https://modernconsensus.com/technology/building-digital-dollar-requires-private-sectors-help-fed-chairman/
Clearly, I am a bit behind.
Tag: Philip Andreae
Van Buren v United States
Date & Time:
Tuesday, June 29th, 2021
10:30 AM PT | 1:30 PM ET
Explained: A Legal Perspective on the Future of Cybersecurity Research
The Supreme Court’s Van Buren decision earlier this month aimed to clarify the ambiguous meaning of “exceeding authorized access” in the Computer Fraud and Abuse Act, the federal computer crime law.
In the context of protecting critical infrastructure from hackers, this particular ruling will define how we manage, report, and handle unauthorized access.
It also raises some foundational questions that, if weighed carefully, have the potential to foster a collaborative relationship between researchers and companies. How should good-faith researchers conduct themselves? Does this redefine the relationship between companies and hackers? Is every researcher considered to be in violation of CFAA if they’ve not sought permission to access a system?
Jared L. Hubbard and Christopher Hart have followed this ruling closely and worked on amicus briefs to aid the Court in this matter. They will discuss the case and answer questions.
Speakers:
Jared L. Hubbard, Partner, Fitch LP
Christopher Escobedo Hart, Partner, Co-Chair, Privacy & Data Security Practice – Boston, FoleyHoag LLP
Register on Eventbrite
Follow us on Twitter and LinkedIn to stay in the loop with updates!
Copyright © 2021 Voatz. All rights reserved.
Philip in the News
What is a DAO and how do we govern tomorrow
Distributed autonomous organizations, a DAO.
When we think of governance and how we control society, we immediately must consider the realities of people in the tribes they belong to.
Recently the emergence of bitcoin, the understanding of the power of a distributed ledger, the use of a hash chain, the power of cryptographic processes, and the security of the devices we carry establishes a foundation for a brave new world.
What is governance? It is the method processes and mechanisms a society puts in place to establish order and ensure harmony?
The ancient Turks, Greeks, slave spoke of democracy, the idea that each member of the tribe, the town, the city, or the state could assemble and determine new laws, regulations, and best practices. We then evolved into Republican governments the concept of a group of people representing a larger number of citizens.
Influence and power define what shall evolve. In my lifetime, the idea of being able to plug the handset of your telephone into the back of a terminal and establish a connection to a computer somewhere out there was a novelty. For my father it is Time in Geneva when Aryanism stood out as a challenge, opportunity or threat. Telephones were just emerging and radios were available. TV was still not present. Paper books and libraries surrounded the environment we will call Geneva.
City on the Lake, what is this thing place in his history his is as relevant as your or mine.
One question why anonymity at the profound process of engagement. When you are something called anonymous I am not sure I want to play. If your anonymous is mandatory; I don’t want to play.
The innovative spiritual and the. Nurturing essence of life.. How this evolves involves countless engagements.
Each sublime note to the fabric of the virtual environment we present to the public is.
And, all of us form the fabric of the public.
He answered them, “And why do you break the commandment of God for the sake of your tradition? 4 For God said,* ‘Honor your father and your mother,’ and, ‘Whoever speaks evil of father or mother must surely die.’ 5 But you say that whoever tells father or mother, ‘Whatever support you might have had from me is given to God,’* then that person need not honor the father.* 6 So, for the sake of your tradition, you make void the word* of God. 7 You hypocrites! Isaiah prophesied rightly about you when he said:
8 ‘This people honors me with their lips,
but their hearts are far from me;
9 in vain do they worship me,
teaching human precepts as doctrines
“Listen and understand: 11 it is not what goes into the mouth that defiles a person, but it is what comes out of the mouth that defiles.”
What shall we do? Simple honor the one Jesus answered, “The first is, ‘Hear, O Israel: the Lord our God, the Lord is one; 30 you shall love the Lord your God with all your heart, and with all your soul, and with all your mind, and with all your strength.’ 31
You commit to what you believe in with a robust desire to adhere to the moral imperatives. The one God is the same God written about in so many different ancient lore.
