “

So what is Isis planning? Clearly Pundits are not sure.

EMV is truly becoming the base for secure Card Authentication and Cardholder Verification

INCREASING EMV CARD AND TERMINAL DEPLOYMENTS CONFIRM EMV AS GLOBAL PAYMENT STANDARD
06 October 2010: As of 1 September 2010, over one billion EMV®* cards and 15.4 million EMV terminals were active globally. These are the latest EMV deployment figures reported by EMVCo, the EMV standards body collectively owned by American Express, JCB, MasterCard and Visa.

http://www.emvco.com/download_agreement.aspx?id=561

A must read on NFC Near Field Communications

http://www.nfctimes.com/nfc-projects

There is nothing more to say click and explore.

Remove Volatility

Today I was confronted with volatility. In a two week period gas prices had gone from 2.395 to 26795, quite a climb of less than 14 days.

Volatility, this is what we must remove from peoples lives. Stability and comfort are what is important. Having gameful activity to allows us to contribute to the whole. Being idle is unproductive and only benefits the traders who prey on short term activity to enjoy profits from volatility.

Our President must accept that the Wall Street lobby must be squelched for a while as volatility is banded from the marketplace. This will take an acceptance on the part of the wealthy that they cannot take it beyond the grave and before that excessive income is not acceptable to the healthy grow of civilization.

Set a maximum salary of say 2 million.

Foreign exchange markets are another area of concern. Volatility based on war and famine must the mitigated out of the civilization.

Our civilization is global and provisional limitations such as food subsidies need to be removed.

Remember they are simply subsidies paid by the tax payer. Government should be limited to a percent of the population; remembering its role is to only assure the the primitive functions of justice, liberty, freedom and security.

Regulation is something that must be removed and a new form of peer review established with responsibility to maintain quality, service, stewardship for the planet, and a judicious use of nature resources. Free enterprise is encouraged by remembering that it is the relationship between the customer and proffer that ultimately decides success.

The Future of Money

I took offence when I looked at the picture included in the article published on Wired.

http://www.wired.com/magazine/2010/02/ff_futureofmoney_move/

The arduous path that he has carved out for a card transaction assumes a lot of unnecessary intermediaries that have included themselves within the picture.

For me the story can be simplified.

Credit card processing involved a minimum of five parties. The Issuing bank and its technology arm, the acquirer and its network and the scheme (Visa, MasterCard … ). Everyone else is about the realities of the ISO marketplace and the proliferation of parties offering added value services along the transaction path.

Remember a credit card transaction is simply

Swipe/Tap/Dip/PIN.

Add transaction amount, time, merchant etc.

Ask Acquirer for approval.

Acquirer passed to scheme

Scheme routes to Issuer

Issuer approves and sends back the authorization.

then if necessary sign receipt

That night batches of requests for payment are sent from the acquirer to the Issuer with the Scheme, reconciled and settled.

Then there is ACH. Yes the technology needs a modernization the functionality must be stream lined and ubiquity must be embedded in the pricing model.

Electronic checks that are facsimiles of hand written checks cleared through the Check 21 system should not be eliminated, they are efficient and provide a great personal audit trail. handling the paper should be pushed as close to the original transaction as possible so that personal accountability is induced. The person I handed the check to has the check. So if there is a problem I have to deal with him.

Otherwise all the necessary transactions are possible and with the move to STP “straight through processing” the ability to assure availability of funds can be assured.

What are most of the other schemes. First like American Express they are three party solutions with a man in the middle holding funds on account in a pre-paid scenario or capable of submitting as your proxy transactions into the ACH and card systems.

Yes the three party system is the most efficient. Unfortunately it has one problem, it is not open.

Visa and MasterCard, although viewed as restrictive, are open systems. They accept; any properly sanctioned bank as a member willing to abide by the rules and maintain sufficient reserved. For a new system to acquire this status either means they become a bank and meet those incremental regulations or they focus on building critical mass as American Express has proven can be done.

