Mastercard and Visa to kill off password authentication
Mastercard and Visa have announced plans to kill off the need for users to enter their passwords to confirm their identity
BC was charged £12 in late payment fees Photo: Alamy
By Sophie Curtis
12:22PM GMT 13 Nov 2014
Mastercard and Visa have announced plans to ditch the need for customers to enter passwords as a means of confirming their identity.
Current systems – MasterCard SecureCode and Verified by Visa – are both based on the 3D Secure protocol, which was developed by Visa to reduce fraudulent credit and debit card transactions online.
It works by forcing people to enter a password into a pop-up window, so that the card issuer can confirm their identity before the transaction completes.
Retailers have been encouraged to adopt the protocol as it reduces the number of fraudulent chargebacks – money returned to the consumer from the retailer due to a fraudulent card transaction.
However, it is unpopular with online shoppers, because it requires them to use complex passwords that are easy to forget, and it can be difficult to tell whether the pop-ups themselves are legitimate or fraudulent.
How productive are you when working from home?
My eBay Money Back Guarantee battle
Should we spy on our children?
New Twitter features: native video and 'highlighted' tweets
Passwords are also inherently vulnerable, as they are repeatedly used for authentication and can often be discovered via social media or other means, rendering the consumer subject to fraudulent transactions.
Mastercard and Visa's new 'invisible' authentication system, called 3D Secure 2.0, aims to tackle some of these issues by reducing the reliance on passwords as a means of verifying identity.
In the event that authentication is needed, cardholders will be able to identify themselves with the likes of one-time passwords or fingerprint biometrics, rather than committing static passwords to memory.
Mastercard is also piloting commercial tests for facial and voice recognition apps to authenticate cardholders, and conducting trials of a wristband which authenticates a cardholder through their unique cardiac rhythm.
"All of us want a payment experience that is safe as well as simple, not one or the other," said Ajay Bhalla, president of enterprise security solutions at MasterCard.
"We want to identify people for who they are, not what they remember. We have too many passwords to remember and this is creates extra problems for consumers and businesses."
The new 3D Secure 2.0 protocol could be adopted in 2015 and it is hoped that it will gradually replace the current 3D Secure protocol.
Commenting on the news, Marta Janus, security researcher at Kaspersky Lab, said that – if implemented properly – the new protocol will not only be more convenient for users, but also much more secure.
"It's pretty well known that passwords are severely flawed: weak ones are easy to remember and easy to guess; strong ones are hard to guess, but hard to remember," she said.
"One time passwords are already widely used and considered much safer than traditional 'fixed' passwords ... combined with biometric checks, this will certainly make a strong alternative to any existing authentication method."
Sophie Curtis »
The best tablets
In Technology News
Mobile photography awards
Celebrating British Inventions
Instagramming the world
Instagramming the UK
Is Google Glass doomed?
Facebook isn't dying. It's just changing
How hackers took over my computer
Read more from Telegraph Technology
Top Technology Videos»
Rise of a tech giant: the history of Google
The history of Uber
Skype invent robot that delivers groceries
Forget standing desks: This office workstation lets you work lying down
Instagram launches gif-like app Boomerang
Now your iPhone will even weigh fruit
Technology choice
iPhone 6s and 6s Plus rumours: all you need to know
Seven tips to secure your iPhone from hackers
Technology Advice
Telegraph for iPad