On 16/03/2024 07:03, Boots wrote:
> On 15/03/2024 01:16 YTC#1 penned these words:
>> I'm having one of those "do I really trust this" moments.
>
> Not relying on 2FA via SMS?

It has it flaws. I would prefer and Auth app be used.

>
>> Nationwide want to get rid of the PITA card reader for security. However
>> they want to use facial recognition.
>
> Got two of those & a Nat Worst one which appears to be identical under the cheap
> plastic covers.

HSBC have a "digtal" card now (replaced the physical). I am happy with
that one.

>
>
>> I just don't like the idea of my image being used for security, and
>> having it bounced around.
>
> I had a shed load of issues with facial ID for one of me e-wallets, the auto
> focus on the front camera packed in. Even with it fixed it is very dependent on
> the lighting.

Yeah, facial falls down if the camera is fubared :-)

>
>>
>>
>>
>

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
http://ytc1.blogspot.co.uk/
There *is* an alternative! http://www.openoffice.org/

On 14/03/2024 17:16, YTC#1 wrote:
> I'm having one of those "do I really trust this" moments.
>
> Nationwide want to get rid of the PITA card reader for security. However
> they want to use facial recognition.
>
> I get that it will go to a 3rd part and be mapped, digitised and sent
> back to NW. Then deleted.
>
> Yeah, like they will really delete it...
>
> I just don't like the idea of my image being used for security, and
> having it bounced around.
>
> What is wrong with traditional TWA?
> Why do they not use an authentication?

I'm also with Nationwide and also did find the facial recognition a
rather flimsy security idea, but presumably I'd still have to apply a
digit to get into the app in the first place so it's digit plus face.
Card readers are something of a PITA so biometrics would be welcome.
However, if just my lovely face is sufficient to gain access to my
money, I'm not doing it.

On Fri, 15 Mar 2024 20:46:22 +0100 (CET), "Worst Case"@dizum.com
wrote:

>On Fri, 15 Mar 2024 09:14:00 +0000, Colin Irvine <look@colinandpat.co.uk> wrote:
>
>> On Thu, 14 Mar 2024 17:16:14 +0000, YTC#1 <ytc1@ytc1.co.uk> wrote:
>
>> >Why do they not use an authentication?
>
>> Good question. Have you asked them? Something like Authy, which seems
>> to wo[r]k seamlessly.
>
>I'm NOT AN AUTHY USER! I follow the Privacy subreddit though, and I
>thought I recalled something about Authy being mentioned there. Turns
>out the desktop Authy setup is merely a Chrome App. Chrome Apps are
>sunsetted, so, if you're using Authy on a desktop, you probably need
>to take steps.

I've already stopped.

--
Colin Irvine
R1250RS

On 17/03/2024 02:31, Mike Fleming wrote:
> On 14/03/2024 17:16, YTC#1 wrote:
>> I'm having one of those "do I really trust this" moments.
>>
>> Nationwide want to get rid of the PITA card reader for security.
>> However they want to use facial recognition.
>>
>> I get that it will go to a 3rd part and be mapped, digitised and sent
>> back to NW. Then deleted.
>>
>> Yeah, like they will really delete it...
>>
>> I just don't like the idea of my image being used for security, and
>> having it bounced around.
>>
>> What is wrong with traditional TWA?
>> Why do they not use an authentication?
>
> I'm also with Nationwide and also did find the facial recognition a
> rather flimsy security idea, but presumably I'd still have to apply a
> digit to get into the app in the first place so it's digit plus face.
> Card readers are something of a PITA so biometrics would be welcome.
> However, if just my lovely face is sufficient to gain access to my
> money, I'm not doing it.
>

And then I read this.
---8<
If you have other devices, like a tablet, you'll need to complete the
facial authentication set-up on all of them to be able to use them
without the card reader.
---8<
Which means doing it 3 times (mobile, laptop and iPad)

And will still have to use the card reader with my desktop.

And the 3rd party that stores the data/map is Mitek, a California based
country, I can't find any clue as to where that data is held, or what
level of erasure is used.