So as this next article concludes, what is can improve and probably is better than something new.

http://www.wired.com/magazine/2010/02/ff_futureofmoney/all/1

The Future of Money: It’s Flexible, Frictionless and (Almost) Free

By Daniel Roth February 22, 2010 12:00 pm
Wired March 2010

This is what I have done as the following snapshot indicates:

www.andreae.com/presentations

Critical mass versus ubiquity the future of payments

In a paper recently published by the Federal Reserve they begin to consider what actions the FRB should take to drive the further adoption of P2P electronic payments and the reduction in paper checks.

http://www.bos.frb.org/economic/ppdp/2010/ppdp1001.pdf

Their introduction speaks to the differences in adoption of electronic payments in the USA and Europe. Intriguingly they include privacy concerns as a key issue. This being said, having lived in Europe for 15 years, I am not sure the desire for privacy is greater in America. What can be said is that the moment when the underlining infrastructure was developed defines the ideas and feature sets. Newer systems learned grew as other economies embraced and proved the viability of innovative ideas.

They go on to discuss the fate of eCash (Mondex, VisaCash) and the need to create ubiquity in order to assure success. Clearly, as they outline, the major adoption issue in the field of payments is achieving a density of merchants willing to accept a particular means of payment and simultaneously demonstrating a significant number of consumers willing to employ said means of payment.

Unfortunately for the inventors of neat solutions the reality is that without figuring out how to assure ubiquity the new idea they will not be a success. If we look at contactless, MasterCard clearly recognised this reality and funded the initial investment in equipment. Without this investment one wonders if PayPass would have reached the low levels it has.

The interesting thought that emerges from this paper is that the wide spread deployment of mobile phones means that an infrastructure that both merchants and consumers have is in place and if one can find an intuitive means of exploiting this installed base, part of the deployment problem is mitigated.

In my heart, I believe mobile will allow the establishment of new ways of paying, The next question can today’s infrastructure support P2P payment instructions and will the issuers and acquirers figure out how to make money without cannibalizing existing revenue streams.

An interesting story as we think about health care

I met a man with a deep understanding of the Red Words, who told me a little of his life and how he spent $180,000 resolving medical issues associated with a stoke. Little was done, given the amount spent and the available technology and medical sciences.

Today, he believes, based on sound medical opinion, that exercise, surgery or medication could eliminate the de-habilitating impact on his sight, mobility and hearing.

After spending his life, saving, my friend lives comfortably in a 250 square foot home with nothing but the bible and his spirit.

Where is the VA for a VIET NAM vet; there were provisions made under Nixon for long-term medical care?

What should a more balanced system do to afford my friend a comfortable retirement?

today on CNN – What about this idea

http://newsroom.blogs.cnn.com/2009/10/05/unemployment-what%e2%80%99s-to-blame/

Unemployment: What’s to Blame?

Posted: 08:44 AM ET

Former Federal Reserve Chairman Alan Greenspan predicts U.S. unemployment could hit 10%. Currently the nation’s unemployment rate is at 9.8%.

So, what do you think is most responsible from the worsening employment picture: a failed stimulus package, an economy much worse than we knew, employers cutting deeper and hiring more slowly than expected, or something else all together.

Leave us a comment. We’ll share some of them on air in the CNN Newsroom, 11am ET — 1pm ET

So there we are. A picture and a set of points on why we are where we are with unemployment. Now what about this idea.

First, there is an issue of Greed. A small percentage of the global population has accumulated a massive amount of wealth. I am not here to judge the right or wrong of how they or their ancestors acquired the wealth. I am here to suggest looking forward.

100 million dollars a year as a salary to hedge the price of gasoline and contribute to raising the profits and consumer costs associated with oil.
$17.2 million to successful sell Visa inc, to the market, earning bankers a significant return.
Numerous excesses that programs like Nip/Tuck mimic for Wall Street millionaires.
A stock market that has a curve that simply should not have been allowed. Long term prudent economic management is essential.

Ponder this. If equities is suppose to represent the inherent stability of the corporations that employ our neighbors; what happened starting in 2000 and culminating in the bear Stearns collapse in 2007. Is Wall Street unravelling the growth that began in 1982 and went into a hyperactive phase in 1995, and simply correcting itself.

What next should represent a step change in how we think about governance, compensation, risk, responsibility and morality.

What I think a lot of us forget is that our society evolved over millennium and here we are thinking we are so important. What is important, is being faithful to a common morality, and making sure that we leave something better for our children.

I agree with the Dali Lama, all we want is peace and happiness.

So what next?