The second is this, ‘You shall love your neighbor as yourself.’ There is no other commandment greater than these.” 32
32
Who is your neighbor?
Anyone you engage in an event. An event is is anything we all seek to record. By the way any unit of one can record as long as all parties are aware. It is our contracts and promises. Those such as payment, voting, identity and influence.
See you next time.
Identity in the Digital World
Voter suppression cannot be what the political parties seek
I am confused. I thought the goal of a democratic society was to ensure each citizen of age had the ability and the right to vote. In 2020 there was and still is a pandemic often in history there have been natural disasters these challenges create issues voters have to consider when attempting to voice their intent on who shall represent them at a city, municipal, county, state, or federal level.
Many legislatures, Secretaries of State, or Lieut. Governors decided to expand the ability for voters to vote by mail. Our previous president argued mail-in voting was subject to fraud and built a case or better-said conspiracy theory that would allow him to contest the election of Joe Biden as the 46th president of the United States. Now the GOP is busy attempting to rewrite the law that will remove the ability of those unable to attend the voting place to use mail-in ballots. Why one should ask! To restrict the number and class of people who can vote in a democracy is unacceptable. Our political class should wish and work and make sure our democratic process of voting enables each of us the ability and the right to vote. Any attempt to limit someone’s ability to vote should be classed as a criminal act. By making this statement one could easily argue the GOP are criminals.
Often in history, those who seek power seek to suppress those who wish to also participate. We can only hope the good people of this country will decide that we are a free nation built upon laws that engender respect and seek to include everyone.
Voting Needs to Be Easier. Period
Voatz Has Successful Developed a Mobile Voting App Used in the 2020 Presidential Election
Reflecting on the year 2020
This morning I am drawn by the press to reflect on who and what we are.
I was glad to read this editorial from one of the various pro-Trump papers. https://nypost.com/2020/12/27/give-it-up-mr-president-for-your-sake-and-the-nations/
It causes me to believe that this nation would be great if “we the people” found common ground and work together to build upon our ancestors’ creation.
We have issues with race and wealth https://www.minneapolisfed.org/events/2021/racism-and-the-economy-focus-on-education.
This discussion of race then leads us to reflect on our history and how the south effectively established segregation as a means of voter suppression. https://www.economist.com/christmas-specials/2020/12/19/reconstruction-reshaped-america-along-lines-contested-today
We distort the truth to satisfy the minds of those in power. Greed and pride are two sins we each must own and work to remove from our evil character.
We must remember, we construct history to serve those who seek to control and influence our young and impressionable children https://twitter.com/pandreae/status/1343923775998455810.
The courts, multiple states Attorney Generals, and those who ran the elections in over 9,000 jurisdictions all agree we worked tirelessly in the face of a pandemic to enable the American citizens’ right to vote. https://www.brennancenter.org/our-work/analysis-opinion/election-lessons-2020
We must respect the people’s decision and stop attempting to claim fraud when no one can convince a court of law and the republican judges appointed by Donald Trump that there was massive voter fraud.
We then must also recognize there was an active attempt to intimate people. https://www.propublica.org/article/pistols-a-hearse-and-trucks-playing-chicken-why-some-voters-felt-harassed-and-intimidated-at-the-polls White men banishing guns carrying Trump flags is the typical image we saw throughout this nation.
And, Today, our President shares his anger with the general public https://twitter.com/realDonaldTrump.
It is time we restore order, accept the will of the people, and work together for the future we all crave.
Where are we in this age of dis-information
It is 11 AM December 6 and I wonder about the past and future of the United States of America. The news is divided. There are those that focus on the Trump-centric right-wing media. There are then those that focus on the Biden-centric left-wing media. The challenge where is the truth. For those capable and willing to watch both sides of the story we may be able to fathom reality. For those fixated on one side or the other, they are no longer are capable of appreciating where the middle of this country lies.
November 3 we had an election and over the next several weeks it became clear that Joe Biden would be our new president. Unfortunately, the current president Donald Trump could not nor would not accept the fact he lost.
