Contactless Credit Cards

An anonymous reader writes "According to his article in EETimes, Visa and Philips are teaming up to introduce a so-called "contactless credit card". Basically it'll work like the proximity cards many of us use for access to our places of work or apartments. You won't need to physically swipe it, simply waving it over a reader is good enough."

Comments

Good and badGood and badGood and Bad

[krray]

I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

Where?s the security? I often wonder why the heck credit card purchases don?t require a PIN at the very least. Yeah, we?re all high tech and thumb prints and/or eye scans would be cool, but I?m all for having to know and enter a PIN on each and every purchase.

I tend to go for EFT payment whenever possible as I do have to enter a PIN. Shoulder surfing or a corrupt security camera guy is always a problem. I?m smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN too. I suppose insurance costs and ?shrink? just isn?t too expensive yet?

I?d be impressed if there was a thumb reader built into each plastic card I waived around buying all my shit.

Mobile gas anyone?

Re:Good and badGood and badGood and Bad

[the_bahua]

I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.

At the very least, the signature process should be retained.

Re:Good and badGood and badGood and Bad

[FatRatBastard]

Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

Re:Good and badGood and badGood and Bad

[FatRatBastard]

...Assuming you're a lazy ass like me and don't take it out of your wallet when you swipe it to get into your building.

Re:Good and badGood and badGood and Bad

[pirodude]

It's fairly easy and a part of all smartcards on the market today. Not only is the reader able to verify the card, but the card is able to verify the reader.

How I see it working would be, 1 central authority (CA like we know it for SSL certs) issuing certificates to all of the readers on the market (there still needs to be a way to expire the certs incase one gets stolen, put out of service). The cards will contain the corresponding certificate for the CA so it can properly validate any certificates the CA signs. When

Re:Good and badGood and badGood and Bad

[teknokracy]

And then it comes down to the point where you have the fact that the card could just as easily be stolen. No amount of encryption would protect a card from that.

Re:Good and badGood and badGood and Bad

[RajivSLK]

to charge them, it's very much a physical action.

Physical, hardly.
Have you ever purchased anything online?

All I need is your number, name and expiry and I can charge your account all I want.

Credit card accounts are inherently very insecure. Prosecution is the only thing stopping (even more) massive fraud.

Re:Good and badGood and badGood and Bad

[b0r1s]

I would be interested to know how they would be able to stop "contactless thieves" in this case. It seems to me that scanners would become available for people to walk around zapping people's funds away from them. One nice thing about the tried and true swipecards is that to charge them, it's very much a physical action.


Not entirely true. One of the more common credit card scams here in Los Angeles is portable card scanners being carried by waiters in restaurants. As they take the card you've handed them back to scan it for the bill, they scan it in their personal scanner, which records the information for later use.

There is no meaningful physical location tied to this because you've given your card (intentionally) to someone you have to trust. If you eat at multiple restaurants over the course of a week, there's no easy way to trace the theft back to an individual location.

Re:Good and badGood and badGood and Bad

[Jetson]

The magnetic strip in my credit cards are usually destroyed/useless before the card even expires.

My cards usually crack from curvature long before the stripe is demagnetized or worn away. I guess that's what comes from sitting on your wallet all the time.

FWIW, Esso Canada (gas station chain) has been using keychain-dongles for rapid payment for about a year now. You just hold your keys in front of the coloured box on the pump for a few seconds and it prepares to make the sale exactly the way it would if you stuck your card in the stripe reader. They also put the same dongle-reader at each cash register so you can buy your morning coffee a few seconds faster....

Re:Good and badGood and badGood and Bad

[KrispyKringle]

"Skimmers" are pretty common as is. If we had a more complex system to defeat them involving some sort of PKI you have two issues.

First, this would be hardware based and it'd be fairly likely that someone out there would sell a legit signed reader to a theif or a theif would get one somehow. Unlike the CA analogy, where this only effects people if the fake store manages to steal the real store's private key as well and the weak point of trust is still a legitimate store, here, we are looking at a stolen card reader and suddenly the weak point in the chain is not just a shopkeeper or retailer, but any random theif who manages to walk by you on the street.

Second, how would this infrastructure work in conjunction with CC# purchases where there is no physical transaction, i.e. online purchases? I suppose you could only implement it for proximity card purchases, some sort of built in smart-card feature as you said, but I don't even see it as providing that much security. As I said, one stolen reader and someone can charge you whatever they like.

The best solution I can come up with, now that I think about it, is to have all the proximity-broadcast information encrypted with a public key for VISA or whoever, and only VISA can decrypt it. That way, even a stolen reader is useless, all someone can do is charge for purchases, and then the money paid from the CC company is traceable anyway. There is no way for the theif to actually gain the CC details. No need for any other sort of security; you could give this information out to everyone on the planet and have it still be totally secure.

Re:Good and badGood and badGood and Bad

[cmallinson]

Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

I have two proximity cards on me at all times, for two different security systems. Whenever I swipe one card, and the other is too close, it will not work. There seems to be some interferance between the two cards. I assume that the reader machines would be able to tell if more than one card is detected, and the transaction would fail.

Re:Good and badGood and badGood and Bad

[u19925]

"I often wonder why the heck credit card purchases don?t require a PIN at the very least."

do you mean credit card should require PIN + signature or just the PIN?

you use your ATM, typically at certified places. credit cards on the other hand can be used at lot more places where possibility of cheating is higher. so PIN is secure enough for ATM, but is not secure for credit card. by requiring a signature, they (credit card companies) make sure, shopkeeper cannot cheat. Note that, credit cards, when used for cash advances at ATM, you only need PIN.

Requiring signature AND PIN would be totally redundant.

Re:Good and badGood and badGood and Bad

[alexburke]

Hell, there's even a simpler problem: If I have more than one credit card which one will it "charge?" Or will it charge both?

The one you pull out of your wallet/purse and hold in front of the reader?

Re:Good and badGood and badGood and Bad

[Tet]

I often wonder why the heck credit card purchases don?t require a PIN at the very least.

Ask and ye shall receive. In the UK, all customer present credit card purchases will require a PIN within 18 months. It's being trialled in Northampton at the moment, before being rolled out to the country as a whole. PINs are already required in many countries in continental Europe.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

All I need is your number, name and expiry and I can charge your account all I want.

Exactly, and being able to simply walk by someone and wave a magnetic reader NEAR their wallet while they don't even notice would probably make this easier.

Re:Good and badGood and badGood and Bad

[nmg196]

> Physical, hardly.
> Have you ever purchased anything online?

Yes, I seem to recall needing to physically see my card to do it and enter the numbers on a keyboard. The site did not simply sense the card in my wallet from a pop-up window and start charging things to it.

> All I need is your number, name and expiry and I can charge
> your account all I want.

And how will you get those without seeing something with my card details on it (like my card)?

The argument here is that just walking past something/someone carrying a proximity reader could steal all the details off your card and possibly start using it unless it's also combined with some kind of compulsory PIN.

Nick...

Re:Good and badGood and badGood and Bad

[the uNF cola]

Hopefully, the proximity would have to be kinda close, like building passes.

Then again, you'll have thieves who'll get just a little too personal, IMHO.

Re:Good and badGood and badGood and Bad

[RajivSLK]

My point is that the current credit card authentication system is so insecure that it doesn't really matter what the physical card is made of. The only thing that keeps massive fraud from occurring is the paper trail. It is easier to trace the money and prosecute that it is to secure the system. Securing the system would inconvenience the user and that is something that visa would never want. It is much easier to prosecute.

That being said we may see this attitude change in the future as online credit card databases allow fraud on a much larger scale.

For the record I can get a large number of credit cards (probably yours too) fairly easily:

Receipts carelessly tossed in a garbage can outside of certain stores (yes, many of them do print your full name, card number and exp. Date)

Hacking insecure online servers (many have 1000s of cards in plain text or weakly encrypted)

Grab your mail

Look in your recycling box

Look at your card over your shoulder

Hidden cameras, crooked cashiers/waiters etc

Set up a fake online store selling a few products very cheaply.

Set up a cheap porn site. (ala the Eros Island scam)

etc

Re:Good and badGood and badGood and Bad

[TheMidget]

You, Sir, are a moron

Re:Good and badGood and badGood and Bad

[tomstdenis]

Actually Detective Green,

there is a method. Simply make up different cards and use each one at a different restaurant...

Days like this I wish I was head cop guy instead of unemployed compu-geek crypto-nerd.

Tom

Re:Good and badGood and badGood and Bad

[jjshoe]

then what is the point of the proximity based card if you still have to hand it to the untrusted cleark behind the counter?

I HATE TARGET. they have credit card swipers on the end of every register for *my* privacy, but if i use it, i still have to hand my credit card over. what is the point?

Re:Good and badGood and badGood and Bad

[Daemonic]

I often wonder why the heck credit card purchases don?t require a PIN at the very least.

French credit cards in French shops require a PIN to be entered.

UK credit card companies say they intend to implement the same thing.

Re:Good and badGood and badGood and Bad

[Jameth]

The point is that, while a hand-held scanner is hard to notice, someone ten feet away with a scanner in his briefcase on the subway is virtually impossible.

I recall when the place I worked at had a card scanner with way too much power. All you had to do was, assuming you had the card somewhere in your rear pocket, twist slightly while walking past. It'd catch things over a foot away.

Re:Good and badGood and badGood and Bad

[LordKronos]

Esso Canada (gas station chain) has been using keychain-dongles for rapid payment for about a year now.

Yeah, Mobil here in the US has been doing that for over 5 years. It's called Speedpass. You can use it right at the pump, or you can use it at the register inside to pay for whatever goods you buy. Just looking at the speedpass website, it looks like its now accepted at Exxon and even some McDonalds (probably those ones that are located at gas stations) and Stop & Shop(?) stores. The keychain-dongle is what they've always used, but it looks like the web site is advertising a speedpass watch now too.

For me, a credit card at the pump works just as well, but I can see how it would be handy. If you lose it, its only good at a few places for whoever finds it (as opposed to a credit card).

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Except then you've given some people an extremely large incentive to throw some processing power at finding the private key. Perhaps an underground version of distributed.net's operation? You could change the key periodically if the readers did the encryption, just push out an updated public key now and then...but then the card is unprotected. Unless you send out new cards to everyone fairly often, there'll always be the chance that the private key might be discovered before all cards using that key have been replaced.

The average and maximum time to find the key might be immense, but there's no guarantee the key can't be stumbled upon quickly.

Re:Good and badGood and badGood and Bad

[jdreed1024]

All I need is your number, name and expiry and I can charge your account all I want.

Actually, that's less and less the case. With the exception of the "big" vendors who have enough fraud insurance (amazon, etc), more and more vendors are instituting stiff requirements on your card purchases such as: a) shipping only to the credit card billing address (or another address listed on your credit card), b) requiring that you enter the CCV (the three digit number printed on the signature stripe of the card), c) requiring that you enter your credit card's customer service number so they can contact your bank.

And almost all online vendors (except the really sketchy ones) require that you provide the credit card billing address when placing an order. If they don't match, the order won't go through. I have had several vendors call me when this happened because I typo'd the name of my street.

On a related note, I wish more and more brick and mortar stores would check your signature. To prove a point, my friend and I were making a purchase at a large national chain store, and he signed "Homer J Simpson" to the credit card receipt, and the cashier didn't care.

Re:Good and badGood and badGood and Bad

[zerblat]

In Sweden credit card purchases require either entering a PIN code or showing ID plus a signature (except, it seems, in bars and restaurants).

Re:Good and badGood and badGood and Bad

[jdreed1024]

I like the convenience idea of it. The magnetic strip in my credit cards are usually destroyed/useless before the card even expires. Between rubbing against other credit cards, contact with the leather, and/or body sweat highly used cards are usually replaced before they ?expire?.

The mag stripe isn't actually necessary for making the purchase. (If a store salesdroid tells you it is, demand to see the manager or take your business elsewhere). Only the card itself is required.