Cap salaries for the rich at 2 million per year.
Institute a managed health system that still uses the concept of insurance and hedging risk to fund our healthcare system.
Introduce a health management system, with a basement for those that cannot afford even the most basic plan.
Re-introduce exercise in the school system and subsidize community gyms and recreational facilities.
Re-introduce the luxury tax for non essentials over $30,000 and on things that are not good for you or are excessive. Say anything not associated with your food, transportation and housing.
Focus on better educating the family practitioners, gynecologists, internist and pediatricians so that they do a much better triage and assessment of appropriate care given available resources with fear of reprisal for taking risks. If necessary, require an additional year of service at a teaching hospital earning a reasonable income say $120,000.
Do a lot of what Congress is already talking about
1. Strengthen the VA hospital and medical care system
2. Do not mess with Medicare or Medicaid, until the new system is in place. Let the people move to the free market approach.
3. Do not create a Government run insurance system. Yes to creating a open market, knock down state borders and promote re-introduction of the original Blue Cross Blue Shield concept of a co-operative not for profit solution
Focus on regulating the quality of care with a no one left behind principle.
Keep the insurance companies out of setting fees. Manage thje cost of the healthcare system by focusing on competition. The patient is the client and is to be saught after without offensive advertising.
Mandate a National Id card keying off the social insurance number. Combine it on the Drivers license, as a day one requirement.
Focus as a corporate priority on employment being the key indicator of success. Begin discussions on Right to Work legislation and stimulating more humane approach to managing down costs in a period of economic recession. Reduce executive wages well before the first person can be let go, without cause.
Merge all the work in the fields of governance, risk and regulation into a replacement bill.
I could go on.

From Nothing Something

In an apologetics I was asked to question the idea that something came from nothing.

This is what I have to believe if I am going to listen to the Atheists and ACLU.

Then I thought about Creation and Intelligent Design. Oh how much simpler it is to believe than these Macro Environmental facts that cannot be backed up with data explains it all. There is much to accept if you are going to believe out of the Big Bang and Chaos; time would produce a single cell. Then from that single cell produce the abundance of life forms that have and do exist.

255 proteins must magically appear in one place at the exact right time,

Before we can start thinking about things like DNA

What next for Smart Card and Mobile Phone

Why not start implementing EMV in the USA. It is the right thing to do. One global standard.

“Chip and PIN”, EMV … ISO 7614

The New York Times, in the previous post, looks at the issue from the obvious perspective. The result is as one would expect. Remember when France first introduced smart cards 1984or mandated then back in 1992 and the acceptance nightmare.

In the past I have written on the idea –

Push PCI/EMV into one coherent electronic and secure smart card reader and PIN Pad.

Mandate all new 1 July 2010; with the understanding that the reality – every piece of equipment will be replaced in a reasonable period, say 7 to 10 years.

VARs should easily be able to do that.

The incremental ($8/device) on the device side goes down over time, as equipment becomes more affordable.

On the system side, most international providers have a solid EMV implementation they can port over to the US platform over that same 7 year time frame.

At the Network switches, gateways and IPSPs; data formats should be changed sooner, say three years from day one.

Issuers can then decide, when to embrace one global two factor authentication solution; using contact and contact-less EMV cards to support card authentication [Factor 1] and card holder verification processes (eg. Chip and PIN) [Factor 2] .

Biometrics were understood when EMV was created. The mechanisms are in place to introduce an agreed, more secure, biometric verification process [Factor 3].

The NYTimes understands what EMV is

So why not go ahead, do contact ISO7614 and contactless cards ISO14442 for 1.75 a piece. then merge 15+ cards to a few. Save 11*$.025 = 2.75 per person. or 1.100 Billion less cards as pollutants

Could U.S. consumers spur adoption of EMV in U.S.?

Tracy Kitten

• 01 Oct 2009

As the rest of the world wraps its migration to EMV/chip-and-PIN technology, Americans traveling overseas are running into mag-stripe disadvantages.

This week, travel reporter Michelle Higgins of The New York Times writes that U.S. cardholders traveling abroad are getting turned away by some merchants, since mag-stripe readers are quickly becoming things of the past in every corner of the globe except the United States.