In 2016 the popular vote said he lost. Based on how our Constitution is written, the electoral college decided he won. We had to accept this truth and we had to get on with life.
The challenge, since then we have had to live with the lies, the untruths, and the constant cry “fake news”. We had to deal with the constant barrage of POTUS reminding us he is a narcissist, he is the president of the United States, and recognize he was allowed to lie to the public. Is he sane one might ask. Are we?
Digital Identity and Authentic Relationships
When we think of investing in various businesses the goal, of course, is revenue. One of the keys to such success is loyalty. Loyalty is all about the relationship companies create with their customers and the revenue these relationships assure.
If the buyer has something the seller wants, in exchange for the good or service they desire, then a transaction occurs. The challenge is simple, each party defines the value of what they are providing or exchanging and presto the trade occurs.
When society grows and the complexity of what each of us produces and when our needs are not aligned to this process called barter, a means of monetization is established. Society creates a trusted means of exchange – pebbles, coins, money, a promissory note or now even, some would argue, cryptocurrencies.
In other words, society created an answer to enable the exchange of goods and services between parties, who do not have the goods and services the other party seeks.
With cash, coins or other tangible representations of value, commerce is easy. When society does not develop a secure and trusted means of facilitating the exchange of things commerce, innovation and a good life cannot be achieved. To this end, paper money is imbued with ‘value’ based on the integrity of the party issuing the physical or now electronic ‘money’. The addition of the word ‘electronic’ brings technology, computers, and networks into the conversation. One network, typically referred to as the Automated Clearing House ‘ACH’ allows banks to electronic instruct the movement of ‘money from an account at one bank to an account at another.
The addition of the word ‘electronic’ brings technology, computers, and networks into the conversation. One network, typically referred to as the Automated Clearing House ‘ACH’ allows banks to electronic instruct the movement of ‘money from an account at one bank to an account at another. The use of an ach check processing system for business transactions between vendors and customers has become increasingly common in addition to banks. The advantage of this system is that it usually allows businesses to transfer money automatically between bank accounts so that their payments can be cleared out in a short period of time.
In the 1958 Bank of America created Visa Inc., in 1964 the Wallenberg family created Eurocard, and then in 1966 a collection of banks banded together to create the Interbank Card Association, Mastercharge and now MasterCard.
These payment networks, by necessity, add complexity. They create the need to establish a two sided market. On one side the relationship with the buyer, consumer, or cardholder. On the other side if this market the seller, merchant, or retailer.
Issuance and Acceptance. Two words to describe the two sides of a network. It’s only when the two sides of the market have sufficient participants. Only at the tipping point, when critical mass exists, can one claim to have created a self-sustaining network. A network of people promoting use to buyers and a network of merchants willing to accept payment based on the terms and conditions defined by the network. Beginning at this tipping point, the network and it’s Brand blossoms. If either side of the market does not achieve critical mass, the network collapses.
Relationships – The oil of commerce
Any two entities familiar and trusting in the Brand, or each other, can easily establish a temporary relationship with entities associated with the brand. If one or more of the entities require anonymity increases the level of trust and recognition the Brand must establish with these participants.
In a digital environment, we are in need of mechanisms to share and establish trust across trillions of electrons. The two sides of a relationship, in other words, the market, will not take the time to understand or appreciate the need for network and endpoint security; until the risk exceeds a threshold understood by the participants.
The Artifact of Trust
When a mutually trusted set of parties gives the citizen, consumer, employee or courtier a letter, card, device or any uniquely registered object, and provides every acceptor with a reader capable of recognizing the trusted thing. Then the two parties are in a position to establish “trust”. The consumer has a thing which is recognized and trusted by the acceptor. This is often referred to as “What You Have”.
Once the thing is recognized by the acceptor, then, the process of identification and authorizations (the transaction) can take place. The object – the artifact – carries an identifier. It possesses unique characteristics. The object also possesses a means of assuring the acceptor the presentation of that identifier represents a unique representation of that identifier.