Back in the day, credit cards didn't have mag stripes. They were called charger plates, and they were placed in a machine along with a carbon sales slip, and when a roller was moved back and forth across the paper, an imprint of the card was made on the sales slip. And you signed it to charge something to your MasterCharge or BankAmericard.

The security was in actually having the card present at the checkout. That is still the case - you swipe it to prove that its there, or if the stripe doesn't work, they take an imprint of it (all places that take cards are supposed to have an imprint machine). That, combined with the signature, is in theory enough security. I'd wager a large portion of credit card fraud could be stopped if places would stop hiring illiterate 12 year olds at registers who can't even read, let alone compare signatures.

Re:Good and badGood and badGood and Bad

[gbjbaanb]

I'm sure using a contactless credit card will be exactly liek you use the swipe card at the moment - only the reader will be a different shape.

I used to have credit-card shaped contactless door pass at a previous company. Only they were binned in the end as having too great a failure rate - people would put them in their wallets in their back pockets and they'd (the internal aerial) get slightly bent and stop working. In the end we changed to teardrop-shaped versions which worked very well and made an excellent keyring. (which raises an interesting idea - concept credit cards - strange shapes made into jewelry, watches, pens...)

I think the same problems with the form will happen here, unless technology has improved.

Oh, and the worry about criminals 'swiping' your card - forget it, these door passes had to be slapped against the reader even though they were technically contactless, the range was truly pathetic.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

It's rather common to not show ID+write a signature.
When that happens, I usually grab the pen like a child grabs a crayon and make some round circles. It's pretty fun, and the next time they see me they usually want to look at my ID. Haw haw. umm

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Well what would be the point? Credit Cards are supposed to be used online... And just like Bank cards with a Cash account, you cant use them online by using a pin number :(

Re:Good and badGood and badGood and Bad

[thelexx]

Card in pocket, it is far from "just as easy" to take it from me as it would be to pass a wand over my butt without me noticing.

Re:Good and badGood and badGood and Bad

[SomeGuyFromCA]

My cards usually crack from curvature long before the stripe is demagnetized or worn away. I guess that's what comes from sitting on your wallet all the time.

Keep your wallet in a front pocket - it's less vulnerable to pickpockets, doesn't mess with your seated posture, and doesn't deform everything in it.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Man, this arguement is faulty.

"It's really bad now, so it doesn't matter if we make it a little worse."

I mean, seriously?

Re:Good and badGood and badGood and Bad

[l1gunman]

Sadly, not even the correct name or expiry date seems to be required for many online authorizations of a card charged. I had an issue some years back where my number (apparently generated at random?) was used for several fraudulent charges to some shall-we-say questionable web sites. The name associated with the charges was not even mine - it was several made-up names like qazwsx (look at your keyboard). I had never used the card for other than my now-defunct CompuServe charges - there was no way someone could have gotten hold of even a discarded charge carbon as it was never used in such a way (and I'm a compulsive shredder). The authorizations were given without a notice of the phony name. I got the charges reversed, but the point is that many (most) online charges don't go through even the most basic of data verification.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Mastercard already has this running in Orlando. Its called PayPass. Check out http://www.paypass.com. It is designed so you only have to sign for your purchase if its over $25.

They claim the sole purpose of this is to stop "skimming", or merchants having personal readers to grab the info off of a card.

Although skimming might eventually be possible with this as readers become available, they do not transmit the credit card number or info. My understanding is they transmit a unique ID instead. Although someone may eventually find a way to use this, you certainly can't get on a website now and buy things with the unique ID. And they don't plan on the ID's ever becoming public, so they won't allow merchants to enter in this ID to pay for a purchase. So while it certainly isn't completely secure, its a big step up from the current system.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

what is there stopping me from monitering for this "encrypted" data? i don't necesarily need to know the real credit card number, as once i have the encrypted data couldn't i then make a purchase by sending the data that was encrypted by the card?

visa is expecting encrypted data and that is exactly what it is recieving...and once unencrypted do we not still have the real cc number? the only difference being we do not know what that number is, but visa will.

encryption doesn't necesarily make data secure!

Re:Good and badGood and badGood and Bad

[walt-sjc]

Yeah, online purchases are a problem. Amex has "one time only" card numbers that you can use when buynig stuff online and you don't trust the merchant or system.

Frankly, I'd like to see the big companies (Visa, Amex, etc.) have a paypal Like system (but without the extra "account" bullshit and paypal politics etc.) so you never need to give a merchant your card number. Verisign announced something like this years ago, but I have yet to see any merchant using it.

Re:Good and badGood and badGood and Bad

[cdh]

This isn't limited to Target. Most stores that have self-swipe terminals ask to see it. You should be happy for it as in theory (yes, I know in practice it doesn't always work this way) the cashier is supposed to confirm the signature.

The convenience is there as you can swipe the card as the cashier is ringing up the items. Then the acceptance process is completed faster.

Re:Good and badGood and badGood and Bad

[walt-sjc]

To attempt the USELESS step of matching your signature with the one on the card. I never sign my name the same twice. Many times it's not even close. What's worse is the Home Depot "sign on the touch screen" thing that is so bad it's almost unreadable.

By the way, the swipers are not really for your credit card privacy, they are really for ATM cards so you can enter the PIN. Yeah, I know you can run a credit card through, but I don't even bother.

If you are really concerned about card theft, you can always write "see drivers license" on the signature spot. Won't stop people from buying gas at an automated pump though.

Re:Good and badGood and badGood and Bad

[hagardtroll]

Just implant it into your skull.

Re:Good and badGood and badGood and Bad

[rbuysse]

On a related note, I wish more and more brick and mortar stores would check your signature. To prove a point, my friend and I were making a purchase at a large national chain store, and he signed "Homer J Simpson" to the credit card receipt, and the cashier didn't care.

I write "See ID" on the back of my credit cards for an extra measure of security. It's really frustrating when a cashier somehow manages to match that with my signature on the receipt for a $400+ purchase.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

Where?s the security?

The security is that little camera above you when you make your purchase combined with laws we have against theft.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

Why do you care if that cashier's business gets screwed over? Chargebacks without a valid signature are going to be accepted every time.

Re:Good and badGood and badGood and Bad

[vidarlo]

Pin-code. Or thumb reader in the card. So _you_ had to hold it when paying. Then you could not skim one in the pocket of one. This would however, not be as convinient as pin-code, since it was only you that could use the card, you could not lend it over to some you trusted to pay at the resturant (At the end of galaxy;).

Re:Good and badGood and badGood and Bad

[teknokracy]

That's just expensive and awkward. The common card we use today works because the standard was decided on years ago, and everyone has gotten used to this kind of thing. If someone wants to make a new way, try and make it as similar to the old way. That may sound like the talk of a luddite, but think of _who_ will be using these cards... you, your kids maybe, your grandma... now are most of those people going to figure out some kind of complex thumbprint scanner or something? The answer is most likely no.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

Except then you've given some people an extremely large incentive to throw some processing power at finding the private key. Perhaps an underground version of distributed.net's operation?

You could always use a different public/private keypair for each card. And there's no reason to release the public key(s) as long as you require a connection to the processing system for verification. Just send the encrypted data to the processing system.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

Yeah but if your card is physically stolen, you know about it and can report it.

Re:Good and badGood and badGood and Bad

[GTRacer]

...you could not lend it over to some you trusted to pay at the resturant (At the end of galaxy;).

...But for meals at Milliways, you wouldn't NEED a cc as you've already paid the exorbitant cost of the meal by depositing one penny in your bank account before your arrival!

GTRacer
- Confounding compounding interest!

Re:Good and badGood and badGood and Bad

[The trees]

I don't keep my signature on my credit or check cards. Instead I write "SEE ID". It's still not perfect, but it would take a thief that extra bit of effort to fake an ID instead of simply forging my signature.

Re:Good and badGood and badGood and Bad

[damiangerous]

"See ID" is consider invalid. The merchant is not allowed to accept any card with "See ID" written on it. They're supposed to make you sign the card and then compare that signature with another piece of signed identification. If you refuse to sign the card, they're not allowed to accept it. They usually do, of course, due to poor training or apathetic cashiers, but they're completely liable for any chargebacks in that case.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

The only thing that keeps massive fraud from occurring is the paper trail.

That's true for online purchases, but at the supermarket, the only paper trail is your signature (and possibly a security camera). And if you're going to use contactless credit cards without a signature, what's the point, really?

You look at the card, then you look at the signature on the back of the card, and if they don't match, you ask for ID. Sure, there are places that don't do this, but likewise there are stores which expect you to ring a bell to alert the cashier to come to the front and take your money (yes I've actually had this happen at a supermarket at 3 in the morning).

Inherently, if security is breached, it's most likely the stores own fault. But with this system there's not really anything that the credit card companies can point to to put the blame on the stores. Unless of course they require a signature and ID anyway, and just realize that stores aren't going to follow it since it defeats the purpose of a contactless card.

Re:Good and badGood and badGood and Bad

[bill_mcgonigle]

I often wonder why the heck credit card purchases don?t require a PIN at the very least.

The Credit Card Companies want to make it as easy as possible to use your credit card. The easier it is, the more people use them. PIN's are an inconvienience.

Now, here's the kicker: the credit card companies don't assume any risk for fradulent transactions. The merchants do, if they accept a credit card without a signature (gas stations, online, etc).

And, in the end, that's why identity theft is so successful and hard to prevent.

If they required a PIN, identity theft would go down, merchant losses would go down, heck, muggings would probably go down, but so may credit card companies' profits.

Re:Good and badGood and badGood and Bad

[jdreed1024]

Except more and more merchants are refusing cards that say "SEE ID". Technically, it's in violation of their agreement, and they're not supposed to accept it. Call VISA or Mastercard - they'll tell you the same thing. My last credit card came with a little note that said special interest pieces on the news dealing with fraud tell people to write "SEE ID', but that it's not allowed by the credit card company.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

I'd wager a large portion of credit card fraud could be stopped if places would stop hiring illiterate 12 year olds at registers who can't even read, let alone compare signatures.

Of course, hiring anyone but illiterate 12 year olds at registers would cost more than the credit card fraud they'd stop.

Re:Good and badGood and badGood and Bad

[Servo]

I wrote "See id' on the back of one of my cards a while back. I have NEVER been asked to show ID when using that card.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

If they required a PIN, identity theft would go down, merchant losses would go down, heck, muggings would probably go down, but so may credit card companies' profits.

Huh? Why would card company profits go down but not merchant profits? After all, merchants want to make it as easy as possible to use your credit card too.

Re:Good and badGood and badGood and Bad

[Tet]

When that happens, I usually grab the pen like a child grabs a crayon and make some round circles.

I always do that when signing for a package, or initialling a receipt for cashback in a shop. They've never once checked, or asked for ID...

Re:Good and badGood and badGood and Bad

[archaic0]

The whole idea of using the signature to validate the purchase is stupid if you ask me. Let's step through the process.

step 1: bad guy steals my card
step 2: bad guy goes to store
step 3: bad guy grabs a $1000 worth of stuff
step 4: clerk rings it up and swipes my card
step 5: CARD CLEARS - money gone
step 6: bad guy signs name
step 7: clerk then compares signatures
step 8: they're close, or could be close, but he doesn't really know because he's not an FBI handwriting expert. So what the heck does he do? He assumes it's OK. Then it's up to me to figure out what went wrong, PROVE IT, and fight for my money back. It will eventually come down to comparing signatures and will all be fixed.

Even if the clerk does think the signature is bad enough that it might be a bad guy, he can hold the card, but the stuff and the bad guy go right out the door. Then, let's start the process of getting my money back. Meanwhile, I'm out $1000

Say it is me with my own card, but I've had a bad day and I have a cold and my signature looks nothing like it did when I signed the card. Then what?

Signature comparing equals zero security. Only if a handwriting expert was the clerk would it be anywhere close to making sense.

