Slashdot Mirror
What About "Smart" Credit Cards?
Platypii writes "After seeing many ads on TV and around the Internet for the "smart" credit cards (both major companies now have them I believe), I became curious about them. The Visa website was rather vague about it, and only proclaimed dreams of merging all your cards -- of whatever type -- into one. Anyone know the technical details of these cards? The privacy aspects?"
What, me worry?
As long as these cards are useable in a store of today it wont create any extra security. This will only create more to expolit all at one time.
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
2600 had an article about this some time ago. I can't remember exactly what issue but it discussed the technical details of the card and what the chip does. Towards the end of the article the author sums it up by saying only time will tell whether this new chip is friend or foe but I digress.. I'll follow up with some more information if I find the issue.. somewhere.
These cards may be smart, but they won't keep you out of debt. They will probably drive you furthur into debt because you won't be afraid to use it because it is "secure". How smart is that?
[ ]
Are these cards called smart because somebody put a little electrical circuit in them, or is there a lot more going on with these "smart" credit cards than the average consumer knows? Credit cards are have always been evil - luring innocent and naive consumers and sinking them in irrecoverable debt. Perhaps they've just gotten cleverer at that.
Am I a hipster-doofus?
Just last week I recieved a phone call from a young lady quite eager to sign me up for a new Vis a card with a built in smart chip. But first, I had a question:
Me: "Yes, well, before I sign up, I'd like to know; is that smart chip silicon based or germanium based?"
Her: "...uhm... excuse me?"
Me: "Well, if a company doesn't know this kind of basic information about the products they are selling, that's not a company I would do buisness with. Good day."
Needless to say, they have yet to call back.
--
#nohup cat
gemplus.com, a leading smartcard manufacturer, has some good info on smartcard technology.
As far as I can tell, these "smart cards" do nothing at all. Keep in mind that reader hardware is needed for the little embedded chips, and until such hardware becomes ubiquitous no one can do anything with any data that someone bothered to put on there. My university actually tried doing this exact thing with its student ID cards for a couple years, and the only use it could find for it was as a rechargeable stored value system. They dropped it because it wasn't all that useful and it raised the cost of the cards from like $7 to $20 to replace. I guess that these cards might be a good way to use small amounts of electronic money, but considering one is already doing just that -- it's a credit card, remember? -- I don't see the point. I guess people could store basic commonly-needed information like a health insurance policy number on them, but again, unless access technology is widely available this is just a gimmick.
Perhaps someone who was at the HAL workshop can give the hacker's perspective?
geek. lawyer.
Anyone know the technical details of these cards? The privacy aspects?
Simple answer: More convience = less privacy = less security (for most cases)
What I find really interesting is the credit card one-time deals (don't know a link to information, if anybody does, please help out) but the gist of it was that: you'd sign up with a credit card with, say, Visa. Then when you're about to buy something on the internet you get a temporary credit card number from Visa that only has a certain amount available on its balance.
Security-wise it's great, since if anybody gets that number, no big deal, since they can't use it. Privacy-wise it wouldn't be hard to make it not require any personal details. (Since it's a temporary number issued on deman, it's almost safe to assume it's not stolen (possibly ask for a name or something like that))
You would not use a credit card.
The average family in credit card debt carries a balance of $4000 on several cards from month to month.
I like to replace the words 'credit card' with 'loan shark'.
Sales Rep = Someone earning $8.50 an hour, just trying to do his/her job.
You = A genuine rapier-witted genius who must feel really good about himself for demeaning the sales-rep.
Well-Done!
Just runaway now!
It's those damn marketing folks out of control again.
They just want to track all of your habits via cross-referencing to a central database.
It's just like tracking your IP across websites, except they'll know for certain that you really will spend money at those businesses.
You are being MICROattacked, from various angles, in a SOFT manner.
From what I remember, reading about the chips awhile ago (no idea what website), the danger doesn't really seem any more than that of the magnetic stripe as far as privacy goes. The chip pretty much behaves the same as the magnetic stripe, but with a greater capacity. One thing the chip can do which the magnetic stripe cannot however is store algorithms for something along the lines of encryption, which would seem to only make the card more secure. The actual functionality of the chips varies though, most of the major chip manufacturers make them with different specs. The beefiest I remember seeing was a mitsubishi chip which pretty much had the same capabilities as a microcontroller when inserted into the correct reader.
If you sign up for a "smart card" you are supposed to be able obtain a desktop reader from your issueing bank (looks similar to the desktop compact flash readers) that plugs into the back of your PC. When you're making an online purchase you slide your card into the reader which authenticates you as the card holder.
I'm in a hurry or I'd throw up links. I just noticed this hadn't been explained yet. Ta Ta!
I'm against picketing, but I don't know how to show it.
Yes the attractive transparent card with the smart chip on it http://www.providian.com/mysmartservices/index.htm
looked like it would be a wonderful edition to the small collection of cards i rotate through my wallet over the months to build up an extensive credit history.
The problem with this card is it seems the entire company and everything about it is entirely automated.
I first received a call from them to activate the card from a very rude operator who demanded all this information about me which was entirely unnecessary and completely unrelated to the card. They also gave me a pathetic $1,000 limit making it the most useless card in my collection and I had cancelled a platinum discover card with an $8,000 limit for this stupid pretty-looking card.
Over the following two months I was still on the mailinglist and received three more notices to signup for the card.I tried to then use the card by charging a chartitable donation and it appeared to go through at first until I went to some stores tried to buy an item and it didnt go through. So I called to have the card activated again and after the process was complete it STILL wasnt activated making a total of 2 times.
At this point I was very frustrated so I tried to cancel it only to find absolutely every phone number was automated voicemail with no access to a human being and no option to cancel the card. There are multiple phone numbers which loop between each other so you can call one number and wind up selecting an option that will transfer you to one of the other numbers. I was just about to call the better business bureau when I FINALLY found an obscure number listed in a dark corner of their website and immediately cancelled it. Until Providian gets their act together AVOID THIS CARD. Besides Providian is already so nosy about all your personal details just to activate the card just think of how nosey they'll be when they finally activate the smart chip once enough get into circulation.
http://www.livejournal.com/users/cixel
ISO 7816 is the smart card standard. Almost every smart card available today uses that standard, including credit cards, and the cards DirecTV uses for subscriber authentication. Litronic has some useful information on their site about Smart Cards and smart card readers.
Hey, I just sat down to eat dinner when they called. They could atleast have the decency not to call people between 17:00-21:00. Or just don't call in the first place. But until that day, I may as well have some fun with them.
--
#nohup cat
I remember years ago the NJ DMV was talking about putting all this information onto the Drivers license...like credit card, medical records, and social security info.
Last that I have heard anything about it was that it went through the state legislator and was shot down because of the whole privacy issue.
_______________________________
"I'm not Conceited...I'm just a realist..."
Heard about this outfit on the radio in the past week. Sounds like interesting technology. Don't know how far they will get.
http://www.chameleonnetwork.com
We have met the enemy and he is us... pogo
Currently my university has been using these same smart chips in our University IDs for the past year. It has been a costly switch over and ridden with problems. Most likely much of the information would be stored on the smart chip with these new cards just as our accounts are stored on it. Unfortunately if a card is lost or stolen there is no way to get money back on your id card as as there is not much of a paper trail to follow. The chips in the cards are also easily worn, as my card will attest to from sitting in my wallet, and I often have problems using my cards in many of the readers accros campus. Unfortunately the administration will not release much about our cards and they continue to say that there is no vital information stored on the cards. But I ceertainly don't regard my university account with which I use for printing, copying, buying food and supplies as not vital.
In what can only be described as, nothing more than a quota machine, online Law enforcement officers have become more net savvy, learning tricks that include ways to destroy the evidence of innocence victims who fall prey to rogue officers. In a shocking investigation of online police activities, we uncovered one of many techniques used by officers to bait online males into appearing as though they are planning to meeting young females and arranging to have sex with them. AOL/TimeWarner's deal with the DOJ allows them to continue monopolistic moves in exchange for free run of AOL's network.
ICQ started as a venture in Israel and gained worldwide popularity before being purchased by the Media Giant AOL/Time Warner. Since then, ICQ has seen continued growth and benefit from it's new parent.
AOL has been long known as a haven for the less than savvy Internet user and a controlled environment subject to the codes of conduct setup by it's founders. On the Internet, a user can go into a chatroom or messageboard and say pretty much anything they want and not have to worry about some authority figure breathing down their back. On AOL, you can be turned over to the authorities in a split second for making a threat you can't possibly carry out. This has happen on several occasions over the last few years. It's been long know that AOL has catered to law enforcement in order for them to meet their pending quotes of perverts, raging lunatics and whatever else they can dig up. This, I'm sorry to say, has spilled over to ICQ as well.
Over the last six months, I've notice a tremendous increase in both adult women and 13 year old girls sending messages to me for no apparent reason. Most would shake this off as random porn solicitors or first time users looking for people with similar interests. I left several of these people (Adult and 13 year old girls) on my list, but didn't reply to them. Just let them send me messages. I'd noticed that many of these adults would always appear at the same time as a 13-year-old. Then I discover a patch that allows a user to run more than one ICQ program at the same time. I would receive a message from the adult, shortly after; I'd receive one from the child.