The simplest artifact of establishing “trust” is a handheld thing, be it a key, fob, card, watch, pendant, phone, earpiece. It does not matter what it is, all that counts is that the merchant recognizes it and that the consumer is willing to carry and present it.
Trust, for the merchant, means they can, according to defined procedures, recognize and authenticate the thing. They are then in a position to pursue a temporary and trusted relationship. What can be achieved during the time the relationship of trusted is bounded, is constrained by an additional layer. In this layer the consumer, the acceptor and any third parties address which the rights and privileges are to be granted or pursued. This is when the exchange, sale, conversation, tranaction, event or access is granted.
Voting in the age of technology
Voter suppression, voter apathy and voter regret are what we feel, hear and must tolerate.
COVID-19 the corona virus and the ranting of the American President set the stage of an interesting lead up to the November election.
How will we assure the success of the election. We worry about polling places not being open creating very long lines at those polling places we are able to open. We think about Vote by Mail and wonder if some states will even allow those seeking to maintain social distance to request and absentee ballot. Worse still he whose name should not be spoken will accept the results of an election where a significant segment of the population will have taken advantage of the healthier Vote Remote option.
All this said there is another way to enabling the people to express their opinion. We could take advantage of technology. We should ignore those who live in the past and argue technology can never be secured and call this “settled science”. We could bring together the practitioners who are securing technology and ask them to work together to make sure those solutions already pilot tested are as secure as is possible.
Voatz has created a Remote Ballot Marking solution built on the secure foundation of current generation mobile devices. A platform built to mutually authenticate the verified voter is eligible to vote, the device they are using is secure and not infected with malicious software, the communications is encrypted to assure no one can see who the voter decided to vote for, the secure cannot be hacked and each vote is immutable.
All of these security precautions then enhanced with sophisticate detection techniques designed to monitor and make sure those who attempt to attack the system are identified and prosecuted.
Security is inherent in Voatz’s design as is the simplicity of the user interface. A user interface designed to assure everyone, no matter their situation or disability to ability to vote.
Voatz began by focusing on serving our military. People who do not have access to printers, the post office or any other means of casting their ballot. What they do have is a mobile phone and access to the internet. Voatz makes sure they could vote. Voatz then saw an opportunity to serve those with disabilities. With these two constituent solved for Voatz is ready to help each and every America election authority protect your right to vote.
The next step is for you the people to demand the ability to vote. Ask the secretary of state or lieutenant governor to work with Voatz to offer Vote by a Phone as an option this year.
Settled science
In March 2020, I moved from the payments industry into the election industry. This movement caused me to wonder about democracy, politics, academia, and the world of technology. What amazed me is how computer science academics could rail at the idea, technology could be used to innovate on the election process. Years ago I imagined participating in a national referendum simply by opening a browser searching for the government website and voting on the measures and contests currently under consideration.
Unfortunately what I’ve learned troubles me. Certain clusters of intelligent individuals believe that they know best. They stigmatize technology and argue that a human being, who writes software, could leave unintended bugs which might lead to unintended consequences. They forget software is an evolutionary science. Through piloting, continuous improvement, testing, and rigorous testing we can eliminate bugs and create stable and secure critically important applications serving our financial, health, national security, and public interests.
Recently in a letter written by verified voting, a nonprofit organization, the word settled science appeared. An intriguing word, an intriguing phrase. I was driven to wonder what did it mean. From my high school years, science was an evolutionary process. A hypothesis was put forward. it was tested. If it was found to be false a new hypothesis was offered, it was tested and on the scientific community went. In one article when googling “Settled Science” I was intrigued to read the word oxymoron followed by an explanation of how if Sir Isaac Newton’s beliefs had been settled science Albert Einstein would never have been able to put forward the concepts of general relativity.
This whole conversation feels very much like a religion, a church, who has a dogmatic belief in the written word of the Bible being the written and only word of God. We forget how man inserts himself into every dialogue. Too often we insert our beliefs on others. Maybe “Settled Science” is the dogmatic belief that we are right and everyone else is wrong.