All cards should require PINS and/or require photo ID. No exceptions. Online purchases should be governed by a list of changing PINS that your bank gives you via ATM reciepts or monthly bank statements. You'd have to remember the next two PINS maybe each day, but I'd rather do that than deal with fraud. Or we could go to biometrics, but I think we're closer to the PIN solution than refiting all the terminals with scanners.

Re:Good and badGood and badGood and Bad

[bill_mcgonigle]

Huh? Why would card company profits go down but not merchant profits?

Merchants take the bulk of the losses for fraud, not the credit card companies.

After all, merchants want to make it as easy as possible to use your credit card too.

The issue isn't whether you'll make the purchase, it's whether you'll make the purchase with a credit card. Imagine if they start requiring eyescans and blood samples. Forget it, I'll go inside the gas station and pay in cash. I won't not get gas.

Re:Good and badGood and badGood and Bad

[z_gringo]

In France, all the Bank Cards have pins. (of course if you leave france with your french bank card it just works like a normal Visa), So if you are in France with a French card, you just put your card in the machine, and enter your pin. No signature is required. It's a really nice system, and the French seem to use them for just about everything. I'm still in the habit of using mostly cash.

Of course there are downsides to the french system as well. I once entered the wrong PIN 3 times on accident, and I had just purchased train tickets. But they couldn't Print the tickets unless I validated the PIN. My account had already been charged, and they wouldn't give me the tickets. I tried to just by new tickets, but she helpfully explained that the train was full. (of course the train wasn't full because I had already paid for an reserved a seat. This led to a conversation where the crazy french lady said nothing but "Your card is blocked. The Train is full." for like 5 minutes. I still see her in my nightmares taunting me.. "Your Card is blocked. The Train is full" over and over..

Re:Good and badGood and badGood and Bad

[Malachi]

Actually, there are more sites out there than naught that require your billing address to match up.

Of course this isn't fool proof, but it is a growing simple deterrent.

-M-

Re:Good and badGood and badGood and Bad

[ptbarnett]

I wrote "See id' on the back of one of my cards a while back. I have NEVER been asked to show ID when using that card.

I have "DEMAND PHOTO ID" on the back of all of my cards, next to the signature (so that the card is still signed, and valid).

About 1 in 10 ask for ID. So, I consider the measure useful only to discourage someone from trying to use my card, because they might be challenged.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

OK, I see what you're saying. Of course, if the credit card companies started losing money, they'd probably just raise the processing rates to compensate.

Re:Good and badGood and badGood and Bad

[UnixBlackhole]

the only problem is that the cashiers never check the signature, my mother once had her card stolen and the theif kept MISSPELLING her name! and the cashiers just let her go with it!!
but the eye scans sound like a good idea

Re:Good and badGood and badGood and Bad

[Sylver Dragon]

I work with this technology daily, I happen to work for a company that makes physical security systems, and probably have worked with the type of reader you are talking about. While I have seen readers that can hit a foot, or even a couple of feet range, none of these have been smart-card readers. There is a major difference between your standard wiegand type cards and smart cards, and a lot of this is the amount of data transmitted. So far, the best Mifare card readers I have seen (type of smart card mentioned in article) have about a 4 inch range and have to be held there for a couple seconds. Plus, the security of this stuff can be incresed greatly by also requiring a fingerprint ID from the card holder. In the case of the readers I have worked with, the fingerprint can be stored either on the card itself (encrypted) or in a database. When the card is presented you simply place your index finger (not the thumb, it doesn't scan as well) on a pad and wait a second. If they want to impliment contactless credit cards, I would see this sort of thing as a requirement.
BTW, if you still have access to that reader, get a card or two from your co-workers, stack them together, then present them to the reader. You'll find that they don't read very well, or at all. Now, considering this, if you happen to have 2 or three of these contactless cards in your wallet, it'd make it a real pain for someone to simply bump into you and read your cards.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

It's not a purse! It's European!

Re:Good and badGood and badGood and Bad

[The Salamander]

I just refuse to give it to them. They can then either accept it, or cancel my purchase. They
then accept it.

Actually, I don't shop at TARGET anymore because they seem to hire more pathetically slow morons than other places.

Re:Good and badGood and badGood and Bad

[jdreed1024]

Meanwhile, I'm out $1000

Um, no, you're not. At least not in this country. With a _Debit_ Card, you might be, but, that's a different issue entirely. With a Credit Card, you are liable for at MOST $50, and most reputable companies will waive that. If you report the theft as soon as possible, and the charges occur after your card was stolen, you're often not even liable for the $50. I had my card stolen, and a guy rang up about $500 worth of stuff. I didn't pay for any of it.

Now, with a debit card (that has a MC/VISA logo on it), on the other hand, you can lose lots of money. Generally, if you report the theft, your bank can put a hold on the account immediately, but you may still end up losing quite a bit. Which is why you should never use the credit card feature of a debit card if you can avoid it. It can also take longer to work out things like duplicate charges and the like.

Re:Good and badGood and badGood and Bad

[ryanwright]

This is silly. They should be using iButtons. Totally waterproof & nearly indestructible. About the size of a thick dime, can be made into jewelery, etc. The Java versions are only slightly larger and can hold public & private keys and perform detailed transactions.

And they're cheap! Less than a buck each in bulk. A little more spendy for the Java iButtons. They aren't contactless. They automatically transfer data at 140 some odd Kb/s when you tap them onto a reader. One quick tap is enough to complete the transaction.

I've bought some and am having one built into a ring to use for access control for my home (unlock doors, etc) so I don't have to carry keys anymore.

I have no idea why Visa/etc haven't signed on to this idea. iButtons are the best thing since sliced bread.

Re:Good and badGood and badGood and Bad

[Zirnike]

"Where's the security?"

That's not a problem. Just turn your wallet into a farraday cage.

Is that a metal cage in your pocket, or are you just happy to see me?

Re:Good and badGood and badGood and Bad

[archaic0]

Meanwhile....meaning until it's sorted out. It may take a few days, or even a week to get it sorted out. Not that I'll be out the money forever, just that I have to go through a process to get it back.

Also, legally you are right about being liable for $50 on a credit card. The legal Debit Card liability in the US is $500. Each bank handles it differently, but in the end, there is a process to go through either way. Especially if the perp is smart about it and uses the card right before a weekend or holiday then it's just lost time to nail it all down.

If my card required ID or a PIN, the process wouldn't have been started in the first place.

Re:Good and badGood and badGood and Bad

[Zirnike]

"I wish more and more brick and mortar stores would check your signature"

I used to work for Sears. I did this. One guy comes up, tried to buy something, I think a faucet, and gave me an unsigned credit card. I asked him for ID, he gave it to me, complaining, and I handed back the ID and the card, and asked him to sign it. He refused, started yelling, and walked out.

Mind you, the card quite clearly states 'not valid until signed'. And this wasn't an isolated incident, either.

That is why stores don't check signatures very well. Customers don't want the security it provides.

Re:Good and badGood and badGood and Bad

[rbuysse]

I don't care if they get screwed over. I care if I have to spend time and effort out of my life because some stupid cashier didn't bother to perform basic security checks.

Comparing signatures is worthless. Verify me by means of official picture ID.

Re:Good and badGood and badGood and Bad

[ptbarnett]

Whenever I swipe one card, and the other is too close, it will not work. There seems to be some interferance between the two cards.

I can already see it: someone will market a bogus proximity card, for the sole purpose of interfering with any proximity credit cards nearby.

Put one in your wallet, and it "shields" the rest of your credit cards.

Maybe I should apply for a patent......

Re:Good and badGood and badGood and Bad

[DonFinch]

right but to steal you card number, and copy it all I need to do now is have a reader in my front right pocket, a PPC running SNIP (spell that backward you'll get what it is for!) and walk around bumping my front pocket into purses and back-pockets containing wallets. you'll just think I'm some odd horny freak humping people in the street at random, when you're card suddenly shoots through the roof and your credit report is shot. I doubt the "horny old man" would be the first you think of.

Re:Good and badGood and badGood and Bad

[SmegTheLight]

Unless your disabled and have no hands to
fingerprint, or blind and have no eyes to scan..

Guess a DNA scan would be next..
Everyone has that

Well, at least everyone who should have a credit card ;)

Re:Good and badGood and badGood and Bad

[BuckaBooBob]

I dunno about contactless CC's... How long is it untill someone walks around with a strong portable reader and grabs away all the CC info of people that walk near enough to it for them to be read... This will be a scammers dream come true

Re:Good and badGood and badGood and Bad

[Fluid Truth]

The big problem with PINs is verifying it. If it's built into the card, then it can either be read or changed. If it's something sent over the wire, then it's just one more thing that can be stolen and then faked. This is the same general problem with any sort of authentication scheme. How do you prove you're you without allowing someone else to find out how to prove that they are you?

The closest one I've heard of is a biometric check that has a lot of information, but only a small part of it is requested (or is it that only a few bits are sent down for comparison? I can't remember). That way, even if the information is intercepted, only a small part of the total information is leaked. Next time, a completely different portion of the information is requested/required. To get any significant portion of the information is a serious time investment. Hopefully, the investment begins to outweigh the benefit, and the information is simply not stolen (because it's too much work).

Re:Good and badGood and badGood and Bad

[frozencaveman]

my CC signature is
"ASK FOR ID"

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

It will be a near perfect idea if proximity credit cards go into full scale use.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

I care if I have to spend time and effort out of my life because some stupid cashier didn't bother to perform basic security checks.

So don't lose your credit card. Is it that hard? If you lose your credit card or if it is stolen you have to spend time and effort already anyway. The only difference is whether or not the merchant loses money.

Re:Good and badGood and badGood and Bad

[trigeek]

Actually, it would be in your best interest to go with the signature instead of entering a PIN for 2 reasons: When you enter a PIN in an ATM, the PIN is encrypted immediatly using hardware (usually an IBM 4758 encryption board). When you enter the PIN at the grocery store, they probably do the encryption using software, and exactly how secure is the back-end computer system at a grocery store? I don't trust an IT guy who couldn't get a job somewhere else. Also, it is virtually impossible to contest a purchase that was made using a PIN, so if someone else gets your PIN, too bad for you. Which brings me to my second point: when a bogus purchase is made with a signature, all you have to do is call the card company to get it cancelled. You cannot get a purchase made using a PIN cancelled.

Re:Good and badGood and badGood and Bad

[lewp]

The horny old man is always the first one I think of. Sigh... what a summer that was.

Re:Good and badGood and badGood and Bad

[Servo]

Do more than 1 in 10 look at the back of the card? Hardly anybody usually looks at mine, but even when they do they still don't ask.

Re:Good and badGood and badGood and Bad

[tigga]

If you eat at multiple restaurants over the course of a week, there's no easy way to trace the theft back to an individual location.

Yes - it's not easy for you. But if thiefs are greedy and do a lot of transactions from stolen cards than investigator could notice all stolen cards have been used in same restaurant recently.

Re:Good and badGood and badGood and Bad

[ptbarnett]

Do more than 1 in 10 look at the back of the card? Hardly anybody usually looks at mine, but even when they do they still don't ask.

When a cashier takes the time to look, they invariably ask for my ID.

I don't offer my driver's license (unless I remember them as a merchant that always asks), and watch to see what they do. If they hang on to the card until after I sign the receipt, I expect them to ask for the ID and have it ready.

But, most simply swipe the card through the reader and hand it back to me. I should note that I don't count people that know me personally and "self-swipe" terminals among the 90% that don't check ID.

Re:Good and badGood and badGood and Bad

[cpeterso]

or instead of a bulky high tech gadget, the waiter could just write down your name and credit card number on a napkin. Or he could just steal the receipt carbon copy.

Re:Good and badGood and badGood and Bad

[Eraser_]

I sign "DuckCow" (a joke amongst my friends) to any credit card slip where my picture ID isn't verified. I do it in mostly legible text too, so as to make anyone notice who pays attention. Not once have I been called on it, however some friends of mine who are cashiers places laugh at it when they see it.

