Latest opinions that Stephen Wilson has shared on Finextra

Join the Community

22,227

Expert opinions

44,188

Total members

438

New members (last 30 days)

216

New opinions (last 30 days)

28,747

Total comments

Join Sign in

Stephen Wilson

Managing Director

Lockstep Consulting

Member since

24 Apr 2008

Location

Sydney

View Stephen Wilson's full profile

Stephen's opinions

Hybrid cards perhaps less than the sum of their parts

The real issue in the new crop of hybrid cards that combine Chip & PIN with One Time Password generators is whether they represent a long term strategic advance, or are more about shorter term convenience. Convenience is important, but we need to have a long term plan. Do the hybrids do anything more than do away with a key fob, by integrati...

05 December 2008

How to stop identity theft

The root problem in most identity theft as we know it today is the ease with which ID data can be taken over and replayed. Businesses ask for -- and obtain -- ever increasing amounts of precious ID data in an increasingly futile effort to authenticate their online customers. IDs get stolen and traded on a vigorous black market, enabling fraud wh...

28 October 2008

But is it an attack on Chip and PIN per se?

I can see how lifting account details from a terminal device can help an attacker take over a bank account via conventional channels, but I am not sure that this is an attack on the Chip and PIN system is it? I assume that the attackers are not able to clone any smartcards using the stolen data (because of the fundamental security measures in the ...

13 October 2008 /security

Where is the All Party Parl. Group ID Fraud Report?

While there is some reporatge of the latest report by the All Party Parliamentary Group on ID Fraud, I cannot find the APPG's report, or even its press release anywhere. The APPG's website (www.fhcreative.co.uk/idfraud) appears to be a year out of date. Does anyone know where to find the report? Cheers, Stephen Wilson, Lockstep.

08 October 2008

National ID card and biometrics in banking

One purpose for the planned UK National ID Card is that it is to be used to help banks confirm identity when individuals open new accounts or undertake certain higher risk transactions. The plan is for banks to have fingerprint scanners and to compare new fingerprints with templates held on or with the ID cards of customers (see for example Tran...

05 July 2008

We could make ourselves less vulnerable to breaches

People often bemoan being treated "like numbers" in the modern world. If we think more deeply about ID theft, the real problem is that when we deal with people numerically, we need to take more care about the pedigree of those numbers. Card-Not-Present fraud and all manner of identity takeover is enabled by the fact that most "i

27 May 2008 /security

What about offering a phishing-proof interface?

How is it that we have all forgotten that an ounce of prevention is worth a pound of cure? Giving away anti-phishing software is shutting the stable door after the horse has bolted. Phishing and pharming is enabled by the fact that conventional client-to-website connections pay no attention to the integrity of the target site. A phisher sends ou...

23 May 2008

Responding regionally to credit card fraud

My first reaction to the news of Citi's special concierge (in which a reliable intermediary facilitates Singaporean online shoppers using US web stores) was, well, someone's going to be paying a nice premium for this security service. Probably merchants and cardholders alike. Presumably the service only accepts Citi cards? But another response ...

14 May 2008 /payments

Why is Federated Identity so hard?

Perhaps because it's just not natural! Federated Identity is certainly one of the hotter topics in e-business and security circles currently. It promises to improve cost, efficiency and convenience of identity management -- an intuitively compelling package. But the impact on security is far from clear, and the legal complexities have been badly...

06 May 2008 /security Online Banking

Regulators chasing their tail over data security lapses

Reading between the lines, regulators will continue to take a big stick to institutions that leak personal data. And so they should. But there must be a more artful approach to stem the flood of stolen ID data. As a security professional, I am aghast at the never ending obsession with policy and process as the only weapons to fight ID theft.

28 April 2008 /security /payments