If this is the case then how do we move forward? If scientists – academics force there will on society than society has lost its objectivity.
The Means of Payment And the Method of Payment
Two words each can be seen as the same as the other. Yet, it is important to create a distinction.
The method of payment should be related to how we execute and not from where the money comes. The means of payment should relate to the source of funds.
Too often, we allow these terms to get lost. Is tapping a payment card at the point of sale or typing in the 16 digits printed or embossed on the card a means of payment? I would argue not! This is the method we use to inform the merchant how they will be paid for the goods and services we seek to procure.
When we talk about the means of payment, we should focus on the source of funds. Are these funds held on deposit, funds in the wallet, or a loan of funds?
Our vocabulary is rich in confusion. These two words in the complex space of payments need to have independents reason.
As an example, I use Apple Pay to pay does not mean Apple is involved in managing the funds. It is simply the method used to share the payment card details with the merchant, enabling the merchant to request funds from the account selected by the user through the Apple Pay user interface.
The Card Was and Is Only a Credential Carrier
Cash is here to stay – cards are the true dinosaurs
This question of the extinction of the payment card is misleading.
What is a payment card? It is the carrier of a set of credentials, A means of Identification offering financial Attributes capable of being authenticated by a party seeking to sell something to the individual or entity presenting the credential as a mechanism to assure payment.
Back when credit cards were designed, the goal was to offer merchants a guarantee of payment and anonymous consumers a means of paying. Behind this means of payment, a financial institution, the issuer, provides the consumer with a “Line of Credit”.
On the merchant side, another financial institution buys these guaranteed receivables from the merchant and charges the merchant a “merchant discount”. Later that day the Issuing Institution advances payment to the Acquiring Institution based on an agreed set of terms and operating rules. Terms and conditions the involved financial institutions collectively agreed upon.
For this method of payment to be effective, a large number of consumers and merchants had to agree to participate; hence the financial institutions came together and formed what we now know as MasterCard and Visa.
Given the state of technology at the time it was essential this new mechanism work without the burden and expense associated with the merchant, supported by the acquirer, contacting the issuer to receive approval, or, in stronger terms be assured of a guarantee of payment. To achieve this result, the merchant needed something to acquire the necessary information to submit a request for payment. For both the merchants and financial institutions,, there had to be a means of authentication. Designed to assure the responsible parties of the authenticity of the person or entity to present their payment credentials.
To accomplish this goal, just like with money, physical security features are integrated into the payment card designed to allow the merchant to authenticate the uniqueness of the card carrying the payment credential, thus assuring the merchant of the authenticity of the card.
Overtime criminals successfully counterfeited these security features.
As these features were compromised additional features had to be added.
Today, a computer has been embedded inside the card, in order to assure the authenticity of the payment card credentials being presented to the merchant.
These computers embedded onto the front of a payment card exploit the power of cryptography. Cryptographic certificates and digital signatures are created by and for these computers, allowing:
-
- The Issuer (symmetric cryptography) to support Online Authentication
- The merchant (asymmetric cryptography) to support Offline Data Authentication
These two mechanisms prove to the merchant and issuer that the card is unique and the data, credentials, and digital signature it contains or produces are authentic.
Once all the merchants have are capable of reading the data from the chip card, the security features of the card become redundant.
As these features become redundant and the merchants embrace Near Field Communications, based on the ISO 14443 standard, the issuer can replace the card form factor with anything equipped with the necessary computational capabilities and ability to communicate with the terminal over the NFC interface.
This is exactly what Apple Pay and Google Pay have done. They replaced the card with a device. Yes, the Payment Card may become redundant. But, the Payment Credentials they contain, remain.
What we know as card payments, is fundamentally an account-based solution. Money, through the defined settlement process, ultimately move from the line of credit or deposit account of the buyer, through a series of accounts with the participating financial institutions, to the account of the merchant.