I have also been tempted to write "Null and Void".

Re:Good and badGood and badGood and Bad

[Eraser_]

Not to get too nerdy here, but I wouldn't know if my card went missing for a day or two if I were purchasing online, mainly because I know my debit and credit card info by heart :(

I even use an old canceled one as the login to my online banking, nothing like pulling a 16digit userID out of your head infront of your friends to minimize shoulder surfing.

Re:Good and badGood and badGood and Bad

[KrispyKringle]

This is, I believe, the same system used by proximity smart cards. You would presumably be wondering why I can't steal someone's smart-card key-code via a proximity sensor in, say, an elevator.

Since the card itself contains a processor, it is entirely possible to make this system every bit as complex as any current PKI infrastructure. In other words, each card could contain its own private key as well as VISA's public key. The key-combination means that transactions could be "signed" (essentially, the private key would encrypt a hash of the transaction data that could then be decypted, or "verified", by the public key; this is how pgp signatures work as well) to prove that this is a valid transaction. What prevents someone from just rebroadcasting this transaction, as you said? Simple. Include some sort of incremented number, or the date and time, or any other dynamic information that would not be repeated. Anyone can rebroadcast an encrypted message, but this proves when the message was encrypted. If this is transaction number 35, and someone rebroadcasts it, he'd have to change the transaction number to 36 and then re-sign it before encrypting it for VISA. This is not possible, since he does not have the card's unique private key.

Much as with PGP, the combination of public key encryption and private key signing (the encryption itself is only necessary to hide the CC# to prevent online theft) renders the data transaction not only secret but also verifiable. Not only does VISA know no one else knows your CC#, but they can be assured that it was in fact your card that did the transaction.

Re:Good and badGood and badGood and Bad

[rbuysse]

It's a hell of a lot easier to cancel a card than to prove that the $400+ retail purchase was fraudulent.

There's no defense for not having proper ID checks, especially when the purchase is over $15.

Re:Good and badGood and badGood and Bad

[anthony_dipierro]

It's a hell of a lot easier to cancel a card than to prove that the $400+ retail purchase was fraudulent.

Have you ever done this? You don't have to prove anything. They have to prove that the charge is legitimate. It's really simple. You call your company and tell them your card was stolen.

All said it'll take you less time then you've spent bitching on slashdot, and a lot less time than you spend pulling out your ID every single time you make a purchase. Unless you're getting your credit card stolen once a week or something.

There's no defense for not having proper ID checks, especially when the purchase is over $15.

Sure there is. It's more expensive to check IDs properly than it is to just deal with the fraud.

If having 100% secure payment at any cost is necessary, then you shouldn't be accepting credit cards in the first place. Accept only cash.

Re:Good and badGood and badGood and Bad

[ccnull]

The "PIN" idea is creeping into the credit card arena -- most Internet and phone purchases now require you to give the "last three digits" from the back of the card. Not quite the same as a secret PIN, but getting there.

That said, how exactly is it more convenient to wave a card over a scanner than swipe it through a reader? I guess you wouldn't have to take it out of your wallet... but what if you had more than one card? How would it know which one to use? The point of this is escaping me. I would bet the same opinion will be had by Visa, MC, and Amex...

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Hot damn, no more surfing dumpsters for numbers, just plant a few cheap scanners around, it'll gather just hundreds of numbers.

Shesh, "Credit Jammers, sniffers, etc" have been a STAPLE of science fiction. Wireless sniffing is a reality so it's not like they've not been warned.

Re:Good and badGood and badGood and Bad

[cait56]

The encryption/key issues can certainly be worked out if there is enough incentive. There is also some basic principles of common law that should prevent silently charging these things without informed consent. After all, the credit card industry makes a lot of money from consenting use of credit cards, they don't want to kill the goose that lays the golden eggs. The real potential abuse is wirelessly probing for data. What protection will these cards have against unauthorized *initiation* of a transaction when the snooper does not complete a transaction? I can already see retail outlets claiming that they have a legitimate reason to pre-scan your card to determine your credit limit, so they can better help you in the process of using all of it that is left -- oops, I mean tailoring their advice to your needs.

Re:Good and badGood and badGood and Bad

[satanami69]

pass a wand over my butt without me noticing

Thanks, fatass.

Re:Good and badGood and badGood and Bad

[Jetson]

Say it is me with my own card, but I've had a bad day and I have a cold and my signature looks nothing like it did when I signed the card. Then what?

I know store clerks don't get training in handwriting analysis, but I'm guessing most bank clerks do. I recently had to sign for a $100,000 money order and commented to the teller "I sign a bit differently each time, so this might not match my card". Her answer was that they don't really compare the signature as a complete entity (because they *do* change constantly), but instead they look for "identifying traits" such as whether or not you loop or join certain letters, drag your pen, tilt your crosses, circle your dots, etc.... IOW, they do handwriting analysis to see if your presented signature and your card have the same traits.

Re:Good and badGood and badGood and Bad

[jjshoe]

i dont sign any of my cards, and i realy hate when a cashier trys to lecture on me on why i should sign it. it is my personal choice to sign it or not. signature or no, if someone wants to use your credit card in a bad way they will.

Re:Good and badGood and badGood and Bad

[jjshoe]

in two departments stores i was un-lucky to work in before getting a real job no one was ever instructed to look at the slip. at the last place i worked, if the credit card went through the system, was aproved, and there's ink on the paper. all is good.

and as another post in this thread said something to the effect of slow cashiers... it doesnt matter what i do, im still waiting on the cashier!

Re:Good and badGood and badGood and Bad

[jjshoe]

i am to the point now where i cant wait to have my drivers liscence expire so i can re-sign FUCK OFF on it, then i will sign my credit cards and everything else they pitch at me.

there are people at the target around here that are such well known morons they stand behind their register with no one coming down their line while others have 4 people waiting. everyone knows better.

Re:Good and badGood and badGood and Bad

[Anonymous Coward]

Actually, no bank tellers do. I've worked in several banks (4 diffrent ones), and my wife has worked in 6 diffrent banks, and not one has given handwriting analysis tips. We're taught to examine the behavior of the person, more then their actions.

Re:Good and badGood and badGood and Bad

[vidarlo]

To continue in a bit of the same tone as the last post, in the voice of D.A: "I talk of none of them who is, but those who shall come." --Deep Tought. I think thumbreaders are pretty cheap now. Around 80-100$. If you build that into, lets say a mobilephone/pda, you will have safe authentication for datas on mobile/pda, and you can easily build in a credit-card module. In norway, it is possible to shop with the mobile phone, you send a SMS to a certain number containing the amount and the 6-digit shop number. I've not tried this myself, but I'm pretty sure it can be linked to the bank account. Then you basicly have a credit card. You can pay with it, without dragging your card. But you have to enter a lot of numbers. So if you refine this, into that the shops, via bluetooth or GSM or whatever, sends a message to your phone when you are ready to pay, with a predefined SMS, and then you have to drag your thumb to confirm, or press a key or something.

Re:Good and badGood and badGood and Bad

[Grizzlysmit]

Work on new near-field radio communication technology, called Near Field Communication (NFC), initiated by Philips and Sony Corp.

Like how near no more than 5 - 10 cm (2" - 4") I'd hope! or it's too insecure, not that credit cards are secure, any one who ever thought that banker had even slight IQ, observe the security on credit cards, and you know bankers are dribbling morons!!.

Re:Good and badGood and badGood and Bad

[camken]

That's why i only keep about $200 in my account at any given time..
If i'm going to make a large purchase, i

1. call the bank to transfer funds from my savings account, or

2. visit an ATM to transfer or simply withdraw the money first.

this is also incredibly useful when going out on the town, it keeps me from spending too much money at the bar as i can't simply 'leave it open' and drink until i forget how much i've spent.

Re:Good and badGood and badGood and Bad

[Huogo]

I recently started as a bank teller. I was not trained in any way, shape, or form in handwriting analaysis. If it dosn't look very close, I just ask for ID.

Re:Good and badGood and badGood and Bad

[ndnet]

Amen. I work at a Walmart. Now, any purchase we should check signature for. At the very least when the terminal says "Check signature" (on $100+, new cards, wathced cards, etc.) we should. Yet no one does. I've seen this so many times. It's sad.

oh, too bad...

[Sebby]

... I thought it meant it didn't have any of my contact information. Oh well...

Contactless? Great!

[Anonymous Coward]

They won't know where to send the bill!

Pickpocket from a distance...

[bgog]

Let's see. A crowded line at an amusement park... I'm sure I could pick up 100 credit card numbers an hour with my wiz-bang pocket card reader. "Excuse me sir... I didn't mean to bump into you..."

Re:Pickpocket from a distance...

[mattyohe]

despite the humor implied, this seems like it would be a problem... This is the first thing I thought of upon reading.

Re:Pickpocket from a distance...

[Anonymous Coward]

Who wants to go war swiping.

Re:Pickpocket from a distance...

[Anonymous Coward]

Proximity have advanced since they were originally released. They do not have to be a read only type medium like that of a credit card magnetic strip.

The reader induces a low voltage in the card itself, which is enough to run a low power chip.

This means that they can do challenge/response type reads, or use it as an event based token similar to safeword.

eg:
Credit Card (or read only proximity):
1. Read card storage
2. Contact credit card company for approval
3. Transaction approved/denied.

Proximity card with challenge response:
1. Read card serial number
2a. Contact credit card company for challenge for given serial
OR
2b. Reader picks a random number for a challenge
3. Reader transmits challenge to card
4. Reader grabs response from card. (Based on challenge and internal seed)
5. response sent to credit card company (and if the reader generated the challenge, the challenge is also sent to the credit card company)
6. Transaction approved/denied

Pro: Secure
Con: May have to hold card near reader for a while. Unless reader generated challenge.

Event Based code:
1. Reader grabs serial number and cryptographically generated keycode (based on event counter and seed value)
2. Card increments its event counter
3. card serial # and keycode sent to credit card company
4. Transaction approved/denied
5. Credit card company system increments event counter for that card.

(See SafeWord for more info on how such a system works in practice, including windows of oppurtunity and server side auto-resyncing)

All in all it is possible for such a system to be more secure, as a naughty person can no longer replay an attack (at all in challenge response, or only once in event based).

This will cut down on some types of credit card fraud, and the companies can milk the proximity aspect for marketing purposes.

Re:Pickpocket from a distance...

[oliverthered]

Lets see:

I buy somthing/s with a credit card.
The information about what I have purchased goes into a comsumer information pool.
The credit and data mining companies have stolen something that I created without even asking.
Now that's thieft from a distance.

Use cash don't let the credit agencies steel your life away.

Re:Pickpocket from a distance...

[Anonymous Coward]

None of those will stop a walk-by pickpocket. All those do is identify each transaction. If the card then remembers each reader's ID, it allows the card to report who performed each purchase...after the thief has gotten the money and is gone.

The obvious method then is to break in to one of the stores which is closed during one day of the week. The thief has use of the scanner until the theft is noticed, probably not until the store opens. If it's a weekday, walk the scanner through downtown, connect a directional antenna and go through a skyscraper, ride the subway and bus, etc. If it's Sunday, take the scanner to church. If the store closed at 5 PM, take the scanner to the movie megaplex that night.

Re:Pickpocket from a distance...

[Rick.C]

A customer site where I used to work used these as entry badges. The guys all left them in their wallets and just raised a hip near the sensor to open the door.

So being able to read them from several inches away makes pickpocketing a serious concern. There would be no need to actually bump the victim.

Re:Pickpocket from a distance...

[Anonymous Coward]

All of the described methods stop a walk by pickpocket with a reader.

True it doesn't stop someone from using a physically stolen card, but then thats not going to be solved unless they adopt two-factor authentication via PINs etc.

Anyone taking bets...

[Verteiron]

... on how long it takes before someone cracks/hacks whatever security these things have and begins making megabucks by planting remote cardreaders in places like mall store entrances?

How long will it be? Say, to the nearest hour or so?