After dealing with this for a few months, I decided to interact with one of the adults. I sent her a link to my website (which logs all visitor domains), she looked at it, made no comments about it, but tried to drum up a sexual conversation, I ignored the sexual tones and only talk about my website. I checked to see where this person was at by checking my website logs (CA.GOV). OK, some government employee with lots of time on her hands. Suddenly, I received a message from one of the 13-year-old girls. OK, innocent Hello's, I replied to her with a link to my website. I checked my logs, and damn was I surprised CA.GOV again. Not sure if the adult had just revisited my site or what; I ran an ICQ hack that detects users unique IP address. The result was that the Adult and the minor where at the same location.
Well, I wasn't all that surprised, but what followed were not the actions of a bored employee, but that of a state or federal agent trying to destroy evidence. I took several screen shots of the users information and logs,(Which I will save incase these bandits try to frame me) then confronted the suspected officer. The response was; "Yeah, you caught me" hmmm, ok, honest cop. I left the room for a few minutes to drain or something, when I came back, I looked at the history on ICQ to refresh my aged and failing memory, only to find all my logs from that user and the minor had been deleted remotely. There is a hack that allows you to do this.
Apparently, the scam works like this, the agent starts a random conversation with an adult male, they later start a conversation with the same male as a 13 year old girl. If you bite the Cybersex bait, they keep you going faster and faster. Then, out of the blue, the 13-year-old will slip in a quick comment along the same lines as the conversation with the adult. Hoping that you didn't notice it was from a different person. (Everyone has sent a message to the wrong person at least once) You may reply with a sexual comment to a minor. You've been baited; they will continue this over several months until they have enough conversation to make you look like a pervert.
Now, If you don't byte the Cybersex pill, you're safe, right? WRONG, If agents are below the quota for investigations they will likely use the method they tried on me, Say you don't reply to the child, but you do carry on a conversation with the adult. Say after several months, you allow that conversation to get sexual. Now the officer takes your conversation with said adult and appends it to the log files of the minor. Walla, your now a pervert. Using this hack tool that deletes your log files leaves you with no defense other than your word against the Cops. Guess who wins that 99.9% of the time? The Cops.
Some people might say "Dan, your paranoid" claiming this was just some random porn spammer or just plan coincidence. I don't buy it. Given the current environment of Feminist that labels most men perverts and molesters and these Feminists' infiltration of our Government Agency's over the last eight years, I'd say that the Government is just doing what it thinks it can get away with.
Using vulgar language with a 13 year old girl has serious legal ramifications, far worse than with a girl just one year older. 13 will get you 20+ and a cop an excellent record of catching perverts and hella good promotion. ICQ is haven for Cops; they've learned the rules of the game and how to break them. The Judges aren't bright enough on this subject to even comprehend how much wool has been pulled over their eyes.
Until you can protect yourself on ICQ I don't recommend men use it, in fact, I'd support an all out boycott of ICQ just on the principle of invasion of privacy and harassment by authorities. If you can't have a private conversation on the Internet without the fear of this person or that person being a cop, Then I say we need restraints on officers online.
Oh, I almost forgot. I do have one last use for ICQ, forward a link to this article to everyone on your ICQ list until hell freezes over, this way, we can use ICQ the way it was meant to be used. Mass communications and fun.
It's nice to see some card companies finally moving towards smart cards in the hope that one day we may not need to carry cash.
The two major offerings are currently Visa's smart Visa and American Express's Blue. At this stage, it seems that MasterCard does not have a combined smart card/credit card.
There have also been various smart card only cards including MasterCard's Mondex and Visa's Visa Cash, but neither of these seems to have gained wide acceptance, despite being backed (however weakly) by the major credit card companies. Let's hope these new combined cards don't suffer the same fate.
A friend of mine told me a story about going to Europe and having to explain to a clerk that his credit card didn't have a smart chip in it, she would have to slide it in the other thingie. He ended up having to slide the card for her.
For some things, the US is way behind.
I second this guy's comment. You're a pretty tough guy for asking a nerdy question to a kid making $8 an hour doing a crappy job.
And for calling when you have dinner, that's where caller ID comes in handy.
I worked for a major valley computer company in 2000, and we had evaluated American Express's Blue as a possible companion to some of the ecommerce solutions we had wanted to develop.
Blue, and everything else I've seen since then aren't real solutions, they're just gimmicks. They need to support real SmartCards which offer strong encryption onboard and payment approval. The half-assed crap that they're pushing now is next to useless. The only benefit that I can see of Blue and its ilk is that they might have the opportunity to make SmartCard readers ubiquitous. From there, they could maybe begin to support SmartCards with the features that I mentioned above.
Why are you letting these clowns ruin our country?
I worked for SCM Microsystems in France, a company that made smart card hardware for set-top boxes and PCs. I worked on firmware for a CANAL+ (pay-per-view) decoder box that used a smart card for authentication.
What the credit card companies want is what they have in France (the rest of Europe? I don't know): when you use a credit card at a restaurant or store, you have to enter a PIN. All the credit cards in France are smart cards, and they store your pin (encrypted IIRC). This saves them lots of money in fraud charges.
However, you can't sell that in the US, because US consumers are already protected against credit card fraud by law. What's the value to consumers or merchants? They don't have to pay anyway (except through higher interest rates, but do you think the credit card companies are going to promise to lower interest rates? hell no, they want to increase PROFIT).
So the card companies are stuck with a hard marketing job: how do they get the merchants to pay up for new hardware to read the smart cards so they can start putting PIN protection on all the cards? well, they have to make it so that consumers are bringing smart cards into the store. If consumers are using the smart cards, the merchants will be forced to buy readers that can deal with them.
So how are they selling it to consumers? Badly. They're promising stuff that nobody really cares about... marginally easier admin of freq flyer miles, intangible future bonuses in "integrated" consumer information. Bleah.
Why don't they just frigging lower the interest rates on PIN protected cards? That would sell like hotcakes, and reducing fraud lossage is the card companies ONLY real concern. Because they are greedy fucks, that's why. They want to decrease their fraud lossage and keep the diff.
France was only able to railroad this through by subsidizing smart card development. Schlumberger et al got some big bank by developing the smart card system for the pay phones, which only happened due to some big time pork barrel action.
The US smart card folks just don't have their act together ATM. Too bad... I think the cards are cute. Don't really care as long as my liability on a credit card is just $50, though.
Bill Gribble -- grib@linuxdevel.com
Linux Developers Group
i don't expect the salesman at circuit city to be an electrical engineer, but he should be able to tell me how long it'll take to make popcorn in my new microwave.
of course, i don't expect the saleman at fry's to know how to plug in the microwave..
xn
I have a credit card. I use it frequently. My credit limit started at $500 when I was in college, and is now on its way to 5-digits. I have never carried a balance, nor purchased so much that I had any difficulty paying it off.
My point? A credit card is perfect for my shopping needs. For those who carry over a balance month-to-month, well, all I can say is thank you for supporting the company that gives me this great service.
I have 2 smartcards in my wallet right now; an American Express Blue, and a Fusion. When I first hooked up the reader, I dreamed of being able to go to thinkgeek.com, hit checkout, put my card in, type my pin, and then having my goodies a few days later. Unfortunately, the support is just not there. With American Express, you use their software and it gives you a list of supported online stores, none of which interest me. The fusion is the same exact way. Both use VERY similar software that runs in the system tray of a Windows computer and launches your little magic cart when it detects a card. Bah...who cares?
Also, one of the main reasons I got them was that both where giving away free card readers which look pretty cool. They're gemstar (I think) and are the same ones that are supported by Win2k for authentication. Not a bad deal, I bet they retail for about $30 a peice. The card reader was also able to tell me a bit of info about the smart card used in my Dish Network reciever. Cool geek toy...nothing more. Next Cue Cat perhaps?
I did see some cool uses such as an electronic card punch that would stay on the card, i.e., you by 9 cups of coffee, you get the 10th free, the card keeps track instead of using a paper punch or other similar device. Alas, this was only a flash demo of what it could do, but I have yet to see any real world examples.
The current generation of SmartCards are java based. The idea is that they provide more than memory, but a full Java Runtime Enviroment, and a set of base applications, under the theory that processing transactions in a known (secure) enviroment is preferable to simply swiping the card through a reader/writer which might otherwise simply increment or decrement a number (of dollars or whatever) stored on the card. These cards have a great deal of potential that remains largely untapped. I have yet to see a smartcard transaction processor which takes any real advantage to these capabilities.
--CTH
--Got Lists? | Top 95 Star Wars Line
I don't want to sound mean or anything, but we've had "smart cards" for ages over here...
In France, there's a ubiquitous system which requires you to type your code for every purchase you do with it. AFAIK, nobody ever complained about it, considering you can't use a stolen French card anywhere in France. If it's combined with a Visa card, you can still use it outside the country where there's no direct way to check its validity.
Here, in Switzerland, my bank card is combined with Visa, and I can set limits for withdrawals and purchases done with the (post)bank part of the card (with a chip), or use the Visa function with equal flexibility.
I suppose it just results from a different banking system between the USA and Europe. In Europe, banks contract the credit card provider (visa, mastercard, etc) and merge their cards. Plus, in most countries, banks have merged their ATM services so you can use any card to pump money from any "hole in the wall".
What strikes me is that Americans see smart cards as a really new things, whereas here we use them for absolutely everything, from e-wallets to bus-pass or phone cards. Smart-card readers are available and cost something around $20...
Bah, real standards have always had hard times getting to the USA, and that's no news!
/max
-- It's always darker before it goes pitch black.
