Schneier on Security

Frank Cusack • September 22, 2006 2:21 PM

Highly flawed article. The errors make it evident that this is a
marketing piece, not a news or analysis piece (in case you were
confused :-)).

> With this baby you make them two-factor style, fusing something you
> know (your card number), with something you definitely have in your
> possession (your card).

No, that would still be one-factor. If you have the card, you have
the number as well. It's just a little better than the system that
exists today, with CVV codes. Thieves with just the card #'s
(probably stolen from some online db with poor security processes)
can't use them because they don't have the CVV code, in theory. In
practice, in violation of PCI requirements, some vendors (the same
ones with weak security processes which allow card #'s to be stolen)
store the CVV. This was just (Aug 29, 2006) highlighted as the
number one security vulnerability by VISA. So an OTP on a consumer
card serves as a dynamic CVV. In either case (static or dynamic CVV),
authentication is one-factor, not two-factor. But the single factor
is "changed" from something you know to something you have. "Changed"
is in quotes because the CVV is already *supposed* to enforce something
you have, but doesn't succeed in all cases. The dynamic CVV ensures
that the factor is something you have.

> Financial applications are, arguably, the hottest and most promising
> markets for display technology cards, thanks to nearly one-year-old
> Federal Financial Institutions Examination Council (FFIEC) guidelines,
> recommending that institutions to bear the burden of incorporating
> two-factor authentication methodologies into their offerings to
> enhance security.

So now the article promotes the FFIEC guidance (effectively a
requirement) for two-factor authentication, also a misrepresentation.
The FFIEC guidance is to implement reasonable controls, not necessarily
two-factor authentication. The FFIEC has recently (Aug 15, 2006)
issued a clarification explicitly pointing out that multifactor
authentication is not a requirement.

My conclusion is that this one-factor/two-factor confusion and the
FFIEC misrepresentation is not just a misunderstanding, it is a
dastardly marketing deception!

> Why would a cardholder care?
>
> Here's one reason: in growing digital-transaction real-world scenario,
> where more and more purchases are made online, the party on the
> other end receives your card number and security code, but theres
> no way of knowing that you actually are the one holding the card.
> No biggie ... until some ID-stealing thief's trying to purchase a dozen
> iPods online using your number.

Sorry, but a cardholder does not care about this (or should not).
The Fair Credit Billing Act limits cardholder liability for fraudulent
transactions to $50. Many issuing banks go further and have no
cardholder liability.

Card *issuers* should care, and the reason for that should be to
reduce fraud expenses. However, even the current fraud detection
techniques (such as analysis of purchasing patterns), coupled with
punishment, are probably more cost effective than using a display
card. Issuing millions of display cards probably costs more than
it's worth (the cost of display cards is VERY high compared to
today's simple credit card). Even if multifactor authentication
is selected as a technique to combat fraud, either the grid card,
or dynamic CVV delivered via SMS seems to be a better choice
(just as effective and MUCH cheaper).

> "If you're a bank in America, you can brand the card, personalize
> the card, and add OTP functionality to the card itself. It's the
> logical next step in the evolution of a payment card for secure
> online authentication."
>
> According to Ms. de Rotstein, technology such as Aveso's allows for
> easy integration of electronic displays into high-volume printed
> products such as credit cards ...

Perhaps, but not as pictured. The picture, an Aveso card, shows
that the battery is in the space where the credit card numbers are
embossed. Banks in America must emboss cards to support offline
transactions, and the battery will not survive embossing. So the
battery would have to stay only in the top half of the card, and
therefore will have to be much smaller. This will significantly
affect the life of an already expensive card, increasing the cost
to the bank even further thanks to more rapid replacement cycles.
An alternative would be to use deposition, but this is also expensive
(compared to embossing), and not as durable.

There is a [big] place for a display card, but a bank card isn't it.

Frank Cusack • September 22, 2006 2:23 PM

> One of the major security problems with smart cards is that they
> don't have their own I/O.

Smartcards do in fact have their own I/O (of course), it is how
they communicate to a reader. Handheld, standalone (not connected
to any computer), and therefore trusted, readers are becoming more
popular and allow smartcards to be used as OTP systems. Yes, it's
more clunky for the user than the more common use of an online
reader, but the point is that smart cards can already be used today
as independent trusted authentication devices. That's not to say
that an embedded display on a smart card isn't useful -- for one
thing it's one less component (the reader) that has to be trusted.
There's a lot more that could be said here, but let's leave it at
that for now.

This statement also has an error of implication. The article does
not say anything about a smart card and in fact the displays mentioned
in the article cannot be placed on a smart card, because they do
not meet ISO 7816. My company, TRI-D Systems, is already in
production with the only ISO 7816 compliant display card. We have
other features the competition can't touch as well. www.tri-dsystems.com

What's not stated on our web page is that we use a flexible LCD
technology, whereas the competition uses different (non-LCD) display
technology. The advantage of LCD is that it's far easier for us
to integrate into existing chips, in fact we've already produced
OEM samples for several large OTP vendors. This is difficult for
the other displays as the vendor has to design new electronics.

