American Express is First Card Issuer to Pilot Facial and Fingerprint Recognition for Safer Online Checkouts

[hegemony]

 

 

American Express is First Card Issuer to Pilot Facial and Fingerprint Recognition for Safer Online Checkouts

[Burgerwars]

9 hours ago, hegemony said:

 

 

American Express is First Card Issuer to Pilot Facial and Fingerprint Recognition for Safer Online Checkouts

 

I won't bother when it's offered to me. If a bad guy robs me and sees I have an American Express Card in my wallet, he'll come back and cut off my fingers to make an online purchase. If that doesn't work, it’s then cutting off my head. 

Too risky. 🤔

 

[nemo]

There's also the fact that I wouldn't trust Amex with that type of data: (1) because I don't know how else they will use it, and (2) because they will be hacked.

[ImBack]

On 10/6/2023 at 4:52 PM, Burgerwars said:

 

I won't bother when it's offered to me. If a bad guy robs me and sees I have an American Express Card in my wallet, he'll come back and cut off my fingers to make an online purchase. If that doesn't work, it’s then cutting off my head. 

Too risky. 🤔

 

I’ve been in places where it checks fingerprint and pulse, to make version the person in possession of the finger is the actual owner… When will it end.

[hegemony]

IDK, Id love to have a chip on my person that replaced all my keys and cards. maybe Qlon's brain implants will be the answer?

[jabroni8218]

Nerd here. This is a fancy press release for something that should ultimately be a good thing for cardholders.

To clarify what Amex is doing here - Amex is not collecting your biometric data (face or fingerprint) directly. They are using a W3C (World Wide Web Consortium) open standard called WebAuthn. A device that supports WebAuthn can, after an initial enrollment (imagine entering your card data and then getting a verification text message or email sent) be enrolled for future authentication (whether this is logged into your bank account, or to Amex Safekey for shopping online checkout payment, etc. is irrelevant). 

 

When you return on a device that you've explicitly enrolled in Safekey/Webauthn on a device that supports Amex SafeKey setup - imagine, your iPhone or Android phone - it could ask for your fingerprint or face as the biometric to be verified locally. When the device verifies it locally, it then uses a private key stored on the device to assert the authentication to whatever service (Amex SafeKey in this case) to tokenize the payment. 

This has a number of benefits, namely that you don't need to enter your card number each time, that the biometric authentication is performed locally and never leaves your device (but it is biometric auth).

The applicability here seems to be 3D Secure (what Amex calls Safekey, Verified by Visa, Mastercard SecurePass, etc.) - if you were in a checkout flow that flagged a transaction as medium risk and requiring authentication (either tap approve to an Amex App notification to approve purchase, or get texted or emailed a code), you would be able to do a local biometric auth on a device supporting WebAuthn (assuming you had done either amex app notification approval or email/text one time code on that device before to enroll it). It would just reduce friction on that purchase in a way that wouldn't send your thumbprint to Amex or the merchant, while being very cryptographically sound (effectively impossible to fake, unless someone was able to fake your face/fingerprint to your phone/tablet/pc/etc.)