I hate Jews
Whilst there are all sorts of risks involved with online use and tampering with the smart card readers, most of the smart cards released here in Australia don't even have a PIN or signature protection: you just press OK/ENTER. If these cards are combined with a credit card, then presumably there will at least be a signature on the back, but this also is not a guarantee (how many times does the sales clerk actually check your signature when purchasing a 5 $ item?).
To provide at least basic protection, the use of these smart cards must require entry of some code such as a PIN.
Here is a little article on smart credit cards (yahoo).
Judging from that posts I have read here, there is a general lack of information about them, so I'll post a few relevent lines:
WHAT ARE SMART CARDS?
Smart cards have an embedded microchip instead of the magnetic strip used by credit cards. The cards need a special reader to transfer information from a personal computer to online merchant Web sites or at point of sale terminals at retail stores.
n/t
If the circuit on the smart card can be used as a public-key crypto engine, then you could use it to secure any interaction with the card issuer's database.
Nobody could get your private key unless they stole your physical card, since there's no need to have the key printed anywhere except in the card's circuit.
Here's the loop: Client (cardholder) sends server (issuer) a cookie encoded with Server's public key. Server decrypts it with its private key and sends it back along with its own cookie, encrypted with Client's public key. Client decrypts, compares the Client cookie it sent with its copy of it, thus validating Server's authority. Client then encrypts Server's cookie and sends it back. Server decrypts, compares with its copy, thus validating the client's authority. This is basic RSA/PGP stuff.
One simple handshake--it's about as complicated as the TCP/IP connection that was made to transport it--and your SmartCard is money.
This gets rid of the current problem of credit-card numbers being stolen ex proprio that arises because you have to copy the number itself off the card in order to use it.
--Blair
"I was speculating about the meaning of ex proprio, too. So sue me."
By now this is completely off topic, but I'll bite.
I don't have caller ID. Nor do I wish to pay for it. I know, it's only $10 or so more per month, but so what? I don't need it. Even if I had it in this situation, I still would have had to get up to look at the caller ID box.
Let's break it down further (I'm really bored now). Say I give them two minutes of my time. Assuming (being a consultant) my time is worth up to $150 per hour, that's $5 worth of time. So in excange for that, I mess with their feeble mind a bit. So?
They are going to replace the mag stripe with a chip. This adds security how? As far as I can tell, only about 1 in 1000 techies have a mag card writer. About 1 in 1 pc users can have a chip card writer with a few clip leads from radio shack. Once this takes off, the small time fraud level will go through the roof once someone makes a nice script kiddie tool kit. The smart cards used by the sat tv are quite complex compared to the credit cards and at one time, direct Tv was guessing that only 10% of their customer base was using craced cards.
As a merchant, I would not take ones of these new cards with out making sure I'm not taking any of the risk.
There is also the static issue. I know a few women that can not deal with electronics without some heave duty static protection. One of them has a complete surface mount static protection workstation that she uses as her desk and so far it has keep her pc working. Before that she would blow motherboards, keyboards and mice week. Since she kills digital watches, I would expect one of these cards to have a life time of less than a week with her.
The idea behind "Smart" Credit Cards is not what most people think. The common conception of a "Smart" Credit Card is of something that will protect you from internet pirates and the evil waiter that disappears with your card for 10 min. This is NOT the case and Marketing knows it. The only basis they have for calling them "Smart" Credit cards is that they "Look Smart" as in fashionable and elegant. Context is everything...
I noticed the widespread use of these cards last time I was in France. I guess the reason they caught on so well over there was that the way the cards are set up, they are somehow self-authenticating, that is there is no need to call a central database, at least not at the time of purchase. This was an important feature in Europe where super-expensive telephone hookups made it prohibitively expensive for the average business to authorise credit cards over the phone every time one was used.
We use them at my university for stored value as well. They were going to drop them from our IDs a few years ago, but the introduction of SunRay network appliances all over here and the hot-desking that goes with them guaranteed they'll stick around a while longer.
Although I think the coolest application I've seen is the card I can store all of my PCR programs on for our Thermal Cycler in the lab. Tres convenient!
--J
Waterworld is possibly one of the finest films ever made. It belongs on the top shelf of any cinema buff's cabinet, next to the likes of Citizen Kane and The Godfather. When Waterworld is on, I do not eat popcorn or engage in other distracting activities, and god help you if I hear you talk during this masterpiece.
"Smart" credit cards? Imagine a Beowu....
oh.
nevermind.
Well I hope they're Silicon based. Well actualy I hope they're not but that's just because it'd be really cool if they weren't. Mind if I borrow the line though? That is too tight.
--Goldbishop
371+3 1=053\/35
Basicly all the smart card is, is a mircochip on the card which has a PIN number or word on it. If a merchent has a smart card reader (which few do) can read that PIN and ask you it to make sure that you are you. Fairly useless IMOH.
Sleep is for the weak!
I have a Fusion smart card which is part of Fleet Bank. I have gotten a $3000 limit and intro rate is 0% with the fixed rate after 6 months to be 11% or 12% not sure which. Anyway, it came with a smart card reader which when used with certain websites which enable the reader's use you get an extra encryption over the 128bit that your brower supports. It is pretty cool. Check out Fusion's website here: http://www.fusioncard.com/home/
girls want me
I worked for a company that specialized in smart card devices and was present while some of the technical and political discussions took place. The implementation, at that time at least, was up to the credit card company but the potential is this (read potential means this may or may not be the route your CC company chose):
A smartcard could secure your credit card number so that only the banks ever see it plaintext. That means you never see it, the merchant and his punk waiter never see it. If they get clever and intercept the transmission, they'll see encrypted traffic - it behaves very similarly to SSL. The PIN is an authorization to allow the transaction to occurr, and interestingly the entering of the PIN# becomes one of the hardest security parts to lock down. I even saw prototype smartcards with little keypads right on them!
Having worked with the technology, I have FAR more faith in a (proper) smartcard-secured credit card transaction than a normal one. Imagine being able to go to po-dunk computer supplier.com and not have to give him your CC # to make a purchase? It's a good thing.
Well, when you talk about "smart" cards you probably mean just plain old "circuit" card. Which is usually just ISO7816-1,2,3,4 compliant card.
;). All transactions end up at least at VISA's servers, which may or may not (yeah, right) track you & your shopping behaviour.
Those standards define electracal interface, and "command" interface. There's a lot of cards that don't abey the standards to the full extent, or extend them in weird directions.
Now, the thing VISA is offering, is that the card is totally standard -compliant, some call it EMV-part2 (part1 is again about interface...). To be VISA-SC compliant, you have to obey EMV-p2..
About privacy: You have near to zero. I know, I program this stuff (not EMV-p2, but near to it. If I'd tell about EMV-p2, they'd come and shoot me in no time
But this stuff isn't new at all, it could have been done (is done) with plain old ISO-2 stripe too. The new stuff is that card can deny certain shoppings. For example you yourself can deny buying 300kg of lollipops with your card. That's just a silly example, but that's possible. You could also limit time at which card functions.. etc..
fucktard is a tenderhearted description
Newer Smart Cards are capable of public key cryptography. They are not just an information store, like a magnetic stripe, but actually perform public key crypto on an embedded processor on the card which is powered by the reader. This way your public key never leaves the card.
Some of the better manufacturers of Smart Cards add all sorts of physical security to the chips as well...to the point where you can't even take the chip apart and scan the die with a electron microsope or special probes to try to read or trick the bits out of memory.
My guess is that the current Visa cards do NOT use onboard cryptography yet...that these are general purpose cards which for now store your credit card number and address for convenience because the infrastructure is not yet in place AFAIK to support public key credit card transactions. They may or may not already have crypto software onboard that could be used with a PKCS#11 driver, but the credit card companies just want to get them and the readers deployed, and then will provide a software update or something to actually add crypto features in your transaction in the next couple years. See the PKCS#11 standard written by RSA (on their web site) for the standard crypto API which has been adopted for smartcards.
Note that smart cards have been around for a while in europe, although they were typically not used in a cryptographically sophistically way.
See www.pki-page.org and http://www.rsasecurity.com/rsalabs/pkcs/pkcs-11/
Braddock Gaskill
Security Consultant
braddock@braddock.com
Smart cards come in a number of flavors, with a variety of capabilities and price tags. The simplest are memory cards (just store values, useful as "wallets"), the fanciest are (currently) JavaCards. Amex Blue is in fact a (Gemplus) JavaCard, running (default) a single applet (I believe the smart Visa cards are similar). This applet has an RSA keypair, and an X.509 digital certificate. Making a transaction with the card requires the card to generate a digital signature on the transaction info (in contrast with standard magstripe cards that just add those magic 16 digits to the data sent to the issuer). Why is this better: it's very easy to clone a magstripe card. Get any piece of paper with the card number on it, it's very simple to manufacture a card. Or for card-not-present (e.g. internet) transactions, the number itself is all you need. Steal it out of some online merchant's database, and you're good to go. With smartcard-based transactions, you have to actually have access to the private key on the card to generate a bogus transaction. Now you can rip the keys out of these cards, but it requires some time alone with the card itself -- just downloading some merchant's badly protected database is no longer sufficient. You get a poor man's version of this kind of protection with those one-off credit card numbers, but that requires the user to actually get and use those numbers. With smartcard based transactions, this all happens transparently. The really interesting thing is that the card issuers have been avoiding smartcards in the US for years because of the cost. But now that they've bitten the bullet, they've gone in all the way -- instead of a $5 smartcard capable of signing transactions and storing certificates, they've gone for the $20 32-bit JavaCards (and $15 adds up fast over all Visa subscribers in the US). Presumably the initial decision to switch to smartcards was simply based on how much they're losing to fraud. The decision to go with the JavaCard may be in the hopes of offsetting the cost by having other players pay them to add further applets to the card (e.g. loyalty programs, where you get the 10th coffee free, etc, or additional security features for environments where you can't use the chip -- e.g. applications that will generate and store one-time 16-digit credit card numbers).