Re:Anyone taking bets...

[RodgerDodger]

I would hope that it would require more than simply waving it around. At the least, I would like to see, say, a button on the card you have to press at the same time.

Otherwise, as you say, someone will come up with something to read them for sufficent distance to go through clothing, your wallet, etc, without you knowing. Sure, the range (according to the article) is only 20 cms, but even that's too far for my peace of mind.

Re:Anyone taking bets...

[cruppel]

...I would like to see, say, a button on the card you have to press at the same time.

I had the pleasure of seeing a prototype credit card that had that feature. It was geared toward online purchases and basically worked like this:

1. You had to have a small signal receptor at the time...this was over three years ago and they were trying to get rid of that piece of equipment.
2. When you enter your card info on a website, instead of typing it, you press an area on the card, and it emits a sonic signal that tells the receptor that
3. 1. You've actually got the card and
   2. It's you using it. The info (name, billing address, etc) is all in the card.
4. To prevent someone from stealing your card and using it at their convenience you needed to enter a PIN once you pressed the button to make it work. In the end it auto-filled your forms for you, and I thought as a concept it looked promising.

The button is an excellent idea because you save transmitter life, although I'm sure there's a power supply that can live the life of a credit card. It also controls when the info is sent out. I wouldn't mind throwing a PIN on there either. Hell, I don't even have a credit card, just a check card, so I'm fine with PINs

Damn I like ordered lists!

Re:Anyone taking bets...

[ColaMan]

Most of the proximity cards are powered by the RF field that is used to interrogate it.

Still , a button would be nice. Even just a 'squeeze point' (eg squeeze the card whilst waving over reader) would be handy.

Then we could also have the obligatory "Squeeze the last cent out of my card jokes"

Re:Anyone taking bets...

[uspsguy]

One part of my job is replacing the proximity cards our security system uses who's batteries have failed. We seem to average about a 3 year card life.

Re:Anyone taking bets...

[Anonymous Coward]

If you knew anythgin about how these card readers worked you would know that they do not require a power cell.

Go for it

[TopShelf]

The nice thing from a security standpoint is that the credit card companies have it in their own best interest to make sure people feel confident using these new technologies. While a single cardholder could be at risk to lose a few thousand dollars, these companies have billions riding on these transactions. When it comes to secure computing, this is one industry that actually keeps it on the front burner...

Re:Go for it

[berzerke]

...When it comes to secure computing, this is one industry that actually keeps it on the front burner...

I beg to differ. Credit card fraud runs in the billions of $ every year. One article claims the losses will be about (2002 figures) "$285 million over the holiday season in the United States." And that's just about 1 month's worth. Credit cards are anything but secure. Since consumers don't see the cost of the fraud directly, most are barely aware it exists. Of course, the cost is passed on in the form of higher fees and interest.

Merchants (and their employees) don't help matters any either. On all my cards, in the signature block, I put "Please ask for ID". (I've checked with Discover and they have no problems with that, BTW). Rarely do I get asked for ID.

Then there are merchants, such as the USPS, which won't accept the card without an actual signature. Don't need to show ID (I tested this), but it must have a signature or they won't accept it. It's an actual federal rule (I checked), so the clerk isn't doing anything wrong. Maybe it's just me, but I would trust a driver's license MORE than a signature with nothing to compare it too.

Re:Go for it

[Talez]

Maybe it's just me, but I would trust a driver's license MORE than a signature with nothing to compare it too.

You mean all this time I couldn't compare the signature on the receipt to the signature on the back of the card?

Holy shit... I must be responsible for millions in credit card fraud alone.

Re:Go for it

[mrscorpio]

I'm sorry, but the "check ID" thing in the signature is so stupid (I used to work retail so I had many incidents and much idle time for this thought to occur). All someone has to do, if they steal your credit card, is to make a fake ID with their picture and your name on it. Fake ID's are much easier to obtain than signatures are to copy, and cleaning the signatures off and replacing them doesn't really work very well anymore...and if it did, they could just wipe off "check ID" and write your name in their handwriting anyway.

Do you see your folly now?

Chris

Re:Go for it

[disneyfan1313]

Not to mention almost all credit cards say on the back "NOT VALID UNLESS SIGNED" which means by putting that "check ID" crap (which does annoy anyone who works with credit cards BTW.. also not signing your card because you think it protects you) does NOTHING and I don't have to take your card since you are in violation of your credit card agreement.

Re:Go for it

[berzerke]

I've never seen anyone do this, although you are correct, it would help. Of course, no signature will match exactly, so comparison will be anything but an exact science.

Re:Go for it

[berzerke]

...Fake ID's are much easier to obtain than signatures are to copy...

True. However, if fake ID's (such as driver's license) were sooo easy to get, they would be worthless as ID's. Yet, they are accepted as such almost everywhere. Strange. Hmmm...

Now, how many people are handwriting experts and would be able to make a meaningful comparison (assuming they even tried)? In any case, a handwriting sample is available to compare to (the "Please ask for ID" - ask me to write that if you want the same phrase.) And oh yes, my signature is on my driver's license, so there you have another thing to check against.

Re:Go for it

[berzerke]

Not to mention almost all credit cards say on the back "NOT VALID UNLESS SIGNED" which means by putting that "check ID" crap (which does annoy anyone who works with credit cards BTW.. also not signing your card because you think it protects you) does NOTHING and I don't have to take your card since you are in violation of your credit card agreement.

Three counter points:

1. Signed means "to make a sign upon; to mark with a sign." ("kdict signed" for kde users.) Have I done that: yes. It may be different, but it is signed.
2. As I mentioned in my original post, I did check with Discover (the card I use 99% of the time) and they do not have a problem with this. If the card owner doesn't have a problem, why should you?
3. As for the annoying people part, I've yet to hear any negative comments, but I've heard many positive ones.

If there were an easy, simple, cheap way to make credit cards secure, it probably would have been done a long time ago. While it's true any merchant has the right to refuse any credit card for any reason, I have the right to take my business elsewhere.

Re:Go for it

[anthony_dipierro]

and if it did, they could just wipe off "check ID" and write your name in their handwriting anyway.

You can't "just wipe off" something from the signature part of your credit card without seeing "VOID" show up.

Re:Go for it

[anthony_dipierro]

Signed means "to make a sign upon; to mark with a sign."

So if someone wrote "Please Check ID" for their signature it would be valid, right?

Re:Go for it

[Anonymous Coward]

Merchants bear the cost for fraud, not the CC companies. If a customer does a charge back i.e. claim they never purchased it, it was defective, etc, the CC company does not pay the merchant.

This is why places like Mickey D's don't even ask for signatures. They figure the risk of someone stealing a card, using it for a $5 transaction, then having the CC holder complain is low. So low that its not worth dealing with the hassle (pens, training, etc) of signing receipts.

BTW - I used work for a CC company - it sucked.

Re:Go for it

[mrscorpio]

Exactly. Read the part of the sentence immediately preceding the part you quoted :)

Chris

Re:Go for it

[anthony_dipierro]

oops, you're right... duh...

Re:Go for it

[mrscorpio]

I notice you avoided replying to my reply of your original post ;)

1 and 2 - because it's many stores' policy, and a good one at that. The burden is on the store and the cardholder to prove that the transaction was true or false, not the card issuer.

Also, at dictionary.com (source: American Heritage Dictionary), I found the following definitions for "signed":

1. Having a signature affixed: a signed document.
2. Of, relating to, or expressed in a sign language: a signed translation.

And for signature:

1. One's name as written by oneself.
2. The act of signing one's name.
3. A distinctive mark, characteristic, or sound indicating identity: A surprise ending is the signature of an O. Henry short story.
4. Abbr. Sig. or S. Medicine. The part of a physician's prescription containing directions to the patient.
5. Music.
1. A sign used to indicate key.
2. A sign used to indicate tempo.
6. Printing.
1. A letter, number, or symbol placed at the bottom of the first page on each sheet of printed pages of a book as a guide to the proper sequence of the sheets in binding.
2. A large sheet printed with four or a multiple of four pages that when folded becomes a section of the book.

So it appears that the one in KDE is at least unclear if not incorrect, "signed" means write your name, as it appears on the card, in cursive, with a pen.

3 - anyone who expects to keep their cashiering job more than 2 days will learn to keep their negative comments about customer behaviors to themselves. And I stopped being a Nazi about requiring a signature when a customer protested and my spineless manager relented, even though we have signs in the store and at the register stating that we required a signature.

And you are exactly right that you have the right to take your business elsewhere. But for your own protection, you really should realize that signing your credit card is a lot more secure than requiring your ID (if your card was stolen, and if the cashier requests to see the card at all).

Chris

New way to jip someone

[Ballresin]

Just toss the poor bastards at the credit card machine....

Re:New way to jip someone

[Anonymous Coward]

I think you mean to say:

New way to gyp someone

Gyp comes from the word gypsy which comes from the word Egyptian.

Re:New way to jip someone

[Anonymous Coward]

goor
agh i
m romany
give me all
your $$$$$ for this gyp dance

Perfect business opportunity

[Anonymous Coward]

Shielded wallets/credit card holders. Someone call ThinkGeek.

Re:Perfect business opportunity

[GimmeFuel]

You're behing the times, man. Us early adopters have had tinfoil-shielded wallets for years. Don't you know the government has spy satellites that can read the magnetic stripe on your credit card and track you whereever you go?

/me climbs into tinfoil bodysuit and runs for protection in underground tinfoil bomb shelter

Re:Perfect business opportunity

[uberdave]

Careful Dude! Alcan can track you.

Re:Perfect business opportunity

[YOU LIKEWISE FAIL IT]

But then how will the European government track how much money we're carrying in our wallets?!

Euro bank notes to embed RFID chips by 2005

Re:Perfect business opportunity

[GnarlyNome]

How about the RFID tag in the tinfoil?

Re:Perfect business opportunity

[Riply Dragon]

I belive they already have that taken care of. And if that doesn't work, at least it will save your credit card from SARS or Antrax or something. Maybe.

Re:Perfect business opportunity

[Pingular]

Credit cards with a caffine centre?

Re:Perfect business opportunity

[mpxcz]

yup, tin foils will do that to you
but seriously, will tin foils work? /me waits for a bomb to fall on my head

Re:Perfect business opportunity

[kurosawdust]

/me climbs into tinfoil bodysuit and runs for protection in underground tinfoil bomb shelter

How much protection do you need from tinfoil bombs?

Re:Perfect business opportunity

[DChristensen]

That's why we used *your* tinfoil!

Re:Perfect business opportunity

[jmb-d]

They (thinkgeek) are one step ahead of you -- check out the Duct Tape Wallet! ...and they cite Z!'s quote equating Duct Tape to the Force. (I worked with Z! circa 1990...)

Re:Perfect business opportunity

[Odin's Raven]

How about the RFID tag in the tinfoil?

Just do what I do, and destroy the RFID tag by microwaving all your tinfoil first.

(whooop whooop whooop)

Ooops, gotta run -- damned microwave's set off the fire alarm again...

Re:Perfect business opportunity

[jridley]

I was actually thinking about this possible product yesterday in regard to the story a few days ago about the plan to put RFID tags in currency, and the 1/3 of the posts to that thread being about muggers being able to use a portable scanner to easily see who had a lot of money on them.

Re:Perfect business opportunity

[bedessen]

Remember, shiny side out! Always shiny side out!

Re:Perfect business opportunity

[Anonymous Coward]

Sprint already beat you to it.. my old Sprint phonecard was pretty effective -- it even prevented the radio-cookie from being able to unlock the doors at work, The silver reflective surface of the card must be a layer of metal foil or something.

Mastercard beat them to it

[sunilonline]

http://www.paypass.com/ Currently beta testing in Florida...

Re:Mastercard beat them to it

[sunilonline]

Sorry, here's a clickable link to paypass

Billy, can you say "fraud"?

[frovingslosh]

Fantastic. Now your pocket can be picked just by someone carrying a bag, purse, or package and passing behind you. Who asked for this?