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
http://ytc1.blogspot.co.uk/
There *is* an alternative! http://www.openoffice.org/

On 17/03/2024 10:47, YTC#1 wrote:
> On 17/03/2024 02:31, Mike Fleming wrote:
>> On 14/03/2024 17:16, YTC#1 wrote:
>>> I'm having one of those "do I really trust this" moments.
>>>
>>> Nationwide want to get rid of the PITA card reader for security.
>>> However they want to use facial recognition.
>>>
>>> I get that it will go to a 3rd part and be mapped, digitised and sent
>>> back to NW. Then deleted.
>>>
>>> Yeah, like they will really delete it...
>>>
>>> I just don't like the idea of my image being used for security, and
>>> having it bounced around.
>>>
>>> What is wrong with traditional TWA?
>>> Why do they not use an authentication?
>>
>> I'm also with Nationwide and also did find the facial recognition a
>> rather flimsy security idea, but presumably I'd still have to apply a
>> digit to get into the app in the first place so it's digit plus face.
>> Card readers are something of a PITA so biometrics would be welcome.
>> However, if just my lovely face is sufficient to gain access to my
>> money, I'm not doing it.
>>
>
> And then I read this.
> ---8<
> If you have other devices, like a tablet, you'll need to complete the
> facial authentication set-up on all of them to be able to use them
> without the card reader.
> ---8<
> Which means doing it 3 times (mobile, laptop and iPad)
>
> And will still have to use the card reader with my desktop.
>
> And the 3rd party that stores the data/map is Mitek, a California based
> country, I can't find any clue as to where that data is held, or what
> level of erasure is used.

The more I read of such security, why is it I feel less secure?

Chris

--
The Deuchars BBB#40 COFF#14
Yamaha XV750SE & Suzuki GS550T
https://www.Deuchars.org.uk

On 17/03/2024 17:10, chrisnd @ukrm wrote:

>> And the 3rd party that stores the data/map is Mitek, a California
>> based country, I can't find any clue as to where that data is held, or
>> what level of erasure is used.
>
> The more I read of such security, why is it I feel less secure?
>
> Chris

I certainly feel less secure: once stolen your biometrics can never be
'unstolen' of course.

1) Fake apps pretend they need biometrics and then those are sold to
scammers to feed into banking apps:
<https://www.theregister.com/2024/02/15/cybercriminals_stealing_face_id/>

2) Bloke has drink spiked and facial recognition used while he was
unconscious to setup an £18K overdraft and then steal it.
<https://www.bbc.co.uk/news/business-59494524>

Which begs the question: why do the banks think that their customers
will need to open an overdraft while out and about? They could easily
lock such functionality to the home address.

And until the banks see sense your only real option is to have two
phones: one locked in a safe at home and which has the "mandatory"
banking and finance apps on it; and a second for everyday use.

--
Bruce Horrocks
FJR1300AS

On 17/03/2024 22:49, Bruce Horrocks wrote:
> On 17/03/2024 17:10, chrisnd @ukrm wrote:
>
>>> And the 3rd party that stores the data/map is Mitek, a California
>>> based country, I can't find any clue as to where that data is held,
>>> or what level of erasure is used.
>>
>> The more I read of such security, why is it I feel less secure?
>>
>> Chris
>
> I certainly feel less secure: once stolen your biometrics can never be
> 'unstolen' of course.

I always think back to when we entered Mexico in 2010.
The guard scanned my pasport code and my photo came up.
We had never previously been to Mexico.
Ergo, it had been shared with the US.

>

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
http://ytc1.blogspot.co.uk/
There *is* an alternative! http://www.openoffice.org/

On 17/03/2024 22:49, Bruce Horrocks wrote:
> On 17/03/2024 17:10, chrisnd @ukrm wrote:
>
>>> And the 3rd party that stores the data/map is Mitek, a California
>>> based country, I can't find any clue as to where that data is held,
>>> or what level of erasure is used.
>>
>> The more I read of such security, why is it I feel less secure?
>>
>> Chris
>
> I certainly feel less secure: once stolen your biometrics can never be
> 'unstolen' of course.
>
[snip]
>
> And until the banks see sense your only real option is to have two
> phones: one locked in a safe at home and which has the "mandatory"
> banking and finance apps on it; and a second for everyday use.
>

Until the phone manufacturer abandons the phone so that it no longer
gets O/S and security updates leaving it open to attack.