I think this was the first application of these types of cards.
Smart cards are pretty cool. They have great security, are standards-based, and are quite cheap when you think about all they do.
Most smart cards (JavaCards or OpenCards) support encryption, wired or wireless interfaces, and a bit of space on the card itself for a program of your own. www.basiccard.com offers a neat little set of cards you can program in basic, if you're just getting started. (the program on the computer can be written in any language). www.gemplus.com has cards you can program in Java, but these are much more expensive.
Each card has an onboard computer which you can program to do your bidding, from anything to securely storing cash (that only the correct program, or card reader can adjust, if you like), identity checking (imagine an ID card with your picture, signature, left thumbprint on the surface of the card, and stored securely inside the card - now there's an ID), and tons of other things that haven't been thought of yet.
You can use them as phone cards, tiny cash cards (swipe your card in front of a soda machine, push Pepsi, drink, repeat)
There are tons of cool things you can do with a tiny computer embedded in a card. Its more than just memory storage, its an entire cpu that you could use for a new TIS authentication scheme, or a new payphone card, or a key for your encrypted files. You could walk by a local ESPN store, swipe your card, then on your Palm later check out all the scores and player stats for the last week. Look, smartcards are great or evil, depending on how creative you are, but the potential for some very cool things is definately there.
There is not yet a good application for Smart Cards in the USA yet. So far, the only application for them that I have seen at all is the savings machine at my local Virgin Megastore (Hey, they had Universal Indicator: Innovations in the Dynamics of Acid, which means I'll buy it). In other words, this is just a gimmick.
Good applications of smart card technology can be found in the BT (is that British Telecom? I'm American, I dunno) phonebooths in Great Britain. One card... easily rechargable... Electronic cash, anyone? Now, perhaps if they came out with phones with smart card readers in America, something that you could easily bill long distance to, just by inserting Brue (Crose enough!) or whatever smart chip card you have on you. Hell, eventually, someone will come out with electronic cash on those babies, and then, that'll be a lot more convenient than carrying around a wad of $20s... (look at the size of that guy's wad!)
Pretty much, though, there really isn't any useful application for smart cards right now in the USA. Perhaps it would be a little better if Amex and Visa rolled out applications and terminals to vendors before unleashing these technological wastes on us...
Ah, I miss the days when new technology was useful... and I'm only 18...
(off topic: I got some porn ad email in chinese... apparently they spidered the site, found my email, and sent it to me, because it had a link to a reply I wrote a looong time ago)
http://www.livejournal.com/users/whiskeyjuvenile/
Why would we not want cash?
I like cash and I dislike cards.
I dislike having my shopping habits tracked, and when it comes time to do work on the side, it's nice to be paid in cash and not have to worry about Federal or State Income Tax on said wages.
In a cashless society, everything is going to be tracked, and I do not like that.
Smart Cards are also being used on GSM phones, since GSM Smart Cards (SIM Cards) can be cloned. This [credit card type Smart Card] will eventually be able to be cloned. NOT so secure in my point of view.
You canceled an 8,000 credit limit card BEFORE you knew the credit limit of your new card? Are you sure you can handle a credit card?
Ka-pow !
Exactly what problem are "smart" cards designed to solve for me, the consumer? My current credit card works fine - I really don't want a card that tracks my personal information and purchases. I'd rather have a dumb anonymous card rather than a smart "personal" card.
The use of chip cards has tremendous potential in both the face-to-face (traditional, i.e. at the grocery store) and card-not-present (CNP, i.e. Internet) purchase mediums. For example, one day there may be a client-side and server-side standard that enables card authentication over the Internet, giving e-commerce retailers greater confidence that the person on the other end is the legitimate cardholder and not someone typing in stolen cardholder information. There are also a number of other proposals to use the chip for CRM purposes, such as electronic couponing and loyalty schemes. The potential is certainly there to greatly improve the way credit cards are used for payments today.
Despite this potential, even the card companies don't know what to do with the chips on these cards. There is a total lack of standards among the card associations (Visa, MC, Amex, Discover and other foreign schemes). To date, none of them have proposed any type of beneficial use for these embedded chips. The card associations love to use catch slogans like "The card with a brain", but mysteriously offer no explanation as to how this brain can help you.
The use of embedded-chip payment cards is not new to the world. Several card markets have experimented with chip cards in the past. Perhaps the most notable market is France, who has employed chip card technology for the last several years. If you've ever been to France, you may have noticed that there is a PIN input pad at every point-of-sale terminal. If you are at a restaurant, the waiter will bring a handheld card reader to your table. Each card issued by a French bank contains a chip, which enables this reader unit to verify if a correct secret PIN has been entered by the cardholder - without contacting a bank or any other banking network. These units also contain a traditional magnetic stripe reader used to authorize non-French issued cards.
This chip-bases system was implemented in France for two reasons: offline cardholder verification and enhanced security. Since the units are able to independently verify correct cardholder PINs, this allows merchants to authorize credit card transactions offline, without requiring a dedicted phone line. This is a nice feature for countries with telcos that take 12 months to install a phone line, which often have overly expensive telecom costs. One important thing to note: Offline PIN-based validations do not have the ability to check for basic validations like checking to see if there is open credit on the account or checking to see if the account is even valid. The offline validation also does not work on non-French issued cards. Subsequently, most retailers authorize transactions using a traditional online method, even if the card has a chip.
Despite the widespread use in France, chip-based authorization is still years away here in the US. France is a very small card market with only a handful of banks issuing credit cards. Various reports have estimated a cost between $10 and $20 billion dollars to convert the current US card authorizations systems to include chip-based authentication/authorization - a cost that card issuers, acquirers (the banks that merchants interface with) and merchants are not ready to eat. In addition, extending chip card authorization to the online world will require client-side hardware (i.e. card readers) and server-side software....more hassle than the card issuers are ready to deal with right now. AMEX tried it and failed miserably (did you actually know anyone that used the AMEX Blue smart card reader? Do you know any online merchants that support it?)
In a nutshell, your credit card may have a brain, but it is yet to have a place to use all that intelligence.
American-style credit cards did not take off in Europe so well because it was(and may be) so stinkin' difficult to get a phone line. He says Italy could throw enough red tape on the ordeal to delay install for a year. This was no way for merchants to jump on the credit bandwagon so they started using smart cards for wallet-based credit. Smart cards SOLVED A PROBLEM. That problem doesn't exist in America as phone lines are easy to come by.
The other reason, as mentioned in a different thread, is that there was/is little legal-based credit-fraud protection in Europe[generally], but such legislation has existed for a long time in the US. The point of Bruce's book applies here: different technology for credit cards won't happen until either the system get some unexpected, significant risk of fraud, or another system comes out which substantially reduces fraud risk below its current level and doesn't offend everyone for things like privacy. Repeat. The risk of credit card fraud is currently manageable. The security of the system has some, if few, countermeasures to keep the average Joe honest. It has a detection mechanism which identifies fraud. It has a response mechanism that allows them to go after all but the most sophisticated attackers. Changing technologies for credit cards must present a MAJOR improvement in: countermeasures, detection, and response. Smart cards don't provide a major step up in security nor do they simplify the speed at which I will spend money. If you don't agree, read the book first. Heck, borrow it from the library and support freedom the Stallman way.
While there may be security risks and complaints about these smart cards, they sure do look interesting. Once they are used more widely and have some better uses, then they will probably catch on.
:)
I had a customer tonight at work who had one and he didn't seem to even know what it did when I talked to him about it. He just figured it was an "upgraded credit card".
I'll look into these cards once the uses become more mainstream. I would love to be able to go to a site, click buy and plug in my card and have everything be taken care of. Thats why I'll use one.
I worked for Visa for a little bit in 1997 when they were launching chip cards in Europe. From what I remember, the chip cards are good for places that don't have much telco infrastructure. The chip can store the remaining balance on the card and subtract when the card user makes a purchase without dialing up. Almost every transaction performed in the US requires a dial in to "them" to authenticate the transaction.
The Novus/Discover people are actually a treat to deal with (a rare occurance in this industry). I haven't used their one-time-number service yet (requires Java, which is IMHO unsupported in release-quality versions of Netscape), but you can find more info at the bottom of the page here
The Daily Build
Here in New Zealand we have Electronic Fund Transfer at Point Of Sale. It looks like a credit card, but it carries out transactions on your bank account in real time. Just about everyone uses them for anything from a car to a bottle of milk at the dairy. No chip, just a PIN and mag stripe.
:v)
Simple, effective, had it for years and it works. No need for silicon smart/dumb cards. And yes I can transfer money from my account to someone else's over the phone.
Vik
did you happen to read the post about simple RSA encryption above?
