Authenticating online transactions

The payment ecosystem is comfortable with the authentication of a payment card holder at the time of retail transaction (about 1.5 basis points of fraud). In retail transactions, the user is authenticated by the checkout clerk, and the payment session is authenticated by the payment server. Two sets of checks using independent channels.

In online commerce, similarly, multi-factor authentication (MFA) is being used for strong authentication to achieve the same degree of authentication. The authentication factors used, include:

• What you have (the payment card) [weak as a factor unless a card reader is also involved]
  
• What you have (the cellphone / hardware token registered with your card)
  
• What you know (the PIN)
• Biometrics (who you are): This is being used by some, with the potential for increased usage)
• One-time password / Signature (yet another knowledge factor [what you know])
  

Banks are deploying hardware in a variety of form factors to enable MFA for [more] secure online commerce. There is lots of debate whether these investments are appropriate or being mis-directed.

Unconnected Chip-n-PIN readers are being endorsed by payments associations and being deployed by European banks to generate OTP (one-time passwords) for secure access to online banking sites. The simplicity of unconnected card reader devices make them secure. They are not connected, therefore are less prone to being attacked by malware. However an additional device to carry around when you travel (or otherwise) is not terribly convenient. There is still the issue of Adversary/Man-in-the-Middle (MITM) attack.

Using SMS as an alternate delivery channel is another alternative (saves cost of deploying readers and hassle of carrying readers around). Cell phones are used to communicate the OTP or Transaction Number (TAN), which the user enters at the online site. For those that don't care for cell phone and/or SMS/text messages, an IVR (interactive voice response) variant of the above is also used.

Hardware token, either the unconnected kind or the USB kind, are also used, but not in the same class of security solution as what you know (PIN) is not involved.

The emerging consensus, including observing the above alternatives, is that a hardware based solution over an alternate channel be used to generate/communicate the additional authentication factor (what you know). See related post here and here.

There are varied opinions about the usability and security profile of these offerings, including:

• Does a Chip-n-PIN reader put a user at physical risk?
• Is SMS safe enough (SMS is a non-confidential plain-text channel)?
• Are smart phones safe enough?
• Should one of the authentication factors be sent over an alternate channel. E.g., user sends the OTP or TAN over SMS to thwart MITM attacks
  

Are the current approaches to securing online transactions adequate? Are there any fundamental lacunae that we need to plug to get a solid foundation on which we can build the necessary security solution? What are your thoughts?

[10Aug09]: Interesting related post from Finextra (link)

Innovations, such as EMUE's card, can get us going again

Very rarely do you see so much buzz about a new payment technology as EMUE's display cards. This is indeed an exciting innovation. This card has the thickness of a traditional credit card, while it has a 8-digit display, 12 digit keyboard and a battery that last 3 years! Wow, this is truly amazing.

This product has the potential of being applicable in a variety of markets, including the US.

The ability to leverage the above product features to support MFA (multi-factor authentication) using a single device is what makes this product exciting. To appreciate this innovation, compare against the Gemalto CAP (Chip And PIN) reader being tailor-made for Barclays (PINsentry) to support MFA for online commerce. Who would want an add-on device if your payment card can do it all? The additional cost of the EMUE card (costs 5 times as much as an ordinary card to manufacture) looks inexpensive when compared to shipping CAP readers to customers.

I see an immediate opportunity to use this card for MOTO (Mail Order Telephone Order) transactions. Visa is piloting this card with bank(s) to complement VbV (Verified by Visa). I am not sure that the problems that merchants and consumers have with VbV will be addressed by using EMUE's card.

You get so excited when you read about such innovations that you forget that the economy is supposed to comatose.