Though EMVCo., which oversees and spearheaded the EMV shift, has said from the beginning that all chip cards and readers would continue to also read mag-stripes, many merchants are reluctant to accept mag-stripes, since they can be held liable if card information is skimmed or compromised. And because magnetic stripes are relatively easy to copy compared with chip-and-PIN technology, accepting mag-stripe transactions potentially opens the door for fraud.

The problem is that most U.S. consumers have not been informed by their financial institutions about potential transaction problems when traveling overseas. Most, in fact, have no idea what EMV or chip-and-PIN technology is.

Twenty-two countries, including most of Europe, Mexico, Brazil and Japan, have adopted EMV technology, according to the Smart Card Alliance. About 50 other countries, including China, India and most of Latin America, are in various stages of migrating over the next two years.

Last year Canada began rolling out chip-and-PIN cards and plans to stop accepting mag-stripe cards at ATMs after 2012 and at POS terminals after 2015.

The Red Words

Someone once said
Read-only his words

My adaptations of the translation used, to keep you on track to accompany a lot of cut and paste. Not for anyone’s adulation. It is my work available for me to see and refer to.

Jesus Christ

Jesus’ Red Words

Matthew Mark Luke John

Extracted from the NIV

Time passes and we must be reminded to think back to how it was

2009 September Philip lived on an island during the flood

False Prophets and False Profits

Last night, 11 September 2009, I watched hours of material on 9/11.

I saw the planes as the flaming arrow of the False Prophet.

I saw the two towers as the symbol of the moral decay of the False Profit.

Both clashed in a period of 102 minutes we will long remember.

The terrorist is acknowledged and the false prophet stands accused.

Yet the False Profit continues to bring harm to many and shame to those of us who seek to know God and the work Jesus’ expects of us.

When will the False Prophet “Profit” finally be recognized as the work of the devil?

American Banker Reports

Europe to Eye Mag-Stripe Ban

Cardline Global | Friday, June 26, 2009

European banks may consider banning the use of magnetic stripe credit and debit cards, according to Gerard Hartsink, the chairman of the European Payments Council.

Hartsink, who is also a senior executive vice president at ABN Amro in Holland, said that European financial companies will have largely completed the transition to the EMV Integrated Circuit Card Specification by 2011, and the council, which is driving the transition to the Single Euro Payments Area, could then advise its members to stop accepting magnetic stripe cards, which are considered less secure than those that use EMV.

“My feeling is, although it has not yet been decided, the [council] will take a decision in 2011, maybe 2010, to only use chip cards,” he said in comments during a presentation this week at the Contactless Cards and Payments conference in London.

The council has no enforcement power, but if banks in Europe went along with such a decision, it could leave U.S. cardholders in the lurch when they traveled to Europe and tried to use cards for purchases or ATM withdrawals.

“If [Americans] visit Europe, it’s not such a problem; their institution could issue an EMV card,” Hartsink said.

Payments council members will probably debate the issue in 2010 or 2011, he said.

Hartsink is not the only person suggesting a ban on magnetic stripe cards, according to Dave Birch, a director at the U.K. research company Consult Hyperion. In a recent blog post, he cited comments from a financial regulator in Singapore pressing for a “concerted, global effort to phase out magnetic stripe technology entirely.”

The time grows near for the merging of leather and electronics

Recently I came across an article that spoke to an idea that i had back in 1996 when I envisioned a personal device that allowed the consumer to merge their leather wallet, Filofax, mobile phone, walkman and PDA into a single light weight device.

http://www.andreae.com/presentation/Wallet_Pockets/my_dream_Start.htm

The author of this article talks to the need to create a secure mechanism to authenticate, identify and as appropriate verify that it is I. When we looked to smart cards that was what we where looking to do and the SIM that is inserted into a GSM capable mobile phone is able to offer the security that Kurt Marko seeks.

Has the time come to move forward with my dream?

That was part of the dream that drove the creation of EMV.

Personal Portable Security Devices

Are Pocket-Sized, All-In-One Security Devices Ready For Prime Time?

Key Points

• Personal portable security devices integrate cryptographically strong user authentication, such as OTPs (one-time passwords) and public key certificates with ample hardware-encrypted flash storage, all housed in a compact USB device.

• The functional integration enables new usage models for secure mobile computing, such as standalone portable applications, browsers, or complete desktop environments.