Hey, I work with that industry =)
Basically all it is is a smart card on your credit card, that contains all of the info that is on the mag stripe of the card. The only difference is that you can insert the card into a reader (end first, and only about 2" to get the chip in), it will prompt you for a pin code, and you can enter it, then the terminal has the info to make the purchase. It's not much different than normal magstripe readers, except that it has the potential in the future to be a lot neater (like replace cash entirely). It can also be used for loyalty programs (stores points on the card, for example). As for the "much more secure", that's bullshit. The information that is on the card is kept hidden and unaccessable, that's correct. It cannot be modified, that's correct. You cannot copy the card, that's correct. But on your PC any information must be passed into the browser, and over the internet, and thus it's just as vulnerable as typing it in yourself.
In the future, you will be able to do things like have a remote site talk directly to the chip on the card, using built in encryption that will be entirely secure, as well as do neat things like authorize payments from your bank, cash transfers, withdrawing money from your bank over the internet onto your card (don't need to go to an ABM anymore!) Unfortunately people aren't yet comfortable with this technology as a whole, and thus the technology trials proved that although the technology works and is available, nobody wanted to use them. Perhaps in another 3 or 4 years.
OTOH, Europe has had smart chips in their credit cards for years now, to the point at which vendors get confused when you pass them a normal mag-stripe-only credit card (I'm not joking, I've had my card refused several times because they couldn't figure out how to use it). Similarly all bank cards here have a smart card in them. It's a lot more secure for banking because you can't copy the card just by knowing the number on the card and the pin number. In North America it has happened several times where people can capture the pin code and card number, make a new card, go up to some banking machine and withdrawl money, and guess what, the legitimate card owner gets fsck'ed over because there's no protection against that. Common to happen is a video camera placed above the keypad somewhere (For example, there was a case in a supermarket where some guy placed a camera with a zoom lens in the rafters of the roof just above a checkout, had it focused on the pinpad, the camera captured the card number visually, and watched you punch in the number. He got away with it for a few months until they traced down where this was happening and finally caught him. Popular also is to put a fake ABM in a parking lot somewhere, and have it prompt you for your card and pin number, then just print out "Sorry, network failure" message, at which point you go away grumbling but they now have your card/pin... I don't use interact anymore because it is HORRIBLY insecure. Credit cards however still are insecure, but the credit card company takes the loss instead of you =)...
If God gave us curiosity
In the US of A we dont need very elegant encryption for the smart cards. Just ROT13 the PIN and then hen some one makes something to unscramble it, throw him in jail using the DMCA
* Carthago Delenda Est *
OK, first of all, this thing was built by Securify, by a now defunct group which was based in Boston. They are the same guys who, btw, built American Express Blue. The program includes a full fledged PKI solution, with your credentials stored on the chip. You can use it for signing in for special services, use it to purchase online. You just have to remember a PIN. The funny thing is that Providian, the first Issuer to give out the cards, SELLS the necessary Smartcardreader for 19.95. Speaking of consumer adoption ...
The chip on a smart card is a rewritable medium. As any good slashdotter knows it can therefore never be "truly secure".
;-).
When the INS wanted a new Green Card they had to choose between smart cards and optical stripes. Optical stripes function like the magnetic stripe on your current credit and bank cards but use the same medium as a write-once compact disc.
Once data is written to an optical card it can't be modified. That's why the INS chose optical storage for the Green Card, Border Crossing Card and others. Of course you can add all the passwords and encryption you want on top of that for additional security.
And optical cards store up to 4 MB of data which is certainly enough to record the transaction history of the average consumer for a couple years.
FYI, I wrote the software the INS uses to produce the new Green Card, so I have a clue on the subject
"The cost of freedom is eternal vigilance." -Thomas Jefferson
What I forgot, rumours have it that the old Consulting/PKI group got all back into Charlie Waltons old/new company Caradas.
I think they make a new number for each purchase so if they somehow found out the credit card # for that purchase they could only use it for a very short period of time, and at that store only. This may be incorrect, but I remember hearing about this some time ago.
Well, it's not really like they have a choice. They need a way to get a living, even if it's by sitting all day long in a call-center and asking silly question to annoyed people.
And if you want to vent your agressions, do it to the manager and not the phone reps.
Up, down. Up, down. Up, down. You can almost hear the network grunting.
What is a Smart Card? offers a brief explanation.
However, AmEx has the best dang credit card feature available: Private Payments, which is basically a generate-as-you-need one time use credit card number. It bills back to your card account, but the number can't be reused, and the expiration date is the current month. No worries about stolen cards at e-commerce sites with questionable security or shifty practices.
The VISA and Amex Blue are great ideas, but building the infrastructure to use them is going to be the big problem. Any Merchant who accepts credit cards already has a mag stripe reader of some sort. It can be a self contained unit or built into the cash register. For smart card transactions to become popular, chip card readers will have to be placed at retailers. Internet purchasing is another good use for chip card technology, the promise is there, but the implementation is not. Chip card technology is popular in Europe, so the market is there if the applications are forthcoming.
I work for a company that deals with chip cards (although not in the credit card arena) -- the cards themself are highly secure when compared to a mag stripe card. The fraud we have seen has not been hacks to the card itself, but fraud at either the Point-of-sale or when the card is applied for. I'm sure the card could be hacked, given enough time and money, but barring an inside job, the cost of defeating the security is higher than the benefit that would be gained. Of course, in the credit card market the benefit goes up, so there will be more attempts to crack the chip. I'm not going to reveal the exact market that we are in, but remember, google is your friend :)
One of the big advantages of the chip card (beyond fraud control) is that value can be stored on the card. For example, I put $50 dollars on my card. I can then go to locations that accept chip card purchases and I can make a purchase without the Merchant being on line. The merchant settles at the end of the day by dial up modem, and their money can be transferred to the Merchant's bank account the next day. This kind of use is great for merchants that are at Flea Markets, Hamfests, or other locations were online terminals are not practical. The credit card vendor provides all of the infrastructure to make this happen. There is a lot of potential here for this market, the cards are getting out there, but neither VISA or Amex has put the infrastructure together yet to actually make it happen.
Beware of Sleestak
stores want to load a buying history file and cookies onto consumer smartcards just like they do on the www, they want to track consumer's buying habits in the offline world in addition to the online. smart cards have a secret data memory which the consumer has no access to but a merchant does.
youll need your smart card just to enter the store, if you don't have a smart card you will be shot to death.
So, you were just trying to be a dick, huh? Congratulations!
Actually, I believe it does just the opposite. When you are about to make a stupid purchase, it praises you on your decision, by use of a popup, and suggests you add a few more of the same item to your shopping cart. Hey, they've got to make money somehow.
I don't see how secure this could be in the long run. Just imagine this scenario:
1. Thief gets his hands on a card.
2. Thief has card reader hooked to his computer.
3. Thief has gotten his hands on a piece of software that can act as the merchant.
4. Thief has another program that can reply to merchant program with PINs as the merchant program asks for it.
5. Thief now has a stolen card and the associated PIN.
Granted, a program like this would take some time to work, but I'm sure it can be cracked. Or if the card itself does the authentication, I can't see how that would be any tougher to crack.
Or am I missing something?
But why is the rum gone?
While you may know about chip chemical composition, chances are good those "feeble-mindeds" know a bit more about having a life
I remember seeing in an old issue of Phrack the plans for a reader/writer for payphone cards used in Europe that looked identical. I have been meaning to try to find that article again, and see if I can't get me free candy for the rest of my days. Some girl's card broke last year, and the machines let her have everything for free! However, it has an ID on it too, so she eventually had to pay $400 to the university. I guess that means I would need to rewrite the magnetic strip too.
Best Slashdot comment ever
I saw a commercial about a Visa card that's smart. It referenced a link to Visa's .
Was in a position where I was working with "Windows Powered" smart cards which interesting enough was recently dropped from development and existing technology sold off to other companies. Can read about the aftermath at: http://www.microsoft.com/smartcard/ :) less likely to get "Passport" on a SC now.
One less security concern I guess
---------------------------------- there are still real heros http://www.pr.usm.edu/oolamain.htm
I did just a little programming for one of the issuing banks regarding their Visa smartcard. I don't know anything confidential, but here are the vague details:
The smart Visa is a java smartcard, and it has a fair amount of free memory on it. The card encrypts the transactions between itself and all involved parties, so the issuing company can feel safer about the transaction. This is part of why they feel comfortable about it.
The extra memory can be used for things like loyalty programs - for example, keeping track of how many cups of coffee you have purchased so you can get your 11th cup free, or whatever. This information can be stored directly on the card, so you don't have to carry the little cards around. Theoretically, this means it would be more convenient to be part of these things. However, in actuality there are relatively few of the required reader devices in stores, and who buys a cup of coffee with a credit card?
The company I worked with had a system where you could get a reader for your home computer, which would allow you to connect your card with their web site. This would let you manage the card's features. I don't know much about what it offered, but there didn't seem to be anything terribly compelling. Also, I seem to recall that the system required a plugin which was only for IE on Windows.
In general, the people at the bank who were running the smart card program wanted to target market the card at a young, tech-savvy crowd and advertise the technical features, but the upper-level suits at the bank insisted that the card be target-marketed at the middle-aged crowd and that the advertising consequently be dumbed-down. Also, they made the membership requirements fairly high. This resulted in a smaller-than-desired subscriber base.
There's nothing wrong with the card system. My coworkers who were more closely involved all said it was really cool tech (other than the Windoze IE plugin), and I trust them in that. The problem as I saw it was that it was being marketed badly. For Visa's and the banks' sakes, I hope they figure that out and start using better marketing that assumes a younger, hipper, more tech-savvy market base... and make the membership requirements match.
and I made a Beowulf cluster. It even runs Apache! Check it out here.