Sounds an awful lot like SpeedPass

[Otterley]

This sounds an awful lot like SpeedPass, which is at least 5 years old. Any idea what the difference is?

Re:Sounds an awful lot like SpeedPass

[RodgerDodger]

It's backed by Visa, the world's largest credit card company?

That's a pretty substantive difference in and of itself.

Re:Sounds an awful lot like SpeedPass

[bgog]

Uhhh.. Visa is doing it. Which means if it actually happens, it'll be accepted at MANY more locations than speedpass. Additionally with a decent amount of storage and the high bit rates, you could use one card to buy stuff, get into your gym etc.

Re:Sounds an awful lot like SpeedPass

[King_TJ]

Yep - that's immediately what I thought, too. It's just the same technology as the Mobil SpeedPass, in a different physical format.

That said, SpeedPass seems to work well, technically speaking. My big complaint about it is it seems a little redundant. "Just wave your speedpass" isn't really any easier than "Just stick your credit card in the slot on the pump".

It's all going to get charged to a card anyway.

SpeedPass would have been more sensible if it functioned as a unique credit card account, instead of requiring you link it to an existing account.

Re:Sounds an awful lot like SpeedPass

[Anonymous Coward]

With SpeedPass, the process is:

- Wave pass at sensor
- Select fuel
- Fill tank
- Get receipt

With your credit card, the process is

- Insert card into pump
- Select Debit or Credit (only at some pumps)
- Would you like to use your airmiles card? Yes or no.
- If yes, swipe AirMiles card
- Would you like to purchase a car wash? Yes or no.
- Select fuel
- Fill tank
- Get receipt

Of course, there is a mandatory 3-5 second delay between each step...

I find it amusing that the place in Canada that uses SpeedPass is Esso. The amusing part is that a few years ago, Esso slowed down the speed of ALL of their self-serve pumps. It takes about 2X as long to fill my tank at Esso as it does at Shell or Petro-Canada. The fastest pumps are always at Sunnoco.

Re:Sounds an awful lot like SpeedPass

[soliaus]

you could use one card to buy stuff, get into your gym, etc.

Im a geek, whats a gym?

Why

[I don't want to spen]

Other than the magnetic strip not wearing out, what's the advantage? Unless its short-range enough that passers-by can't steal your money, you'll still have to present it to a reader (the article mentions 20cm) Or perhaps they mean it can't be swiped (as in stolen.) It could mean the end of shoplifting though, just use the security scanners to read the RF tags in what has been taken and then take the money straight off the card. (Actually, that could be a great way to shop: pick things off the shelf, walk out and pay without having any queues at the checkout. Where's my patent lawyer?)

Re:Why

[Eyston]

Other than the magnetic strip not wearing out, what's the advantage?

The advantage isn't in the method of payment. Like you said, you have to present either form of credit cards (swipe/wave) to pay for items.

The advantage comes in what else they can do. These cards are capable of dialog with other devices. Instead of just blindly spitting out billing information, they can store and call up a multitude of things. It allows some functionality as a personal identifier, especially for services/priveledges you have to subscribe to. Buy a monthly pass for the subway/bus, have it stored on your credit card. Gym, library, museum, etc. Now instead of carrying multiple cards, you just wave your Visa at a reader and you are set.

-Eyston

Re:Why

[mnewton32]

Actually, that could be a great way to shop: pick things off the shelf, walk out and pay without having any queues at the checkout. Where's my patent lawyer? You could try, but I'm sure Amazon would sue you. "Buying something? Don't we have a patent for that?"

Re:Why

[Anonymous Coward]

Ummmm remeber the AT&T you will ads from a few years ago where a shady looking fellow stuffs all kinds of items into his trenchcoat then walks out the door. Then a security guard walks up to him and says excuse me you forgot your reciept!

As a concept there is prior art...forget the patent esquire bitch

Re:Why

[thirdrock]

Other than the magnetic strip not wearing out, what's the advantage?

When I lived in Hong Kong there was a smart card (not Credit Card) called Octopus. Basically, you buy the smart-card, you add cash funds to it, and then you can use it to ride the train system.

It was incredibly convenient, not to have to buy tickets, and much greater throughput than ticket machines. You just walked through the gate and swiped your wallet over the reader.

Anyways, it wasn't long before they figured out the advantage of converting the vending machines in the station over to Octopus. No cash to collect, just fill it up with product and collect the money from the Octopus administrators, less administrative fee.

I can tell you from experience, it beats the hell out of coins, changing money, messing about with cash, fumbling about with change. Just swipe your card and get your product. Faster, easier and much more effecient.

Best of all, the cards were anonymous, which means the govt couldn't track you via the card. Disadvantage of course is that if the card was lost or stolen, there was no recovery. I guess for that reason the maximum you could put on the card was HK$500.

To me this was the first step towards an anonymous cashless society, which despite the Orwellian protests of the tin-foilers, is IMO, A Good Thing(tm). Money spreads disease, has an administrative cost, is vunerable to forgery. If we can have all the advantages of cash, including anonymity, then I say, let's get rid of cash.

Re:Why

[d3ut3r0n]

There's already been talk and patents for food items that have magnetic-frequency or radio-frequency (see link below for the latter) marked labels so that users can just walk up to a super market attendant and pay for it - no scanning required as it happens simulatenously... expected in the not too distant future: http://www.mobileinfo.com/News_2001/Issue18/Smart_ Tags.htm

Re:Why

[ryanwright]

Money spreads disease, has an administrative cost, is vunerable to forgery.

And these aren't vulnerable to forgery? Sounds to me like the cash is actually stored in the device (if you lose it, you lose that money). How long before some geek hacks it and loads it up with free cash?

Seems much more vulnerable to forgery from my point of view. It's anonymous and you don't have to convince some clerk that it's real - just buy whatever you want, and nobody will know the difference (until the company who makes the device tries to balance their budget).

You could get rid of this problem by linking all readers to a database to validate transactions ala Visa, but then it isn't really anonymous anymore...

Re:Why

[Zirnike]

"anonymous cashless society, which despite the Orwellian protests of the tin-foilers, is IMO, A Good Thing(tm)"

I think you're misinterpreting the privacy advocates, here. We don't have problems with an anonymous cashless society, I think... just one where there is no such thing as an anonymous purchace. Most cashless societies tend to have a link back to who you are (ATM cards, credit cards, etc.). This idea wouldn't, so I don't mind it as much. It's like certified credsticks.

Re:Why

[Fastolfe]

These are pretty basic questions that have already been figured out. A quick Google search brings up this little FAQ that you might find interesting: http://ntrg.cs.tcd.ie/mepeirce/Project/Mlists/mini faq.html

Re:Why

[ryanwright]

Cool FAQ. Thank you for posting it.

Re:Why

[thirdrock]

I think you're misinterpreting the privacy advocates, here.

I am a privacy advocate. Just an informed one. I was refering to people who automatically assume that all technology is designed to reduce their privacy, whereas sometimes technology can be designed to increase your privacy.

We don't have problems with an anonymous cashless society, I think... just one where there is no such thing as an anonymous purchace.

I agree.

Most cashless societies tend to have a link back to who you are (ATM cards, credit cards, etc.).This idea wouldn't, so I don't mind it as much. It's like certified credsticks.

Except it's not certified, which currently makes it vunerable to fraud.

Re:Why

[thirdrock]

And these aren't vulnerable to forgery? Sounds to me like the cash is actually stored in the device (if you lose it, you lose that money). How long before some geek hacks it and loads it up with free cash?

Well, I did read the digital cash faq below, but let me answer that question my own way. Yes, the cards are vunerable, but only up to $500. A cash forger can make millions of dollars worth of forgeries.

Sure, you could get thousands of cards (they had a small deposit IIRC), however I have a feeling that a transaction is recorded when you load the card up with cash (against the card, not the person supplying the cash), and each time you go in and out of a station.

If suddenly bunches of cards started appearing with a $500 balance, without a corresponding transaction, the Ocotopus Authority is alerted almost immediately that something is wrong, giving them a chance to investigate or change the security protocol. Which is not to say that the transaction server couldn't be hacked. But it would be a lot of trouble to go to just to get a few free train rides and vending machine products.

Of course, if there were a wider adoption of the card, both the opportunity and motivation for fraud would increase. I'd imagine at that time the system could be modified to strengthen it's resistance by using stronger cryptography (public/private key pairs, blinds and 'digital cash tokens')

BTW, AFAIK the Octopus card has not had any incidents of fraud, but maybe it's not reported like the CC companies don't.

So they've finally upgraded...

[Anonymous Coward]

...to those laser-scanner things supermarket checkout lines have been using for years?

Yanno what I'm thinking...

[Julian Morrison]

so THAT's why the Jedi Hand Wave works.

"These are not the droids you're looking for"
(handwave, subtle ka-ching! sound)
"These are not the droids I'm looking for.. move along..."

Re:Yanno what I'm thinking...

[space_biker]

Didn't work for Qui-Gon in episode 1...Must have been in beta then?

Re:Yanno what I'm thinking...

[paulcammish]

Didn't work for Qui-Gon in episode 1...Must have been in beta then?

Nah, Watto didnt take Visa, thats all.

Re:Yanno what I'm thinking...

[Anonymous Coward]

you ass biting star wars nerd, i bet you lick your dog's cock and pretend he's yoda

Mobil Speed Pass?

[GreenKiwi]

Doesn't the mobil speed pass already do this? nothing really all that new.

Mobil Speedpass

[tbdean]

That's how I pay for gas at Mobil, with their Speedpass. It's a small keychain thing that looks like a black magot:

Well, that was how I paid for gas at Mobil. I cut my Speedpass open, took out the glass cylinder, and put it inside my Nextel i90 cell phone, it fit next to the battery. The Speedpass only lasted a few months before dieing. I haven't tried it again yet...

It was cool when it worked though, I just held my cell phone up to the pump to pay for gas.

Re:Mobil Speedpass

[gehrehmee]

It's a small keychain thing that looks like a black magot

Insect larvae that pay our bills? The future is truly here. Tiny ear-dwelling language-translating fish can't be that far behind.

Re:Mobil Speedpass

[haa...jesus christ]

wait, i thought cell phones blew up gas stations... :)

mobil speedpass

[phalse phace]

This looks somewhat similar to Mobil's Speedpass, no?

Contactless credit cards?

[cperciva]

I've been using a contactless credit card for years. I type the number into an HTML form, and my card never comes within the same city as the merchant I'm purchasing something from. For that matter, it sometimes isn't in the same city as I am when I'm making the purchase -- for a couple months last year it was on a different continent.

In fact... let me see here... no, I still haven't gotten around to signing the back.

Re:Contactless credit cards?

[Anonymous Coward]

ICK you TYPE your CC numbers into a web form? why not just get a magstripe keyboard... oh CC number? swipe... ahhhh......

useful in some situations

[romit_icarus]

.. like a bar where the bartender/s have a hard time settling credit card payments...

But then, isn't jostling at the bar a good way to meet people?

How easy would it be to steal info from these?

[StriderA]

I personally have never had any experience with these other than having to wear them for work. Perhaps someone who knows the dynamics of these can tell how easy or feasable it is to 'steal' info from these cards. If I'm going to be 'issued' one of these in the future, I would like to know the risks.

Perhaps I can make a fortune patenting shielded wallets. :)

Re:How easy would it be to steal info from these?

[pirodude]

It is very difficult to steal information from smart cards. I know of 1, maybe 2 ways to steal from smart cards that use contacts (one is to detect very small fluctuations in the voltage draw of the card as the crypto algorithms are doing their magic) and no ways to steal from contactless cards, given they are properly setup (and given Visa is backing it up, they probably are).