Card-based credential payments
simply become
Device-based credential payments
What has this world come to
When we listen to the news, we must think first of the bias of the reporter. This unfortunate truth is troubling in a world where the United States leader speaks of fake news and uses Twitter to stir up the masses. This body of citizens struggles with truth and is easily bent to believe what the leader says.
This particular charismatic leader, like many others in the past, can cause people to believe anything. The challenge, these same people will follow both those with high morals and those without.
Jesus Christ, Siddhartha Gautama, Confucius, Laozi, and a few others spoke wisely and became spiritual leaders many continue to follow.
To name one well remembered, Hitler, like the recent President of this great country, spread lies, and fermented hatred.
How can we rise above when so many are unwilling or unable to see the truth. We must rise above the madness these charismatic immoral individuals ferment.
That is the concern I have felt since first I looked upon the control a church exerts upon the mass.
EMVCo Good or Evil
https://www.securepaymentspartnership.com/wp-content/uploads/2019/12/Payment_Insecurity_Final.pdf
In 1993, I was asked by the then CEO of Europay International to establish a relationship with Mastercard, and Visa focused on developing the specifications necessary to assure the interoperability of chip card-based security for credit and debit payment cards. The result published in 1996 was the “EMV Integrated Circuit Card Specifications for Payment Systems.”
From these humble beginnings, EMVCo has emerged as a key organization in managing the standards behind card payment systems. In the white paper Payment Insecurity, commissioned by the Secure Payment Partnership, the author reminds us of the difference between standards managed by an open body and those tightly controlled by an exclusive group of competitors. One wonders if the owners of EMVCo will listen and strive to open up their membership or continue to use this entity to protect their proprietary interests.
In the introduction, the author speaks of a series of questions he intends to address. The first question of the paper
Is EMVCo furthering the entire U.S. payments industry or simply protecting Visa and Mastercard’s market share? page 5
begs the question, why limit the discussion to the USA?
This American only focus is driven by the desires of the Unaffiliated Debit Networks and a set of merchants. The paper ignores fundamental and, yes, anti-competitive elements of the EMV specification – the AID or the Application Identifier. It was and is directly related to the Brand responsible for the underlining technology incorporated into the Chip.
I then read the following complaint and am driven to ask how the consumer interpreted the prior Debit versus Credit prompts.
Visa’s response to this solution was to require merchants to display to consumers a choice between “Visa Debit” and “U.S.
Debit” at checkout. – page 13
In essence, what Visa required was simple, the terminal should comply with the EMV specification for “application selection,” key and inherent in the multi-application design of EMV and the underlining ISO 7816.
Moving further into the document in Section 6.1, the author attempts to document the history leading to the creation of EMVCo. As one of the founding members, the author’s sources were not involved and did not understand the history.
First, only France had a smart card solution designed to address Credit and Debit card fraud. They referred to their implementation as B Zero Prime.
Second, the UK in 1995 was driven by Visa to embrace an earlier version of the Visa specifications adapted to the unique requirements of the UK market and branded UKIS. UKIS and the unique UK requirements are responsible for changing many of the shall’s in the EMV 2.0 version of the specifications to should’s in the EMV 3.0 version. This accommodation was the result of legacy limitation within the X25 network the United Kingdom depended on for card authorizations.
To further identify issues with his record of history, the statement on page 22
EMVCo developed standards for chip cards that could work with credit, debit and stored-value cards
It is fair to suggest EMV attempted to incorporate Stored-Value cards in the specification. But as a result of the competitive realities of Europay’s Clip, Mastercard’s Mondex, and Visa Visa Cash stored value solutions, they agreed to exclude stored value cards from the specifications.
It then goes on to suggest EMV compromised and offered a Signature option. There was not a compromise; it was intentional. The goal, afford the Issuer the ability to determine, by Cardholder, which cardholder verification method they could be configured for. One need was to address issues of the disabled, e.g., the Blind.
Debit Routing as a result of the Durbin amendment. One might wonder why EMV did not consider this idea of multiple networks associated with a card.
