Between the essays
Out of band
The arguments I make on LinkedIn between essays, kept here with their sources and the date I made them. They are shorter than the essays and are not sent by email.
-
13 Oct
2 min readAuthentication Out of band
The human in the loop is already in the spec
When an AI agent buys something, how does the cardholder's bank get the cardholder to say yes? The published EMV 3DS specification already has an answer: a 3RI request answered with a decoupled challenge. What is missing is support and settled law.
-
29 Sep
1 min readRegulatory Out of band
Agent indicator or intent record?
Six banks say any party holding a potential liability should be able to require authentication. In the EU that is the issuer, yet the published EMV 3DS specification has no field telling its ACS an agent is acting. Which signal should reach the ACS first?