You can set files on the card (it has a tiny file system) such that they can only be written to. I have a Cryptoflex 8k card here that has my public and private keypair on it for PGP. The public key can be read off very easily but for the private key to be useful, the card will actually do the encryption for me. So I will insert my card into the reader, I will type what I want to encrypt in my email window and when I press send it will send all of the text over to the smart card where it is encrypted with my private key, which never leaves the card. Now ideally you would run your keyboard right into the smart card reader for sensitive operations (so the host operating system cannot be backdoored and the plain text version ever recovered).

The risks for these cards are very small. From what I can tell they'll probably be JavaCards (which basically will run a small java applet) that will only give up information about the card to verified readers (the card will store a certificate authority's public cert and verify the certificates of the readers) . This will stop the "stealing by walking behind someone with a reader" problem so many /.ers have complained about.

Hope this helps (I've done a crapload of work with smartcards recently for a Purdue IEEE project)

Re:How easy would it be to steal info from these?

[Sigurd_Fafnersbane]

A smart card will host a micro-processor and some memory. This is not a big problem for a contact-card since you get your power from current drawn through the terminals.

An RFID tag do not have its own power source but relies on axtracting power from an RF field transmitted by the reader. You cannot power a microprocessor from this, at least not reliably. RFID tags are memory based devices that will transmit a few hundred previously stored bits when triggered. This is the equivalent of the information stored on the magnetic stribe on most credit cards.

Re:How easy would it be to steal info from these?

[pirodude]

They do make contactless micro-processor smart cards. Schlumberger makes one, two, three, different versions.

From their site:

High-speed contactless operations are completed in less than 100 milliseconds and at distances of up to 10 cm from the reader. Security between different applications is ensured by two 48-bit diversified keys and specific access conditions per sector. Security is further reinforced by replay attack protection and a three-pass handshake, which manages the mutual authentication between the card and the reader. In addition, the Easyflex FastOS 2.0 fast anticollision algorithm allows more than one card to be processed by the reader at the same time.

Easyflex FastOS 2.0 communicates on the 13.56 MHz carrier frequency in compliance with the current ISO 14443-Type A standard and implements the standard Mifare protocol, allowing it to be used with the vast majority of contactless card systems.

Re:How easy would it be to steal info from these?

[dgil]

This is not a microprocessor but just a memory card (Mifare) with a very light authentication protocol based on a shorten DES key.

wellll

[Anonymous Coward]

if you are using such card to access your apartment perhaps its time to move out.

can't wait to take a portable reader on the subway

[mkbz]

no, i'm not the pervert who's rubbing up against you for kicks...

well, maybe i am. but i'm taking your money, too.

heh.

BAD IDEA

[Anonymous Coward]

Just think of the ways this can be abused...suppose there was some hot chick who wanted to rip you off. She could build a really small card scanner and hide it in her hand. Then she'd come up to some guy and start rubbing his ass and all, and the dude would be like "COOL!!". But then she would charge $10,000 to his account!!!

So this is obviously not a good idea unless you are a hot chick who wants to rip people off. Or if you work at Six Flags Magic Mountain you can maybe hide a scanner inside those metal detector things that they pat you down with. That would work too.

Re:BAD IDEA

[Anonymous Coward]

A hot chick rubbing your ass would be a sure sign something was wrong to any Slashdot reader.

Re:BAD IDEA

[Anonymous Coward]

Rip me off? No. Rip the credit card companies off? Yes.

So let's see. I get to cop a feel, and my credit card company pays for it. Sounds good to me.

Absolute Fascist Control

[HotNeedleOfInquiry]

Read the article. Plenty of subtle reference to rights management and content control. Buy a DVD with this viper and have to wave it next to your DVD player to get it to play.

Re:Absolute Fascist Control

[sulli]

Yes, the EE Times guy mentions that:

One of the biggest hurdles faced by consumer electronics manufacturers designing "connected" consumer devices is developing a business model that allows devices to offer consumers an easy way to purchase content and services. Content and service providers face similar issues. They need solutions for secure digital rights management and a reliable means of getting paid.

But! But! PEOPLE WILL NEVER, EVER USE IT for that purpose. DIVX failed because of this. Apple Music Store is the only DRM enabled anything that is not a total failure, and it's only because Apple fanboys will buy anything. If you think people will "upgrade" to some future DVD requiring Speedpass, I have a few nice bridges in NYC to sell you.

Re:Absolute Fascist Control

[cpeterso]

People would no longer be able to buy DVDs are gifts because the birthday boy would need your credit credit to watch his new DCD! oops!

Warning

[apankrat]

You won't need to physically swipe it, simply waving it over a reader is good enough.

DON'T OVERWAVE

One L

[overshoot]

That's Philips, with one L, not two. The Phillips with two LL in the middle is a petroleum company.

But...

[Anonymous Coward]

does it run linux?

Re:But...

[Anonymous Coward]

Imagine a Beo...

*gasp*

[Anonymous Coward]

Didn't you hear? You're not supposed to use your phone near the pumps! /Inter-office cc:

-Dumb_Nig

Re:*gasp*

[YOU LIKEWISE FAIL IT]

Not everyone agrees.

Re:*gasp*

[Anonymous Coward]

But I can still use my CB radio, right?

too long range

[73939133]

data rates as high as 1Megabit/sec over a distance of 20 centimeters

If the action of placing the card close to the reader is supposed to indicate payment, that's too far and invites both security problems and just accidental mixups.

I think IR is actually better suited to these kinds of applications. IrDA already exists, it's on most devices, and it's much more secure. Some businesses are already using it for communicating with PDAs that people bring in (including Sony Theaters).

Re:too long range

[xphread]

As far as I'm aware, there are no passive IR devices avialable. Secondary to that is the issue of practicality. How do you propose to produce a flat (ie credit card size), passive IR computational and storage and device. At work we use very similar smartcards in our transit ticketing systems we develop. Our security is pretty heavy (key exchange and the like - not really my area) but Visa have a LOT more to loose if it is an unsecure system. I'm sure they will provide a decent system - because if not, they will have to foot the bill.

Re:too long range

[73939133]

As far as I'm aware, there are no passive IR devices avialable. Secondary to that is the issue of practicality. How do you propose to produce a flat

Why do these things need to be passive or flat? First of all, if you use IrDA, people can use their existing phones and handhelds for some transactions. Second, you can make these things into key fobs, just like some banks already are offering credit cards in key fob format.

Still, I don't even see any big problem with making a credit-card sized IrDA device these days. You can integrate a battery, and an IR emitter/receiver does not have to be thick. An almost credit card-sized battery can hold a lot of charge, longer than the card is likely to be valid for.

I'm sure they will provide a decent system - because if not, they will have to foot the bill.

That's a bad bet. When the banks screw up on picking technology, one way or another, the customers pay. For individual screwups, it takes a long time to get one's money back. And the overall losses are recouped through higher fees.

Re:too long range

[raju1kabir]

If the action of placing the card close to the reader is supposed to indicate payment, that's too far and invites both security problems and just accidental mixups.

Yup. It would seem that the principal day-to-day advantage for me, as a consumer, would be that I don't have to get the card out of my wallet and could instead wave the whole thing like I do with the proxcard on the turnstile at the office. That way I save time and have less chance of accidentally leaving my card behind.

But how would I decide which card to bill against? Whichever one happened to connect first? If I end up having to fish it out, then I'm no better off than before.

Re:Nigger

[Anonymous Coward]

This is why this challenge is going to be so hard.

Let me get this straight...

[djupedal]

You say you are smart enough to remember a purchase PIN and a ATM/Cash type transaction PIN, yet you also claim to be buying shit?

Most, if not all, of the smart people I know never, ever 'buy' shit....they seem to find a way where people continously give them shit, sometimes for no apparent reason. Now I know some would argue that this may well be a gift, but I've watched this happen, over and over, and I'm here to tell you, it seems like it doesn't matter what they do or what they say, someone will eventually give them shit. Really! I am not kidding! It's true!!

If you are having to pay for shit, may I suggest a crash course in shit 'taking'...you can sign up for one online I believe..perhaps right here, if you ask nice.

Re:Let me get this straight...

[SirLanse]

People give them shit... Not all of us can be blondes with big tits, someone has to be the sugar daddy.

Re:Let me get this straight...

[Anonymous Coward]

I don't take charity and I don't give a shit.

Re:Let me get this straight...

[blair1q]

I'm amazed nobody seems to have got it.

So I'm gonna give all the other re-pliers shit for it.

I just did.

Re:The N word

[DingoTango]

Didn't read the title at all, since my view (possibly all views?) of the discussion thread displays the messages in line. In fact, didn't even know what your subject line was until I read your message. Of course, if you posted this while logged in, I would've mod'ed you down for being off-topic ;)

Yes

[Anonymous Coward]

While playing oggs.

And on related news

[rmsousa]

rmsousa Corp announces the "Faraday Cage Wallet". The perfect companion to the "contactless credit card". And if you call now you'll get entirely free a "Faraday Cage Trenchcoat", the perfect tool to "shoplift"^H^H^H^H^H^H^H^H^H^H"ensure privacy when buying" products with RFID tags.

And this product opens new horizons... Now you can sexually harass women on the street and then say "sorry, I was just trying to steal your credit card".

"You won't need to physically swipe it"

[jjeffries]

indeed... maybe metal wallets will become a popular deterrent.

I am Asian, actually

[Anonymous Coward]

I am Asian, actually. And no, delving deep into my soul, I can honestly say that I harbor no racist feelings. This is an experiment.

Re:I am Asian, actually

[idiotfromia]

You have serious issues to get worked out.

Existing Technology?

[wo1verin3]

I'm in Toronto and this is already in use at several Gas station chains, most notably Esso.

While the speed pass works in the same way of not requiring direct contact, instead of billing you directly you provide them a credit card number to bill to, but the technology in this case is the same and not incredibly amazing.

Business alarm systems have used proximity badges for years now!

My 2 yen

[DNS-and-BIND]

Not to be a twit, but I heard about this sort of "keep it in your pocket" magnetic technology being deployed already. Around February of this year, one of my English students in Tokyo, who worked for Sony/Ericsson, told me his company's "secret" new cell phone in development would have this mag card tech built in. It would replace the "Suica Card" existing tech, which is just a card you mash against the reader while keeping it in your wallet. The phone was due to hit the shelves in 6 months, which would be this August. Only in Japan, of course, which means it should be out in America around August 2005.

Maybe good Maybe not

[emerrill]

The technology in general can be a great convience, I have used them before and it means you don't have to fish the card in and out of your wallet, but what happens when you have more then one of this type of card in your wallet (the reader will read them all properly, but which to use?) and theft is a real concern.

Unless the also use a pin-number system, there is really nothing they can to to prevent theft. If you have a 'shielded wallet' or you have to press a button, then it defeats much of the point, and you have to actually get the card out.

I'm worried that they will try a type of encryption, (info on card is encrypted, and the CC co has the key in a central data base). Now if they were to do a new encryption key for each card, then great, but I could see them using one key for all of them, then what happens if that key is leaked. Even if they do that, it keeps the CC number safe so it cant be used online or such (assumming that the RFID number is even related to the actual CC number, which it probalby wouldn't be) it still cant stop someone from making a new RFID card to retransmit the info.

Basicly it all boils down to that there is no real way for the CC company to protect the card if it is contactless. with 20cm (about 8in) you could easilly walk around a mall with a reader in your pocket picking up the ids of the cards.

Re:Maybe good Maybe not

[spector30]

Actually if you have a shielded wallet, when you open it the shield should open as well. Then you can use the card as you would if it were not shielded. Just like your driver's license picture is hidden until someone asks you to show ID/scare them.

Re:Nigger

[NiTRiX]

My thoughts: Bah. I've seen attention whores, but you my friend are an attention dictator.

War Driving, er, no Pocket Surfing...

[Anonymous Coward]

Great! Akin to war driving to find open nets, now we can "pocket surf" -- aim a super-high gain antenna tuned to the frequency these cards operate at at purses, pockets, and wallets of unsuspecting users and collect credit card information (enough to clone 'em) without being seen.

new form of pickpocketing

[dten]

Now thieves will only need to walk around waving readers over people's butts to snag their CC info...

