Kenneth Weiss believes two things:
1. Our mobile phones will soon do the job of all of those rectangular pieces of plastic that crowd our wallets, from Charlie Cards to AmEx cards.
2. Securing our phones, and protecting the wireless transactions they engage in, will require a high grade of authentication - a way for you to prove that it’s really you using your Blackberry to buy that diamond engagement ring at Tiffany.
Mobile phone makers are racing to add so-called NFC (near-field communication) chips to their handsets, which would enable phones to communicate directly with cash registers. Credit card issuers like Visa are keenly interested in mobile payments, and several wireless carriers got together last November to form ISIS, a joint venture focused on developing “mobile wallet’’ technology.
Earlier this year, PayPal acquired Fig Card, a small Boston company that had been developing its own mobile payment solution to link phones with cash registers.
I had lunch with Weiss to talk about his approach to the opportunity. Weiss was the founder and longtime chief executive of Security Dynamics, the company that developed the SecurID token that millions of employees use to access their company’s computer networks. Security Dynamics acquired RSA Security, adopted that name, and eventually was gobbled up by EMC. Weiss was chairman and CTO of Security Dynamics when the company went public in 1994, but he left in 1996, a decade before the EMC acquisition and well before SecurID’s recent security problems.
“Identification is at the core of most of what we do today,’’ Weiss said, “whether we’re buying something at a store or traveling through an airport.’’
He says the authentication system designed by his company, Universal Secure Registry, will offer a higher level of security on a mobile phone than you get today from a traditional credit card or passport. First, Weiss says that none of your sensitive information - like a credit card account number or Social Security number - should be stored on your phone or transmitted via Bluetooth, WiFi, or any other wireless protocol over the ether. All of that, in the USR system, remains on a secure server inside a data center.
Instead, your phone would have three ways to identify that you are you. The first is a PIN code that you would punch in. The second is a randomly generated number that would appear only on your phone (similar to the way SecurID tokens work). The third is your voiceprint: the way you sound when speaking a number or phrase into the phone.