html5-img
1 / 7

Identity, Security and Privacy: Mobile Web Payments

Identity, Security and Privacy: Mobile Web Payments. Giri Mandyam March 25, 2014 W3C Web Payments Workshop. Mobile Web Payments - Legacy. Premium SMS still popular Based on operator-assigned short code Customer sends text message to short code

lamar
Télécharger la présentation

Identity, Security and Privacy: Mobile Web Payments

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Identity, Security and Privacy: Mobile Web Payments Giri Mandyam March 25, 2014 W3C Web Payments Workshop

  2. Mobile Web Payments - Legacy • Premium SMS still popular • Based on operator-assigned short code • Customer sends text message to short code • Can be followed by pin exchange to verify origin of SMS • Customer is billed through operator • Identity through cellphone credentials • PSMS market still quite strong worldwide • US operators have shut it down • Acc. to Transparency Research International (2013) • 236.9 billion in 2012 and further expected to reach to 1,134.2 billion in 2017 • CAGR of 36.8% from 2012 to 2017 • Mobile browsers have supported PSMS from the WAP days • Any new web payments mechanism would have to bear this in mind • And all the accompanying issues, including • Operator rev share, • Bad debt

  3. Mobile Web Payments – Legacy (cont.) • HTTP Header Enrichment • Long used for mobile content management systems (CMS’s) • Operator adds header with unique mobile subscriber ID (e.g. MSISDN) • Service provider works with operator to bill customer directly • Advantages • Seamless billing from an end user perspective • No changes necessary to existing browsers • Disadvantages • Not secure if path from operator network to server is not secure • Middleboxes can spoof headers • Traversing NAT’s is an issue • Not expected to work on WiFi • Similar transactional issues as PSMS • Bad debt, operator rev share

  4. Mobile Web Payments – Going Forward • Multifactor authentication leveraging contextual data • Location, biometrics, etc. • Retail example: • In-store shoppers who use bar code scanning on mobile device to scan in items as placing them into cart • At checkout, device produces a final bar code to be scanned is displayed on mobile device and read • Customer automatically billed • Can in-store location of shopper be leveraged instead?

  5. Mobile Web Payments – Going Forward

  6. Mobile Web Payments – Going Forward • HTML5 has introduced features such as Geolocation, NFC that take leverage device API’s in mobile devices and provide contextual information • Use of contextual information has a place in multifactor authentication • Previous in-store shopping example • Such data must be provided by a verifiable source • Information could be sensitive (e.g. biometric data) • Data sent directly by web apps using standard methods such as XHR or WebSockets may be vulnerable to attacks (even over TLS) • Any W3C Web Payments enabler should consider whether deeper integration into HW for multifactor auth using device API’s is needed

  7. Thank You

More Related