• PPSDs are a relatively new and evolving technology that suffers from hardware costs substantially higher than those of point products, such as encrypted storage or OTP tokens, complex deployment processes, and necessary additional management software.

USB thumb drives have become the sneakernet’s backbone, the result of plummeting prices and burgeoning capacities for flash memory. These tiny wonders are spacious enough to store an OS installation with room to spare for user data; however, they are also inherently insecure. Although vendors have addressed this shortcoming with drives incorporating hardware encryption chips, these haven’t yet achieved mass acceptance. Small USB devices have also become a common vehicle for delivering secure, two-factor user authentication.

Wouldn’t it be nice if secure storage and authentication features were combined into a compact Swiss Army knife of security? A relatively new class of products, PPSDs (personal portable security devices) “combine the flash storage of universal serial bus thumb drives with the access control and secure storage capabilities of the smart card,” says Burton Group Senior Analyst Mark Diodati. “PPSDs leverage the USB form factor, use hardware cryptographic processing to provide smart card and one-time password device services, have secure storage capabilities, and reside in a tamper-resistant container.”

The real security magic comes from the synergistic integration of the two sets of capabilities; for example, users cannot access the flash memory without first providing strong authentication. Diodati adds, “The PPSD overcomes two issue— the limited storage capability of smart cards and the relative insecurity of USB flash drives. Larry Hamid, CTO of MXI Security, says the combination allows “a device that serves multiple security functions.”

PPSD Features

Furthering the theme of convergence, PPSDs also incorporate several strong authentication technologies. Like traditional USB tokens, PPSDs embed a certificate-based smart card in hardware; however, they add a software-based OTP (one-time password) generator. Unlike SecurID tokens, most PPSDs don’t sport a display; thus, to generate and view the password, users must plug into a PC’s USB port and run an embedded application. This makes PPSDs problematic for use on public kiosk PCs where the ports are usually disabled. Like USB security tokens or smart cards, PPSDs can hold any number of certificate-based credentials for Windows login or PKI (public key infrastructure).

PPSDs pair their strong authentication features with gigabytes of flash storage. Hardware-based encryption is accomplished via a symmetric algorithm such as AES, and, while standard USB flash drives can be encrypted with software, they are arguably less secure. In addition, PPSDs are tamper-resistant because they use their internal smart card to store encryption keys and an embedded chip to execute the encryption. Some PPSDs also support biometric authentication via an integrated fingerprint reader for added security.

Advantages & Usage Scenarios

Like plain-vanilla flash drives, PPSDs have benefitted from dramatic increases in flash memory density and are available in capacities from 1 to 16GB. Such abundant storage enables some intriguing applications, according to Diodati. He sees PPSDs as an ideal way to protect mobile professionals via solutions such as hosting a complete virtual desktop OS, “hardened” business applications, Web browsers, or SSO (single sign-on) systems.

For example, using software, users can carry a fully customized Windows Desktop environment on a USB stick. Similarly, some let users install and run individual applications directly from a USB drive while leaving no traces behind on the host PC. PPSDs enhance these portable application environments by running them within a much more secure framework.

PPSDs look like the perfect security multitool, so what’s not to like? Unfortunately, according to Diodati, “the functionality of the PPSD comes with a price.” He explains that extensive processes are required to initialize devices for a particular organization, customize and personalize them for users, and bind their security credentials to internal directories. Although vendors provide administrative tools to automate these tasks, Diodati notes these often aren’t the end of the story. “Additionally, a smart card management system is required for most deployments, adding to the cost of the PPSD deployment.”

Cost vs. Alternatives

Aside from the administrative overhead and costs of ancillary software such as a CMS and OTP system, PPSDs themselves aren’t cheap. For instance, 2GB devices run around $150 with 4GB devices pushing $200. Compare that to a 4GB flash drive bundled with software encryption for less than $30, and it’s tough to justify the PPSD’s six-to-one price disadvantage if all one needs is secure storage.

The mobility of today’s workforce opens enterprises up to more security risks, according to Hamid. “You either have to compromise security [or] compromise functionality.” He sees PPSDs as a technology that can make security simpler, more portable, and less burdensome. Hamid believes carrying applications or entire desktop environments on a secure PPSD could emerge as an important new security model for mobile users.