EMVCo was unable and unwilling to resolve the lack of a debit AID because EMV was never designed for the U.S. market.
I sense that there is another front coming out of the Debit Networks seeking to argue the anti-competitive nature of EMV. The paper, link below, draws me to wonder about the argumentation surrounding “Application Selection.” Please let’s get back to basics – the “AID=Brand=Payment Scheme” drives “Routing.”
On page 13, it argues consumer confusion. I would argue it ignores the past. The EMV default user prompts of “Visa Debit” and “US Debit” are no more confusing than the historic “Credit,” and “Debit” prompts. I would argue consumer confusion already existed. The EMV specification for Application Selection simply afforded the Issuer the ability to provide more descriptive prompts by employing the “Application Preferred Name” instead of the default “Application Label.”
This whole fight surrounding EMV and Payment Security is really a fight about the future of Card Payments. On one face, they argue the Payment Networks did not assure the security of the card payments to protect revenue. On the other hand, they argue EMVCo is a closed standards organization designed to protect and assure the interests of its shareholders, without consideration for the other stakeholders in the payment, e.g., the merchant.
In the end, the argument comes down to the role, definition, and control. How we structure the underlining payment transaction is what we need to talk about. Who provides the mechanism, guarantee, and support for a particular mechanism decides the rules.
The Surveillance State Exists for Profit
I hope we all understand the data collected on each of us
https://www.nytimes.com/interactive/2019/opinion/internet-privacy-project.html
https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html
As a technologist, the revelation of what is available did not surprise me. I understood how location can easily be captured from all of the electronic devices I use. Be it the GPS chip, the triangulation of Cell Towers or the IP address of the router I am using to access the Internet. Where I am is easily acquired by any application or server I am employing.
What bothered me is that “We the People” have not pushed our governments to regulate the capture and use of this very personal information and data. What bothers me is that most of the citizens of this country or this world do not take the time to read the terms and conditions or the privacy statements provided to us and so often simply consented to them without a thought. And, if they did read them, most of us would not appreciate the language and therefore the meaning of these legal documents.
The surveillance state is real. Marketing companies, employers and so many others are buying the data and using it to improve their delivery of services, advertisements and so much more.
https://www.linkedin.com/pulse/i-hope-we-all-understand-data-collected-each-us-philip-andreae/
The Identifier should not be the Authenticator
I was asked to look into the value of the EMV Secure Remote Commerce Specifications. In the first section they wrote:
“1.1 Background … While security of payments in the physical terminal environment have improved with the introduction of EMV specifications, there have been no such specifications for the remote commerce environment. …”
This statement caused a bit of angst. It caused me to think of the work to create SET and Visa’s efforts to promote the original version of 3D-Secure. I was further reminded of how difficult it has been to find the balance between convenience and fraud and how merchants are more worried about abandonment than they are about the cost of fraud. Ultimately, it caused me to wonder about the goal of the EMV 3-D Secure specification.
“To reflect current and future market requirements, the payments industry recognised the need to create a new 3-D Secure specification that would support app-based authentication and integration with digital wallets, as well as traditional browser-based e-commerce transactions. This led to the development and publication of the EMV® 3-D Secure – Protocol and Core Functions Specification. The specification takes into account these new payment channels and supports the delivery of industry leading security, performance and user experience.”
The keywords found in the last sentence “the delivery of industry leading security, performance and user experience” suggest these two specifications are searching to solve the same problem.
According to the Oxford dictionary
Security is
- “The state of being free from danger or threat.”
- “Procedures followed or measures taken to ensure the security of a state or organization.”
Authentication is
- “The process or action of proving or showing something to be true, genuine, or valid.”
- “Computing The process or action of verifying the identity of a user or process.“
On this same page, the authors go on to make the following statement
“… there is no common specification to address the functional interactions and transmission of data between the participants.”