On 18/03/2024 09:42, Tim wrote:
> On 17/03/2024 22:49, Bruce Horrocks wrote:
>> On 17/03/2024 17:10, chrisnd @ukrm wrote:
>>
>>>> And the 3rd party that stores the data/map is Mitek, a California
>>>> based country, I can't find any clue as to where that data is held,
>>>> or what level of erasure is used.
>>>
>>> The more I read of such security, why is it I feel less secure?
>>>
>>> Chris
>>
>> I certainly feel less secure: once stolen your biometrics can never be
>> 'unstolen' of course.
>>
> [snip]
>>
>> And until the banks see sense your only real option is to have two
>> phones: one locked in a safe at home and which has the "mandatory"
>> banking and finance apps on it; and a second for everyday use.
>>
>
> Until the phone manufacturer abandons the phone so that it no longer
> gets O/S and security updates leaving it open to attack.
>
>
Another good point.

--
Bruce Porter
"The internet is a huge and diverse community but mainly friendly"
http://ytc1.blogspot.co.uk/
There *is* an alternative! http://www.openoffice.org/

El Sun, 17 Mar 2024 22:49:59 +0000, Bruce Horrocks escribió:

> 2) Bloke has drink spiked and facial recognition used while he was
> unconscious to setup an £18K overdraft and then steal it.
> <https://www.bbc.co.uk/news/business-59494524>
>
> Which begs the question: why do the banks think that their customers
> will need to open an overdraft while out and about? They could easily
> lock such functionality to the home address.

When we buy and sell houses here, we carry out transactions in the notary
office of many thousands of euros. We use the mobile phones.

--
Paul.

https://paulc.es

Paul Carmichael <wibbleypants@gmail.com> wrote in
news:pan$724e7$2d6459e8$c912db0b$5fb7a6e0@gmail.com:

> El Sun, 17 Mar 2024 22:49:59 +0000, Bruce Horrocks escribió:
>
>> 2) Bloke has drink spiked and facial recognition used while he was
>> unconscious to setup an £18K overdraft and then steal it.
>> <https://www.bbc.co.uk/news/business-59494524>
>>
>> Which begs the question: why do the banks think that their customers
>> will need to open an overdraft while out and about? They could easily
>> lock such functionality to the home address.
>
> When we buy and sell houses here, we carry out transactions in the
> notary office of many thousands of euros. We use the mobile phones.
>

Too many tin hatters over here. I had to rock up to a branch of Virgin
Money with actual paper documents to prove my ID before they would initiate
a CHAPS transaction to my solicitor to buy my home, last October.

El Mon, 18 Mar 2024 19:30:21 +0000, wessie escribió:

> Paul Carmichael <wibbleypants@gmail.com> wrote in
> news:pan$724e7$2d6459e8$c912db0b$5fb7a6e0@gmail.com:

>> When we buy and sell houses here, we carry out transactions in the
>> notary office of many thousands of euros. We use the mobile phones.
>>
>>
> Too many tin hatters over here. I had to rock up to a branch of Virgin
> Money with actual paper documents to prove my ID before they would
> initiate a CHAPS transaction to my solicitor to buy my home, last
> October.

But not that long ago here, we bought a house and had to take a bank
draft to thee notary office. That cost tons. It seems that this country
has suddenly gone from the 19th to the 21st century.

--
Paul.

https://paulc.es

On 16/03/2024 16:52 wessie penned these words:
> Boots <news@millhouse-communications.co.uk> wrote in
> news:j0tfck-vf3.ln1@bilbo.eternal-september.org:
>
>> On 15/03/2024 03:14 YTC#1 penned these words:
>>> I'd prefer finger print, but there does not seem to be an either/or
>>> choice
>>
>> I use FP for my other accounts. Got to remember to disable it when
>> travelling (somewhere dodgy). FP readers don't require the user to be
>> conscious or actually attached to said finger.
>
> I thought a severed finger would not work. I believe the fingerprint reader
> needs the finger to have a flow of blood, and therefore iron molecules, to
> generate the electrical field to trigger the sensor

There was a car nicked in Malaysia with a severed finger, hang on <fx google>
URL:http://news.bbc.co.uk/2/hi/asia-pacific/4396831.stm okay it is a while ago
hopefully it is now as you describe needs to be attached.