Already we have ATMs and vending machines that talk to mobile phones. A large bank here in Australia just bought into a mobile phone company. Unlike a credit card, a phone will cease working if stolen or forged (since you know exacly how many instance of a phone should be on the network). The absense of a physical connection means you won't spend time buffing worn out magnetic strips against your shirt trying to get it to read. Eventually you won't need to buy a train ticket, the carriage will just bill your phone as you travel from station to station. And we'll know exactly where you are at any given time, people in public places without valid phones will be investigated by the police and everyone else's movments will belogged to prove their innocence.
Xix.
"Everything is adjustable, provided you have the right tools"
Hmm, I wonder if you overclock the chip in a smart card if you get more cash?
;)
-- Dan
But it doesn't work that way because merchants don't want it to.
Smart card technology has thrived in Europe for over ten years and lagged in the US for a reason, infrastructure. The current model for credit cards in the US works fine because of our standardized telcom infrastructure. Europe has a variety of systems so the centralized server model for checking credit cards wasn't a viable option 10 years ago so that's where smart cards came in to play. The most visible US credit card with "smart card" technology is Amex's blue. An Amex blue card has been sitting in my wallet since their debut, but I have yet to use its "smart card" technology yet.
if you work for Evil; don't be suprised when people treat you as if you yourself were Evil
There are THREE major credit card companies.
Well, it's not really like hitmen have a choice. They need a way to get a living, even if it's by sitting all day long outside someone's house and shooting sniper bullets at their employer's enemies.
A big exagerration, telemarketing vs murder, but just because someone does something to make a living doesn't make it alright. There are plenty of other jobs they could get... maybe they would have to do some work or use their intelligence instead of sitting around on their ass annoying people...
Tim
Omnia vestra castrorum habetur nobis.
In the US, we're instructed not to pay for anything significant with a bank/ATM (check) card, since the money is immediately transferred from consumer to merchant. There's no chance to dispute charges (in the case of faulty merchandise, for example). Credit cards also give you the option of receiving special benefits on certain purchases, like automatic insurance on airline tickets, cash back bonuses, etc - these are all things that check cards normally don't do. Also, let's not forget that check cards don't allow people to get into heaps of debt, which the credit card companies profit off of.
The reason VISA (and also Mastercard) will
replace magnetic band cards to smart Cards is
that it is very easy to copy the current
cards. Plans are both will issue only
smart cards in 2003 therafter.
Clerks would promply recognize a copied
card, but ATMs rely only on the information
on the mag band. It is not difficult at all
to get the mag info, and then all you need
is a PIN. (Seach for ATM and fraud and you
may be suprised how easy it is.)
I know a guy who was one of the main designers of the "Smart Card" from visa (as recently advertised tirelessly on daytime TV). According to him, one of the primary audiences of the Smart Card would be college students. The use of the card, they hope, would be to "make deals" with vendors on or near the college campus, allowing the students to utilize the Smart Card like cash at the vendors stores even if the vendor didn't have credit card machines. Hence, easier buying for students, more money for Visa. Additionally, to the average user, the card could, or would, be used just like cash instead of a traditional credit card. Whether or not this information is completely true is up to your discretion, but I thought it might make a valuable speculation, at least, to the discussion.
I think, therefore, I'm smarter than our president.
I work for a smart-card solutions company in India and was the technical lead for a team that wrote software for India's largest installation of smart-cards which in India is larger than most credit cards. I have also been asked to present my views in front of RBI (India's fedral bank) sponsered committee to create standards for smart-card use in the country. Coming to technical details, a smart card basically acts like a secure computer with a secure filesystem and operating system of its own. It exposes a limited set of "system calls" that you can call from inside your program which are supposed to be secure (at least in theory). For example, the system calls may allow you to "write" a private key to a "file" in smart card froma program but having once written the private key you are not allowed to modify or read it back. There will be a seprate set of "system calls" that will allow you to decrypt or sign messages using this key however (after giving one or more PIN(s)). As a card is small and can be easily hidden or transported under rugged enviroments this allows a very secure and convenient place to keep critical private keys. Such cards are commercially available and are programmable from Windows and Java (A free linux version in C is being done by MUSCLE guys). There is nothing more or nothing less to smartcard technology. As you can imagine one can leverage this simple use and storage of assymetric (and also symetric) keys to design wonderful credit-card (or other financial) solutions that can provide almost complete privacy and fraud-control. However,it is not technology but the corporates and government which are limiting the use of smart cards. For example, in India a large number of people (especially with money from dubious sources) used to spend by buying stored value smart cards which were available off the counter for cash. Till income-tax department decided to make it compulsory to record identification details for each such transaction. One can argue that it was a blow to privacy but does the govt has an option in front of brazen money laundry? This is not bound to change any time in near future. As soon as you make financial transactions anonymous, guys who got "bad money" get in and start using the system for their own laundry. However, fraud-control is on everybody's list and one should expect VISA and MasterCard to move in this direction. As somebody else pointed out, there is a lot of investment done by merchants and banks in current terminals and rest of the credit-card infrastructure so one should not expect new technology to come out overnight. however, over next 5-10 years I would expect a lot more credit cards to be chip-based with at least PIN protection on them
Here's what I know about smart cards .... I worked for a company called ECP, they are developing programs based on smart cards. The only ones that benefit from this cards are Visa and Amex. They are smarter because they keep track of everything on the micro processor that is on the card .... It holds upto 1K worth of information. The merchants will have to replace their current terminals if they want to accept this cards without having to pay for "manual processing fees" which could add upto $ 0.75 per transaction. This fees will apply once Visa, MC, & Amex decide to remove the magnetic strip on the back of the credit cards. Credit card companies are just reinventing the wheel, and making a bundle of money in the process. The information kept on the cards could be gathered and sold to the highest bidders. smart cards have in place in europe for a long time now ....... the possibilities are endless..... they claim to improve security, but there's nothing on this new technology that would stop a stolen credit card from being used the same way that today's stolen cards are used .....
Here's a website for a project using smart card technology in the US. http://www.smartcardproject.org/
You load it with money from your account (usually at an automathic teller machine) and then you can go around buying things with that card until it's empty (and then you load it again).
Is it used?
The two situations i know best are Portugal and Holland.
Most banks introduced it in Portugal some years ago (a country wide standard) and went around offering cards, providing stores with card readers and advertising the cards. It was a total fiasco - they spent loads of money promoting it and in the end nobody uses it. Then again, the only advantage it had compared with hard cash was that it made it easier to pay for car-parking (instead of using coins).
In Holland they're doing the exact same thing as in Portugal except they are 1 or 2 years behind (they just recently stopped promoting it). Again a total fiasco.
So what's the problem with these cards?
For one they've been positioned as an electronic wallet. This means they have to compete with the ease of use of hard cash. (Accepted everywhere; physically more resistent; well known; widelly deployed).
Also the currently deployed solution doesn't offer many advantages over hard cash (you can used it in some (few) parking metters instead of coins - that's about it)
Finally, you can't use it to pay things in the Net (you need special equipment to use one of those cards) - this means they can't compete with the existing standard (credit cards).
I can't help but get this funny image:
A solitary CSR bunkered down in a fortress on the outskirts of Waco, TX, surrounded by a hoarde of auto-diallers/answering-machines and stolen guns, laughing maniacally. And not one of his customers aware that they are part of a cult
Okay so there's not that much free love, but there's definitely enough user-information power to feed his later-day-Jesus charisma.
:)
Protocols
Smartcards (and their predecessors, "chipcards") implement ISO standard 7816. As a previous writer noted, above, this largly defines the physical, mechanical, and electrical characteristics of the card. It also defines the communications protcol used by a terminal when communicating with a card.
There are two major catagories of card, each with its own characteristics and generally its own communications method. These are:
These use ISO7814 part 4 S=0 ("synchronous") mode communications. They're essentially dumb memory devices, which are serially strobed synchronous data (a bit like an i2C chip in your PC) by the terminal. They don't rise to the level of "smart"cards - other than some very basic (password) authentication, they're just dumb memory devices. Most include a suicide mechanism, whereby they blow their own internal fuse (and thus become permanently dead) if you send them too many wrong passwords. Typically these are used for applications that store and manage a few values - e.g. phonecards, loyalty tokens and utility meter tokencards.
These use ISO7416 part 4 T=0 (character asynchronous mode) and T=1 (block asynchronous mode) communications. They're real computer devices in their own right, typically with either an 8051 or Hitachi H8 8-bit microcontroller as a brain and a surprising amount of memory - several Kbytes of RAM and up to 64Kbytes of flash or EEPROM storage - pretty impressive for a chip that's 2x3mm, I think.
T=0 is a simple, half-duplex, master-clocked serial protocol - you could _almost_ use a regular UART to talk to the card, except the card's initial message (its ATR - Answer To Reset) is sent synchronously, and the UARTS in regular PCs don't have a raw/USART mode that would allow them to receive this correctly. The actual communication speed varies between cards (the card tells the terminal how fast it can go in its ATR), but its generally very slow, around 300baud max. T=1 is just a simple packet format layed on T=0. Both T=0 and T=1 are, IMHO, rather crappy protocols.
True smartcards aren't just dumb memory devices - they run actual programs, and often have built in special functions, generally cryptography stuff (GemPlus makes DES and RSA enabled cards).