Diodati is equally enthusiastic about the market potential of PPSDs but believes they need further development. “While the PPSD has the opportunity to be a stronger authentication market disruptor, the price must come down.” He’s also concerned about the complexity of PPSD deployment. “The orchestration of smart card management systems, key management/recovery, Active Directory, and PKI will remain a daunting task for most enterprises in the foreseeable future.” Hamid agrees that costs are a problem but promises new product lines “with drastically reduced pricing.”

Although the integration of strong authentication credentials and copious encrypted storage in a key fob-sized device promises to enhance and simplify mobile security while giving new meaning to the notion of a “mobile desktop,” the nascent state of PPSD technology means that it’s more appropriate for evaluation and prototyping than large-scale deployment. As hardware costs continue to plummet and management software matures, PPSDs could revolutionize the mobile security landscape.

by Kurt Marko

Key Features Of PPSDs

• Strong authentication via public key certificates or one-time passwords

• Native, hardware-based file encryption

• Portable single sign-on via the ability to carry both a user’s SSO credentials and an on-demand enterprise SSO system

• Ability to securely host a complete portable desktop environment

• Ability to securely carry portable applications, particularly a hardened browser with a restricted operating environment and secure configuration

Source: “Postcards from the Enterprise: The Authentication Experience”; Mark Diodati; Burton Group

Pondering Mother and Daughters

“Honor your father and mother. Then you will live a long time in the land the LORD your God is giving you. [Exodus 20:12].

Thursday, I was in the unfortunate position to hear read the email to David. I was taken aback and wanted to defend myself. Then, the next morning, as per their Mother’s instruction, David forwarded said email to my address.

It is with a sad heart to email you on Mother’s Day to let you know that we are starting down a very scary similar path with Mom….I know that i do not have POA and that I signed papers saying I can never take her to court again so I know that I do not have much power nor do I believe I am up for it again.
The reason I am emailing you is to give a heads up to watch her accounts…I know she has the conservator, Arthur, and I am hoping we can keep him in place so that she does not spend all her money or give it away.

I asked her to go to her counselor here in Atlanta and she said she has an apt as well as with the weird one down on SSI , Dr Devazio (?).

She has started dating a creep – Gae and Dr Andreae’s (the people who live on Sea Island and said she was just eccentric and not bipolar) son named Philip. He is an unemployed international business man that lives in a Fleetwood on Lake Allatoona…not sure of much more and do not really want to know more, but I have an uneasy feeling and my gut says not such a good guy – plus he must know her finances from his parents or at least her history a little…mom does not need to fund him – I realize it is her money and am happy for her to spend it but when it is gone, I am not taking responsibility – I sound harsh but I am talking from my heart.

Not meaning to unload but want you to put whatever legal parameters in that you can and to be prepared for the drama…..

Once again, I wanted to take action!

Throughout the day the following words kept creeping to the front of my head:

“She has started dating a creep – Gae and Dr Andreae’s (the people who live on Sea Island and said she was just eccentric and not bipolar) son named Philip.”

“… I have an uneasy feeling and my gut says not such a good guy – plus he must know her finances from his parents or at least her history a little…mom does not need to fund him …”

Each time these words come into my mind my first reaction is spring to attack. Clearly the author has no idea who their Mother is. They do not have enough trust or respect to believe she knows what she is doing.

Furthermore my father is a very successful Doctor. The author is unaware that he is renowned for his diagnostic abilities. If he as a physician believes someone is eccentric and not bipolar, then, why would a lay person consider impugning the integrity of his assessment?

Through all of this, two teaching brought me back down to earth:

“Suppose someone hits you on your right cheek. Turn your other cheek to him also.”

“How can you say to your friend, ‘Let me take the bit of sawdust out of your eye’? How can you say this while there is a piece of wood in your own eye?”

Finally, one last teaching reminded me that I am not in a position to offer advice, I must remember to be humble, accept life as it comes and always remember these words:

“… You pretender! First take the piece of wood out of your own eye. Then you will be able to see clearly to take the bit of sawdust out of your friend’s eye.”

The only statement I will make on my own behalf is that I will support myself. I will care for those I love and I will always be faithful and true.

THIS IS TO BE DELETED WHEN YOUR MOTHER ASKS ME TO.