This document discusses identity and authentication in the context of developing future scenarios for the Canadian payments system. It defines authentication as establishing or confirming something as authentic or genuine. There are three main ways to authenticate: what you know (e.g. passwords), what you have (e.g. cards), and what you are (e.g. biometrics). Combining authentication methods provides the strongest security. The document notes challenges with online authentication, including rapidly evolving criminal exploits and the difficulty of taking down offshore servers hosting malware. It asks questions to guide scenario planning, such as how to strengthen identity credentials for both physical and online use while maintaining privacy, and what level of government involvement may be needed.

1. SCENARIOS FOR THE FUTURE OF THE
CANADIAN PAYMENTS SYSTEM
AUTHENTICATION AND IDENTITY WORKSHOP
NOVEMBER 3, 2010
Greg Wolfond

2. Are they the same?
2
Identity and Authentication

3. Authentication (from Greek: αυθεντικός ; real or
genuine, from authentes; author) is the act of
establishing or confirming something (or someone) as
authentic, that is, that claims made by or about the
subject are true ("authentification" is a French language
variant of this word).
● Thanks to Wikipedia
3
Identity and Authentication

4. 3 ways to authenticate.
What I Know
4
Authentication
Knowledge based questions

5. 3 ways to authenticate.
What I Know
What I Have
5
Authentication

6. 3 ways to authenticate.
What I Know
What I Have
What I am
6
Authentication

7. 3 ways to authenticate.
What I Know
What I Have
What I am
Combination is strongest! Eg Chip and PIN
7
Authentication

8. This graph shows the increase in the number of unique malicious programs used to steal money from Internet users. Source:
Kaspersky Lab
As banks roll out new security technologies and techniques, the criminal underground quickly develops means to defeat these
technologies. The exploits are rapidly (often within 30 days) widely available in numerous crimeware variants that criminals
can purchase over the Internet. Attacks are often hosted on computers in different countries that where the banks and their
customers are located, making it very difficult to get websites that host malware or command & control servers taken down.
Mashevsky concludes that to make meaningful progress in the battle against an exponentially growing threat will require
much tighter cooperation between financial institutions, their customers, the security industry, and government agencies.
8
Challenge with Online Authentication

9. On Top Of The Direct Revenue
Losses, Cost of Stolen
Goods/Services And The Associated
Delivery/Fulfillment Costs…
…There Are Additional Profit Leaks
From Rejection Of Valid Orders,
Manual Review Costs &
Administration Of Fraud Claims
Source: Annual Fraud Report (2009), CyberSource Corporation
9
$4B Per Year In Online Fraud Losses
For Merchants In The U.S. & Canada

10. Source: “Fraud, the Facts” 2009
10
Today, Growing CNP Fraud is mostly the merchant
problem online

11. Complete
Checkout Form Authenticate Pay
Integrated Checkout Solutions Disintermediate FI’s From Clients And Take Transactions
Away From Card Issuers And Networks
11
In the Online space Non-FI’s Are Stepping In To Meet
The Needs Of Shoppers & Merchants

12. Authentication is often.. (esp in online world)
Authorization is the function of specifying access rights
to resources, which is related to information security
and computer security in general and to access control
in particular.
Separate from
Identification : or Identity Verification
a: an act of identifying : the state of being identified
b: evidence of identity
● Thanks to Wikipedia
12
Identity and Authentication

13. Most of the time picture ID.
No relationship between the provider of the ID and the
relying party
Often Mag stripe.. Easy to copy. Not easy to verify
What’s the dollar cost to the industry? What’s the value in
making the credentials stronger?
How to make it work in the physical and online worlds?
13
Identity Documents

14. Privacy is a big factor in any system
No relationship between the provider of the ID and the
relying party is a key tenant
Is privacy good enough today in the physical world? NO
Physical world system wouldn’t work online. (Tap your
card and give everyone your name and address)
How could it be better?
14
Privacy

15. Authentication - EMV (contact or contactless) at POS
What authentication is needed online?
Identification - Physical and Online - what needs to be
done?
Government involvement needed?
Should playing field be level? All players
do the same KYC, AML or new entrants
ride free?
Privacy - An obstacle or an opportunity?
15
Things to think about for the scenario planning