Major players
Security
As a replacement technology for regular magnetic swipe cards, smartcards are _much_ more secure, mostly because magnetic swipe cards are totally insecure - you can write one yourself with a reader you paid a few hundred dollars for - there's no magic and no cryptography at all.
As real security devices, smartcards aren't terribly secure. They're designed to be tamper-proof, but their form-factor ensures that this will never be very effective. Current implementations leak information from various sidechannels (EMF, heat-dissipation, elapsed-time to perform crypto operations), some of which are pretty easily fixed and some of which aren't. They're never going to be super secure (you're never going to put the launch codes for nuclear missiles on one), but they're probably fine for real-world use for their current and proposed applications.
Writing code yourself
GEMplus sells (for a pretty reasonable price) an evaluation kit with a few demo cards, some programming info and a card interface that plugs into your PC's serial port.
You can get limited JavaCard stuff from java.sun.com, but you typically need more stuff that pertains to the specific card - you get this from the card's manufacturer. The JDK's javac compiler is used to compile code for the javacard.
Sun also has (or at least used to) a pretty comprehensive software framework for the terminal (PC/server) end of the equation - it's called OpenCardFramework. It simplifies a lot of the pain-in-the-ass features terminal programmers have to put up with when talking to smartcards.
Privacy concerns
When used as a replacement for existing magnetic cards, there's no more privacy concern than with the magnetic cards - the credit card company knows all about all your transactions either way, and with the smartcard you're less likely to find out that some enterprising folks in the Far East have cloned your card and tried to buy an airplane with it.
There are privacy concens when you consider that the card can host multiple applications. In practice, you as a consumer (note: consumer is the new word for citizen, apparently) have little to no knowledge of what is being stored, run, or communicated to/from your card. The card's crypto means you can't just open the card up yourself and hunt around to see, so you'll have to trust the issuer of the card (and their agents, etc.).
## W.Finlay McWalter ## http://www.mcwalter.org ##
Ok, as it seems that this thread has just turned into a big steaming pile of uninformed crud, I'm gonna post some sites that are a good place to start. www.oberthurcs.com and www.gemplus.com are two samrt card vendors. As for sun's JavaCard, its not the only type of smart card environment out there. Another good stopping off point to learn about one type of cards system is www.cepsworld.com. Thats VISA's Common Electronic Purse System and, unlike credit cards, does have money stored on the card. Its a pity some people on this site don't shut their mouths instead of just posting crap!
In France, we have smart cards for a while.
And they are not secure:
- 320 bits RSA encryption !!!!
- The secret key was discovered in 1998
- Easy to build at home a 'smart card' which
will draw money from non existing bank accounts !!!
And the 1st credit card hacker, Serge Humpich, is
now in jail !!!!
more info (in french) at:
http://www.parodie.com/monetique/
We have already had a telco using SMS to spam their customers (and billing them for the privilege). Imagine not being able to walk down the street without your phone being assailed with multimedia spam from each and every shop that you pass.
No! My shoe lace came undone and I happened to be out the front of Victoria's Secret. Honest honey...
Xix.
"Everything is adjustable, provided you have the right tools"
..."no, Dave, you will not buy this."
As others have said no system is totally secure, but this ups the bar from needing a few household items to clone a mag stripe card to needing millions worth of electron microscopy to clone a smart card.
That's crap of course. All of the POS terminals have a magnetic stripe readers and it's the kind where you insert the card and not the cheap shit I've seen in the US where you have to swipe your card and say what kind of card you have. What's more, the majority of terminals we have out there all have an integrated smart card reader in addition to the stripe reader in order to process the Geldkarte (a national electronic purse) and it'll be a snap for us to do EMV purses (oh, btw that's what's on these credit card smartcards) as the software release on our hosts been able to handle that for a long time and all we need to do is enable that purchase options in the terminal by remote. Oh and one more thing: Over here you can use your ATM card, your Geldkarte and your Credit Card in a POS terminal...
Seriously, though, it's a way to store more information on the card and to make it more easily-accessable. There are readers on the market that will read the card from several inches away. The privacy implications should be obvious: How long until the card can be read WHILE IT'S STILL IN YOUR BILLFOLD? At any rate, the "smart card" chip does not necessarily need to actually be inserted into a card reader the way the magnetic stripes do.
There's talk of using them on driver's licenses to store fingerprints[1] and blood type and so forth. The purpose of this should be obvious, but unfortunately, it isn't. At least not to me.
Not bitching at you, but at the people who created the URL you pointed at.
Why would any company that's trying to look "net-savvy" use JavaScript redirects in their HTML for something like that? I load it up and get a nice blank screen. OK, I'm clueful enough to view the source and sort it out for myself, but that's the minority.
Lame.
The problem is the French system doesn't check back home like their swipe cousins, I hear the French network is being upgraded to the new SmartCard network like the rest of the countries. However France had the advantage of having experience with the old SmartCards... now you just need the new system and linked up PDQ's.
That's because VISA let alone any of its compliant card companies don't even make the cards, now if somebody from Gemplus phoned up trying to sell you SmardCards then I expect they would accommodate your pedantic questions. Otherwise you're just being an idiot, even though you obviously think you're a laugh a minute to yourself.
I hope VISA has marked your Credit record suitably as "pedantic, sarcastic techie guy, much like the fat (and lonely) comic collector in the Simpson's, this guy does not appear to have a life and therefore would not value a CC. Note: Also lacks any social skills when it comes to dealing with women"
Serge Humpich, a french engineer, broke into these cards last year. When he contacted "GIE Cartes Bancaires" (french banks association in charge of these cards) to inform them of the security breach, their only answer was a lawsuit... Doesn't this remind you of something ?
You can find more details here.
Quoting http://www.mastercard.com/education/shoppingtips/:
Will payment by credit card still be the safest way if there is a computer on the card? After all, computers don't err, and if the technology makes it harder to use the card unauthorized, it may also become harder to dispute transactions, just because the technology is believed to be secure.
Recommended reading:
both by Ross Anderson.
The traditional credit card system may be smarter than the smart card, because it accepts the possibility of failure and distributes the risk over all customers of the card issuer.
http://erichsieht.wordpress.com/category/english/
Yes, they were cracked. See: http://parodie.com/monetique/ (In French, but with the full explaination.) This site covers many possible VISA frauds.
Yes, I know the details. All the cc info everywhere will be collated by Bill Gates and Microsoft with their Passport authentication system. This choice was arrived at when an independent organ studying the various alternatives reached the unanimous conclusion that Microsoft technology is the most secure technology in the whole wide world. So there is absolutely no risk of leakage or other system compromise. Please remain calm.
radsoft.net
From what i read in other articles they seem to be something different from the e-wallet cards deployed in Portugal and Holland.
Altough the Portuguese and Dutch e-wallet smartcard-chips come embebed in a normal ATM card, they are actually used independently - any ATM/Shop Payment transaction uses the information in the magnetic strip of the card (plus a PIN and an online checking mechanism) while using the e-wallet allows you to transfer "virtual money" from your card to the store/Parking Meter card (this will only use the "money" stored in your card and has nothing to do with your bank account or whatever).
Also these seem to be more recent than the French ones (they were introduced in Portugal about 7 years ago)
From the descriptions i read in this thread, the french cards seem to contain a smartcard-chip so that an ATM transaction can be authenticated offline. This is a totally different application.
From a hacking point of view, the main difference is that if you hack an e-wallet chip you can produce money out of thin air (that is, you can mislead the card into thinking you have loaded it with money), while in if you hack one of those french cards you can pass yourself as the owner of some bank account (or maybe use an unexisting bank account number)
Now I know this may sound as flamebait (it isn't, it is just stating the obvious) but actually we should be glad the average credit card debt is 40000$ per familiy. You know why? Because it is those people who keep the credit card companies profitable.
Yes, you read that right: I do have a credit card but I "play by the rules", this means I just never have to pay any interest until I breach the magical wall of 2500$ per month, which of course I never do (it covers food + fuel expenses each month easily). This means that the credit card company never ever earned any dime from me. (Except perhap on exchange rates when in a foreign country)
If everyone did this, no credit card company could stay in business for a long time. So let the "average familiy" be in debt: they pay for you and that is good.
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Also, you won't be able to resist false accusations. You may not be imprisoned without just trial. But all your cards, linked via SSN or equivalent number may be anytime blocked, just like internet access because of suspect DMCA violation. That's just. The cards are not your property, but Bank's.
With all cards blocked and no cash in existence, you and your children are condemnded to loose home, stay hungry and eventual death.
And remember, cash is already no money. Read it: It is "legal tender" and each has a unique number to preven abuse and to make them traceable.
I interviewed for a contract with one of the big credit card companies for writing the specification for systems validating these smart cards. As they explained it, the smart cards offer nothing in the way of extra capability from their end. It's simply a new way of validating the card for the vendor who is accepting payment. The ID and validation token is stored in the chip. The vendor's hardware validates using that. Both ID and validation tokens are sent to the card company to approve payment. It's nothing more than a security blanket for those vendors who are accepting cards.
- Sig this!
A card like the Visa "electron" checks back, to know if your bank account is feed, but perhaps it's a smart card anyway ? Is it ?
Sales Rep = Someone earning $8.50 an hour, just trying to do his/her job.
Me = Someone just trying to enjoy dinner uninterrupted after working all day!