Also not stated is that our customers (both OEM and direct end user)
can choose algorithms at will, whereas our competition limits
customers to their proprietary (in some cases) or HOTP algorithms.
Even when using HOTP, our competition is like every other vendor
and keeps source code to themselves ... not very trustworthy IMHO.
Not only do we make source code available, customers can run their
own code if they like. This is a big deal when the product being
sold is a trust anchor (if you will) for most everything else.

When not part of a smart card, display cards are "just" a new form
factor for the same old tokens in use today. But we shouldn't
discount the improvement in convenience, which increases user
acceptance and is a Good Thing. We see the main advantages of our
card as:

- improved form factor over other tokens
- integrated prox
- integrated smart card
- integrated ID (custom print badging)
- enroll-on-card match-on-card biometric
- source code
- same cost as current hardware tokens

None of those tie the display to the smart card functionality. We
do plan on either using an external [handheld, "trusted"] reader
or embedding tactile buttons on the card for use as PIN and transaction
input to the card, but this is mainly to assist with offline
authentication.

As far as having trusted output from a smart card, I'm not sure
this buys a lot. Would you verify each transaction? Users aren't
going to do that.

I guess it's useful to have transaction data (signature input) be
displayed, when using a non-trusted reader. This is useful for
cash transactions, but as I argued in an earlier comment, the cards
are too expensive to be cost effective. hmm ... for stored value
cards this might be valuable protection (that consumers would be
willing to pay for), but in the US these aren't popular.

Are there other good uses of tying the display to the smart card?

Frank Cusack • September 22, 2006 2:24 PM

@Not Anonymous
> This is really great news. I would happily pay a modest fee to have
> my bank card upgraded to use this technology.

Why? You are already indemnified against loss.

Frank Cusack • September 22, 2006 2:25 PM

@Carmudgeon:
> The bigest single factor to stand in the way of the adoption of
> technology like this will still be cost. Banks are still too cheap
> to give you the security you deserve.

Which is a good thing. Banks should give you the security that is
most cost efficient.

Frank Cusack • September 22, 2006 2:26 PM

@Not Anonymous:
> There is a clock built into the card that keeps track of time
> reasonably accurately (drift is less than 1 minute per year).

No there isn't. The cards in the article do not have a clock, they
are event based. No one except my company, TRI-D Systems
(www.tri-dsystems.com), has production capability to build time-based
cards today. For competitive reasons, I won't go into why that is.

> There is a number on the LCD display based upon a hash of the time
> (this is the tricky bit).

Actually that part is quite easy.

Frank Cusack • September 22, 2006 2:26 PM

@DoubtingThomas:
> This is an expensive, niche technology.

wrt banking yes.

wrt enterprise authentication, you are right, it is expensive --
to produce. But for the customer, it's actually cheaper than current
solutions even when used solely as an OTP token. But then add in
the very high integration capabilities (id badge, prox, etc., as I
pointed out in an earlier comment) and it is far cheaper and more
user friendly than the current solutions.

It's certainly not niche.

Frank Cusack • September 23, 2006 1:06 AM

@Flexible Friend:
> In RLI RA, the time hash is unique for every clock, except an
> identical device/system at the BT exchange. This may seem implausible
> at first glance but I assure you this is so.
> When a use logs into RLI RA, the time hash entered into the VPN
> client (read from the key fob) and the time hash at the BT exchange
> simply must match. This is what I meant by "tricky"

That is indeed tricky.

> Perhaps separating the keyfob from the credit card is actually a
> security advantage anyway?

Good point. That may be true, I'll have to give it some thought.

Frank Cusack • September 23, 2006 1:21 AM

@Flexible Friend:
> £50 of friaud is lost in UK?

That is what the law says in the US also ($50), but visa goes further to $0.
It's a good way to promote use of credit cards.

> Surely the banks will not just say "OK, there's your money back".

I had my credit card stolen once a long time ago, maybe 15 years
back? Back when carbon paper was used to make two copies of a
credit card transaction receipt. I didn't lose the actual card,
but someone apparently stole the carbon from the trash. A fraudulent
charge was made on the same day at the same store. I don't recall
how I learned about it, but yes it was that easy to get my money back.
I was not liable for $50 even.

This past valentine's day, I ordered flowers which never arrived (ouch).
My card was still charged. I called the issuing bank to initiate a
chargeback. The only hassle I got was the rep asked if I had contacted
the merchant first. I explained that I had called several times over
several days and each time after navigating through a complicated
telephone automated attendant menu, would either get disconnected
or transferred to a busy signal. Also, I emailed multiple times
and never got a response. The rep refunded the charge right there,
however I did receive notice in the mail later that the charge might
appear again pending merchant dispute. (Later the merchant acknowledged
the chargeback.) Not fraud, but I hope a reasonable real-life example of the
banks not putting too much onus on the consumer for liability.