This then causes me to wonder about the original ISO 8583 specification, the current ISO 20022 specification, and the subsequent concept of the three-domain model within the 3D-Secure specification. All three of these specifications define the interaction between the participants while not restricting the method of transmitting the data. It seems the authors of the SRC specifications have forgotten history. Or, are they trying to rewrite history.
At this stage, Authentication seems to the most important part of what EMV is attempting to address. But, the focus seems to be more about rewriting history that solving the fundamental problem. We seem to have this desire to take public identifiers and convert them into secrets.
“An industry transition from a dependency on Consumer entry of PAN data can be accomplished by providing an SRC specification that meets the needs of all stakeholders involved.”
These intriguing contradictions beg the question. Why did the authors of the Secure Remote Commerce specification not reference the good work of those that created the 3D-Secure specification and propose an approach unlike EMV? They all are part of the same organization!
Is the goal not to address authentication and Security of the payment transactions, be they instore or on the Internet. I would argue
We allowed the PAN, the payment card identifier, to become a means of authentication
This use of the PAN as both an identifier and an authenticator; reminds me of a hearing of the United States House Committee on Ways and Means May 17th, 2018 hearing on “Securing Americans’ Identities: The Future of the Social Security Number”.
“House Ways and Means Social Security Subcommittee Chairman Sam Johnson (R-TX) announced today that the Subcommittee will hold a hearing entitled “Securing Americans’ Identities: The Future of the Social Security Number.” The hearing will focus on the dangers of the use of the Social Security number (SSN) as both an identifier and authenticator, and examine policy considerations and possible solutions to mitigate the consequences of SSN loss or theft.”
All the witnesses and most of our members of congress accepted and understood the problem. We allowed a simple government-issued identifier to become a means of authentication, in other words, an authenticator. Like allowing the social security number and now also the PAN to become part of how we authentic someone’s identity. We caused these publically available identifiers to become valuable and sensitive PII data.
Cardholder Authentication and Consumer Device Identification
What is clear, as one continues reading the SRC specifications, is the goal is to reduce the frequency of presenting payment credentials on merchant websites.
“Minimising the number of times Consumers enter their Payment Data by enabling consistent identification of the Consumer and/or the Consumer Device”
A very different approach to what the payment schemes do with the EMV based payment process. The authors of EMV saw the PAN as public data, they architected something designed to assure the uniqueness of the card and the ability to positively verify cardholder. Card Authentication and Cardholder Verification.
Why not simply think and focus on the same architecture? Simply change the word “card” to “device” and focus on Device Authentication and Cardholder Verification or as everyone is promoting Multi-Factor Authentication. We simply need to make sure the thing is genuine and the right individual is using the thing. The thing is what the cardholder has – The “what you have” factor. Add a pin/password or better still a biometric to be the second factor the “what you know” or “what you are” factor.
EMV 3D-Secure creates the ability to exploit the “what you have” factor by offering Device fingerprint data to the issuer’s authentication process.
Pay to be Paid
An interesting concern and a telling phrase. When one Googles the phrase “Pay to the Paid” the result takes us into the contracts associated with Protection and Indemnity insurance P&I.
When I entered the search term, I was thinking about how financial institutions see ‘payments’ as a revenue source. In particular, the word ‘Interchange’ springs to mind. I remember sitting in a management meeting in Foster City, at the Visa International offices, as we discussed the results of a McKinsey study this study stated the banks were not earning from their most frequent activity – processing payments.
We then as Visa saw a need to help our members appreciate the breadth and complexity of this simple word “Payment”. Payment Zsars and Gurus were all the rage. International Banks spent millions to create payment factories capable of supporting ACH, WIRE, Swift and card payment. Was the goal to streamline the process? For some, yes! For others, the focus was on reducing costs. For others, they focused on creating a sticky proposition capable of assuring long term relationships with their corporate clientele. For all, increase revenue and profit.
Did any actually think to focus on streamlining the mechanical process of moving money between two individuals or entities? Many will argue yes. Why did they not seek to develop Real-time Gross Settlement Systems, RTGS? Why is it only new economies that saw these opportunities?