Ok, I'm not sure if this is the one you talk about, but here in Sherbrooke, Quebec, Canada, we just finished a one year test-drive of a smart card mastercard call Mondex. In fact, Mondex is the name of the whole system, but the cards are said to have a "mondex chip". I dont consider this a credit card really, but more an electronic wallet. You can put no more than 500$ (that was in cdn dollars btw) on the card, for security reason, and then you can spend it just as with a credit card. It is better than interact (also called ATM cards) because the system doesn't need to call a central office by phone. everything is done local. And also, when you say they hope to put everything in one card, that's because since it is a chip, they put it on a regular ATM card so it can do both. You could also put it on a credit card.
As I learn more and more, I realize I don't know much.
"DAMN KIDS!!! Quit joking and laughing like a bunch of dag-nabit hyenas, I'm trying to concentrate here and can't post serious links while ANYONE is being silly"
The capabilities range from simple memory storage cards (3KB to 16KB), which are a high tech equalivant of the magnetic stripe on "swipe cards" to high end crypto processors which are tamper resistant and/or tamper evident. These crypto cards can generate a private key that never leaves the card, and can securely performing digitial signind decryption using the private key. Such cards typically support DES, Triple DES, RSA 512-1024 bit and SHA-1. E.g. CryptoFlex from Schlumberger, Gemplus Public Key
Smart cards are already far more common in Europe, are used in satellite TV, Mondex (an electronic wallet scheme that never seems to get off the ground), and in a different form factor, the SIM cards of GSM mobile phones are smart cards. Because of Sat-TV, Pay-TV, and GSM phones there are hundreds of millions of smart cards in use today.
There is also Linux support via MUSCLE which supports the PC/SC API made popular under Windows, and most vendors support.
If the goofey thing would store an image of authorized users that the cashier would have to press to continue the transaction, it might be worth something. You could make the program fun by displaying several unauthorized users as well, say ten of them. Think a crook can remember your face that well?
Friends don't help friends install M$ junk.
Actually -
"This note is legal tender for all debts, public and private"
Yes it does have a unique number, but it's not nearly as traceable as a credit card or smart card. If I use a dollar to buy beer, CD-Rs or cocaine, there's no record that John Doe used 100 dollar bill X12345678Z at 10:12:14 on Jan 1, 2002 at Bob's House of Crank, Beer and Blank CDs.
If I use a smart card or some other "cashless" solution...it's all tracked.
Chick-un GOOD
as usual, any time smart cards are mentioned on /., a bunch of europeans jump in to praise the wonders of the electronic wallet, to announce that everyone uses and loves them over there, and to suggest that americans are stupid for not embracing them as well.
it's all bullshit. no one uses electronic wallets in europe.
this is from the economost, may 2001: "According to 1999 figures collected by the European Central Bank, for every 1,000 cardholders, only 20 made a virtual-cash transaction on any day in Belgium, two in Finland, and just one in Germany. "
note that belgium is regarded as the country with the most loyal e-purse customer base.
what europeans DON'T have is access to credit that americans take for granted. who wants a stored value card that gives all the float to the bank when you can have a credit card that gives the float to the consumer? we're not stupid, you know.
nobody
parturiunt montes, nascetur ridiculus mus
Yes. I am overlooking the word "social".
It's a failing support system that at the current rate of funding and payouts...will never be seen by anyone under the age of 30.
I will never see a dime of it, nor will anyone born since the Vietnam War ended.
I don't buy the "it makes more jobs open so the young can have work", because 16 million new jobs have been created in the US since 1991, and the majority of positions vacated by a retiring person isn't filled by a young high school or college graduate.
And...at the time of creation in the US, the median life expectancy was 65.5...and the Social Security age was set at 65, it was not and retirement or poverty assistance tool.
To sum up so I sort of kinda stay on topic.
Smart Card that track spending and income - Bad.
Social Security - Worthless for Me
They remind me of my college id. Use it to get snacks from the vending machines, swipe it for the laundry machines, go to restaurants and pay with it, buy books with it, buy alcohol at the grocery store. Use it to get into electronically-locked rooms. Make long distance phone calls with it. I just wish I was back in college.
I go to umich and our student ID cards have a so-called "cash chip" which on the surface looks a whole lot like those things on the smart cards. The chip on my ID card can hold up to $20, redeemable at soda machines and the like. Anyway, the problem with them is that after a year of lugging the card around in my pocket, I tried to use the chip and it failed to function. I later got a new ID card, and again the chip failed after a few months. I would be reluctant to trust anything important to a technology that ceases to funciton after a few months of sitting in my pocket, so this smart-card thing sounds like a terrible idea to me.
-S
I got a $500 credit limit. I'm so excited.
-Waldo
I had Blue for awhile, dumped it...worthless...and looked into the new Visa Smart Cards...also worthless. None of them have any support for non-Windows systems, so their cardreaders are useless to me. Standards in the USA? Bah. I want European standards NOW.
I had a really fun conversation with a telemarketer offering me a card with a smart chip. I said I just had surgery on my ankle, and they went ahead and put a smart chip in then, so I don't need one, unless yours is fancier. What all does it do again? This went on for a full five minutes. Quite fun.
You = Shouldn't have answered the phone then!
Of course I am very well aware of that fact. That is the reason why some merchants do not support credit cards. ;-) This could have two causes: the merchant increases his prices seen globally to count credit card transactions in, which screws the cash-paying client, or those fees are minimal and can be declared as business expenses (taxes off etc...every merchant loves that)...either way: I don't feel as if I personally paid anything for the service. I know it is kind of pychological thing but I didn't get billed. Get the point?
The AC replying to you states that those costs are -of course- billed over to me. That last is not true: I never got a price cut because I paid cash. Perhaps I'm just not lucky
Ahhh...the great dumpster continuum. Many a free computer will be found there. -- sowth (748135)
Since the card readers are so cheap, and the cards themselves actually have CPUs, can you imagine a Beowulf clust... Aw, nevermind.
In Europe at least you use the same PIN in shops
that you use in ATMs. So Joe Sixpack can rest in
his drunken stupor, no need to learn another
thing.
Simple / Secure / Private
:-)
Choose one...
Are you saying that they don't have a similar network in the United States?
Judging from all the posts saying America needs to abolish cash payments asap, I'm inclined to think its true. There's no doubt, Interac is what I would conisder ubiquitus. Plus, if you use a financial instution like PC Finacial, there is no service fee at all. Though my question is, what are the Plus & Cirrus networks that our bank cards say they are compatible with? I thought they were US Interac equivalents...
In response to the comment about Americans being instructed not to use debit cards for significant purchases, I must say, I have never ever heard of that being a concern here in Ontario.
Talk about a technology looking for a solution. My favorite anecdote is about American Express Blue - a recent article in the NY Times (I think) said that at one point they asked their vendor if they could make the card with a picture of the chip on it, instead of an actual chip. Why? Because it would have the same functionality at a significant cost savings!
sulli
RTFJ.
there was an article about the uselessness of smart cards in the nytimes (unfortunately, it appeared on august 12, so now it is premium - read pay - content). visa and american express rushed to issue cards with smart chips, but have not found a use for them. the result - it cost a lot more to manufacture with no added benefit.
The whole purpose of the magnetic stripe was so the PDQ could phone home, the system has done it for years.
What VISA and Mastercard hope to offer is really of of little use to the average Joe. Specially in the US where fraud is covered by the bank.
Sure there is more security but what does that translate into? Certainly not cheaper transaction costs.
Potentially the next biggest market for smart card is the the area of E-Purse/E-Wallet systems. Operators of these systems hold the float, earning interest to maintain the POS terminals and related systems.
In simple terms the value is store on the card securely (PIN) and in some implementations allow a nominal amount to be deducted without a pin for fast transactions. (Toll boths/vending machines etc)
Unfortunately this model has been around for a number of years and many have attempted to enter the market. In 99% of the cases the scheme doesn't have enough market(store) penetration and flops.
The most successful scheme yet is the multos based system which I beleive is making a number of in roads in europe. Another is in Mayalsia, where the goverment is sponsoring the deployment of a National ID card which doubles as a E-Purse.
It's only a matter of time when VISA or Mastercard make leverage there market share and make the transition from credit to E-Purse.
Rob.
Area51 - We are watching...
You = Shouldn't have answered the phone then!
I see. So its my fault someone is calling me. I guess i should ignore friends and family calling me too. There are some interrupts to my dinner i don't mind; calls from friends and family are one. But someone using my phone to try and sell me something is one i mind greatly.
Ot rant: What the fuck is with people who insist on making their page 1000+ pixels wide? It's been proven that narrower text columns are better on your eyes, easier to read, and allow you to read quicker. A brower doesn't have to be as big as your screen.
When I was able to do my own spam-armoring, you got a chance to email me. Now you can only hope I see your reply.
And this will be safe!!
Why?
You've probably heard about PGP(pretty good privacy) and what the basics are: public and private key system....
so everyone will get one pair of those...
This will make it easier to pay on the internet and to make sure you are who who you tell you are ("everyone will get/be a personal number")..
And a multi-to-one card...: why should it be difficult to make that...??? Proton chips can store a lot.... and like we have frequency bands, we can have datasections for every bank/institution....
**fatnotic**
Ahem, where have you been? Germanium devices have gained popularity in the last few years because of their favorable operating chracteristics. New processes have given us g transistors and diodes with higher heat dissipation abilities, as well as higher frequency operation.
Germanium is popular again. Take a look through an electronics catalog or something.
You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
The only smart credit card is one that says "Noooo!" when you try to buy something.... ;-)
I do everything the voices in my head tell me to...