--
Ian

"Man will never be free until the last king is strangled with the entrails of
the last priest"

On 16/03/2024 08:52, wessie wrote:
> Boots <news@millhouse-communications.co.uk> wrote in
> news:j0tfck-vf3.ln1@bilbo.eternal-september.org:
>
>> On 15/03/2024 03:14 YTC#1 penned these words:
>>> I'd prefer finger print, but there does not seem to be an either/or
>>> choice
>>
>> I use FP for my other accounts. Got to remember to disable it when
>> travelling (somewhere dodgy). FP readers don't require the user to be
>> conscious or actually attached to said finger.
>
> I thought a severed finger would not work. I believe the fingerprint reader
> needs the finger to have a flow of blood, and therefore iron molecules, to
> generate the electrical field to trigger the sensor

I thought they were just capacitive: read the ridges on fingers (the
raised ridges are closer to the sensor cells and thus have a higher
coupling), which is why they don't work so well when said finger is wet
as this kind flattens the surface electrically.

Wouldn't surprise me if there wasn't some sort of pulse detect, after
all, sports watches can detect a pulse, however, they usually use green
light for this and this would be pretty obvious.

--

CHUMP #1 (CHarge Up Muppet)

Pip

PipL <pip@nowhere.nul> wrote in news:l6jkd4Ffg39U2@mid.individual.net:

> On 16/03/2024 08:52, wessie wrote:
>> Boots <news@millhouse-communications.co.uk> wrote in
>> news:j0tfck-vf3.ln1@bilbo.eternal-september.org:
>>
>>> On 15/03/2024 03:14 YTC#1 penned these words:
>>>> I'd prefer finger print, but there does not seem to be an either/or
>>>> choice
>>>
>>> I use FP for my other accounts. Got to remember to disable it when
>>> travelling (somewhere dodgy). FP readers don't require the user to
>>> be conscious or actually attached to said finger.
>>
>> I thought a severed finger would not work. I believe the fingerprint
>> reader needs the finger to have a flow of blood, and therefore iron
>> molecules, to generate the electrical field to trigger the sensor
>
> I thought they were just capacitive: read the ridges on fingers (the
> raised ridges are closer to the sensor cells and thus have a higher
> coupling), which is why they don't work so well when said finger is
> wet as this kind flattens the surface electrically.
>
> Wouldn't surprise me if there wasn't some sort of pulse detect, after
> all, sports watches can detect a pulse, however, they usually use
> green light for this and this would be pretty obvious.
>
>

https://www.quora.com/Does-a-fingerprint-sensor-work-even-if-a-person-is-dead

it is not just the capacitance from the ridges but also the conductance
of the current formed by the flow of blood - all those ions moving about

wessie wrote:
> PipL <pip@nowhere.nul> wrote in news:l6jkd4Ffg39U2@mid.individual.net:
>
>> On 16/03/2024 08:52, wessie wrote:
>>> Boots <news@millhouse-communications.co.uk> wrote in
>>> news:j0tfck-vf3.ln1@bilbo.eternal-september.org:
>>>
>>>> On 15/03/2024 03:14 YTC#1 penned these words:
>>>>> I'd prefer finger print, but there does not seem to be an either/or
>>>>> choice
>>>> I use FP for my other accounts. Got to remember to disable it when
>>>> travelling (somewhere dodgy). FP readers don't require the user to
>>>> be conscious or actually attached to said finger.
>>> I thought a severed finger would not work. I believe the fingerprint
>>> reader needs the finger to have a flow of blood, and therefore iron
>>> molecules, to generate the electrical field to trigger the sensor
>> I thought they were just capacitive: read the ridges on fingers (the
>> raised ridges are closer to the sensor cells and thus have a higher
>> coupling), which is why they don't work so well when said finger is
>> wet as this kind flattens the surface electrically.
>>
>> Wouldn't surprise me if there wasn't some sort of pulse detect, after
>> all, sports watches can detect a pulse, however, they usually use
>> green light for this and this would be pretty obvious.
>>
>>
>
> https://www.quora.com/Does-a-fingerprint-sensor-work-even-if-a-person-is-dead
>
> it is not just the capacitance from the ridges but also the conductance
> of the current formed by the flow of blood - all those ions moving about

Most of the in-display fingerprint readers on recent phones are either
optical or ultrasonic though.