Re:NOT A GOOD IDEA

[bgog]

Let me address your points individually: 1. No, someone could not charge every CC in the world. There is a small computer inside the card and two way communication is required. There is no way for a satalite to charge cards. 2. EMF if used in a mall right now would scramble the mag strips on existing cards and probably screw all the cash registers. No difference.

Contactless Credit Cards

[Anonymous Coward]

So what happens if you have multiple cards of these? How do you choose which one to pay with?

Re:Nigger

[Anonymous Coward]

I just thought it was yet another racist troll post.

Ummm...branding error, me thinks...

[djupedal]

That's 'Philips'...with one L.

Re:oh, too bad... [agreed]

[greenskyx]

same here... too bad!

Comments by proxy

[NeoPotato]

It's not a new concept. We already practice it here at Slashdot - we don't even have to read the article, we just get near the story and start spouting off comments.

Re:Comments by proxy

[Maxwell'sSilverLART]

C'mon, man, if you're going to comment, at least RTFA!

Re:too long range (maybe)

[BakaMark]

If you have 2 side by side, then there can be issues when trying to use them.

This is something that I have seen with proximity cards for two seperate systems. When the two are together then when system A tries to contact Card A, Card B is also activated and the system cannot make any sense out of what it has received. Therefore no access.

In this case you have to seperate the two cards, in order to read them.

There has been talk about contactless smartcards for the past 10 years.

American Express already has this...

[Anonymous Coward]

ExpressPay

Re:NOT A GOOD IDEA

[Anonymous Coward]

You didn't just bite on a troll here, you bit on a JOKE. And you weren't even smart enough to point out that it's EMP, not EMF.

Congrats on doubling the entertainment value of the thread.

How you gonna....

[djupedal]

You know, back when you could still afford to go out for dinner (DQ doesn't count), how the waitperson would bring the bill on a little plastic tray and lay it on the table....and you'd simply drop your c'card onto the bill...and then someone would take the tray and bill and c'card and....oh, wait, I get it...

Hello, I'm Dwayne, I'll be your card waver this evening.

Re:How you gonna....

[Anonymous Coward]

How you gonna keep 'em, down on the farm,
After they've seen Pa-ree?

How 'ya gonna keep 'em away from Broad-way;
Jazzin' a-'round',

And paintin' the town?
How 'ya gonna keep 'em away from harm? That's a mystery;

They'll never want to see a rake or plow,
And who the deuce can parleyvous a cow?

How 'ya gonna keep 'em down on the farm,
After they've seen Paree?

Re:How you gonna....

[Anonymous Coward]

Hmmm...restaurants still do that. I just did it last night at a Big Bowl.

First movers advantage and contentions?

[toybuilder]

So, if Visa is the first mover, do they essentially "own" the wallet because the lazy consumer wouldn't want to bother pulling out a different card?

And what happens if there are multiple cards that are contactless? Do I have to pick one out? What's the point of this, then?

My building uses contactless badges. Ironically, we have a badge for the building and another for the garage. I can't keep both cards in the wallet because they interfere with each other.

Finally, is Phillips proposing to make cars run off the card? Wow. Imagine starting your car just by sitting down...

Re:First movers advantage and contentions?

[kilonad]

Wow. Imagine starting your car just by sitting down...

You already can. Mercedes Benz, Porsche, and even certain Volkswagen models (just to name a few, I'm sure there's others) have this feature. You leave the keys in your pocket. To unlock the car, touch the door handle. To start the car, touch a button on the dashboard. To lock the car back up, just touch the outside door handle on your way out. The keys stay in your pocket the whole time. It works by actively seeking out your remote commander ("the clicker"), and if it finds it, it lets you in and lets you start it up. If it doesn't find it, or if it just plain fails to work, you can always take the remote out of your pocket and click. Or even... dare I say it, use the physical key itself. Anyway, it's pretty nifty stuff.

Barcodes?

[Anonymous Coward]

Doesn't this sound a lot like a barcode system?

These better have a small range

[ebuck]

These cards better have a small range (two feet max) or I don't see how you will manage to perserve the time-honored tradition of the grocery store line.

"Did you swipe your card?"

"Not yet."

"That's funny, because your total has already been paid!"

Re:These better have a small range

[Azghoul]

Why would it even have a 2 foot range? Why not set it up with about a 1 inch range?

Mobil Speedpass doesn't zap your dongle unless you wave it right in front of the thing.

Pick-pocketing

[dachshund]

My work ID badge can operate through my wallet. In fact, I can often just touch my hip or coat pocket to the reader and the door will open, depending on how lazy I'm feeling.

My concern would be that unscrupulous individuals would use portable readers to get your card number. It would be a form of pick-pocketing that wouldn't actually require any contact or much risk of getting caught.

Hopefully, the cards would use some sort of challenge/response system, rather than a fixed number that could be replayed to a terminal. Still, there are bound to be vulnerabilities, and we'll probably be reading about them in a couple of years.

Re:Pick-pocketing

[djupedal]

I do the same with my work badge in my wallet, but my work badge is also a Visa card...

I am a troll

[rock_climbing_guy]

Actually, what I was hoping for was that we could put mod points on these cards. It would give a whole new meaning to 'arma-whoring,' now wouldn't it?

Swatch Access

[Kris_J]

The Swatch Access watch has been able to do this sort of stuff for ages. Here are my old pages from way back.

Well-disguised troll

[Anonymous Coward]

don't bother folks.

Oh great!!!

[borgheron]

Now simply standing too close to someone can cause my credit card number to be stolen.

GJC

stop press

[Debian Troll]

The internet, today:
Debian.com announces new contactless debian operating system - "untouchable". promises unbreakable security.


Debian.com executives stunned the business community today with the announcement of a new operating system in the debian franchise "untouchable", which they contend, ushers in a new age of contactless technology and "unhaX0rable" enterprise security technology for the enterprise. debian CEO Raymond Stallman issued forth this challenge (meaningless freedom diatribe deleted; words rearranged to form actual english sentences - ed.): "[...] if you can haX0r this [...] system, we [...], debian.com, will give you 100,000 free copies of our next [...] debian release [...] due in 2008".

"untouchable" features specially developed "haX0r freedom" technology, designed specifically to ensure freedom from haX0rs. "haX0r freedom" technology comprises debian's patent-pending "cord-free" technology, which allows debian computers to run without cords, and debian's new "network-free" enterprise security technology, which allows debian computers to run without a network. "Correctly installed, debian computers with haX0r-freedom enabled enterprise security technology are invulnerable from haX0rs and other commie government spies" says debian CTO Raymond Stallman. "the extra freedom built into the core of Untouchable leaves enterprise users freer to enjoy other things in the rich debian untouchable experience, like manually installing soundcards". "we think they'll like it" jokes Stallman, freeing a few extra lice from his freely-kempt beard.

Other debian executives could not be contacted by email for comment.

Re:NOT A GOOD IDEA

[pair-a-noyd]

What if he meant Electro Magnetic Field (or even Force)???

An Electro Magnetic Field in a mall is entirely plausable.

Probably how they work

[dzimmerm]

These kinds of cards do not usually have any kind of power source. They rely on a alternating current magnetic field that the reader gives off. This magnetic field energizes the coil that is built into the card. This coil supplies power to the circuitry on the card which causes the card to send its ID via some kind of rf signal. There are no "smarts in the card itself. The card just sends its ID and a computer behind the scenes uses that ID info to open the door or pay the bill.

For those concerned about portable readers consider that a reader would have to send out a powering magnetic field and then capture the ID of the card. My guess is that all kinds of security could be built into these cards. The most obvious kind would be the use of an ID that contained a constantly changing code like the secure IDs many of us use to access various secured dialup and network devices. The only drawback is you would need some kind of contained power source in the card to power the secure ID ciruitry as it has to be constantly powered so it does not lose sychronization with the host system. My guess is the reader could still supply power for the RF signal while the secure ID part used a small lithium cell.

That way the ID would not only have to be correct but the security code would only be good for about 3 minutes. That would make these things fairly secure, probably moreso than a card and a PIN as the PIN can be noted via cameras and the quicksighted.

Physical theft of the card would be a problem but that would not be anything new to get used to.

dzimmerm

Re:This is good news

[GnarlyNome]

Well, you could hack you card so that everything is billed to Bill G.

Challenge/response?

[skraps]

I didn't RTFA, but here's an idea to counter some people's fear that a technology like this would necessarily allow you to steal card numbers as you walk through a crowd.

The card could use a challenge/response system with the merchant. Each card has a symmetric key pair - the public key is your account number used for billing. The private key is known only to the card, and is used to sign a challenge phrase from the merchant. Challenge phrases would be unique to each transaction (given out by the financial institution per transaction). This way, cards couldn't be cloned.

Re:Challenge/response?

[chevelleSS]

I work for an ATM transaction processing company, and it would be really nice if that were possible.. but credit cards do NOT HAVE A MICRO-PROCESSOR (it cannot process a challenge response) in fact A credit card is only a magnetic number, all of the information is retrieved from your bank/Credit card company. The Grocery stores little card reader however does have a process, and Encryption of your card does start there..

In order to process an ATM transaction, your credit card number is sent off from the ATM/Grocery store/wherever to your bank(with debit cards, your pen number goes with it).. In the case of an ATM, the number is encrypted before being sent over an unsecure line (like a telphone line, internet, or in some cases a wireless connection). When the transaction makes it to the Processor, the transaction is sent directly to the bank via a direct link to them, or routed to another processor who has the cheapest processing surcharge (Usually your transaction switches hands 3 times). The bank then verifies your information and your Pin number if applicable before sending the approval code with pertinent information (name, address, account balance) or denial code to your ATM/Grocery store. There are other situations that get very complicated such as Reversals (an ATM does not have the money to dispense, so your account is credited) partial reversals (the ATM dispenses twenty, but you asked for 200) and processing link failures (the transaction was approved but because of a link failure, the cardholders account does not know if the money was dispensed).

Re:Challenge/response?

[sql*kitten]

The card could use a challenge/response system with the merchant. Each card has a symmetric key pair - the public key is your account number used for billing. The private key is known only to the card, and is used to sign a challenge phrase from the merchant. Challenge phrases would be unique to each transaction (given out by the financial institution per transaction). This way, cards couldn't be cloned.

What most people don't know is that there is a difference between a chipcard and a smartcard. Most credit cards are actually chipcards - they use a chip, the little metal bit on the front to store data instead of a magnetic strip, but they have (almost) no computational capability onboard. They can only give the reader the information it asks for. A real smartcard actually does have computational ability, a power source, etc but it is orders of magnitude more expensive per card, and in most cases it's simply not economic for the credit card issuer to give them away. Only a smartcard can decide whether or not to give up a piece of information, a chipcard can only respond to requests "give me the data in slot a" "ok".

Bubble Crystals

[Gyorg_Lavode]

So what happened to the idea of using crystals with air bubbles to create light patterns? That sounds like a much more secure and unique method than this. Really, I have the time to slide my damn card so lets go with security.

Hong Kong has had this for a while

[kramer2718]

When I visited Hong Kong in 2001, I bought a subway pass with this technology.

If you buy more than about $10 US of subway services, you have the option to get a smart card. My whole stay that card left my wallet only once (to return it for a refund). Othere than that when I used the subway, I would just set my wallet on top of the read. It was so conveneient.

Even better, lots of vendors (such as convenience stores) let you pay using your subway credit.

I guess there are more security concerns when using this with a real credit card, but it seems like it should have happened in this country sooner.

Re:Hong Kong has had this for a while

[ross.w]

Shanghai has this system on its elevated railway too. I haven't seen it in the shops though.

Not new ~ BTDT for almost a year now.

[djupedal]

I live/work in Korea, and my company ID badge has a passive chip, where I only need to get it near a sensor. A Jedi swipe will do the trick, in most cases. This badge/card is also a Visa c'card, and it comes with the traditional swipe stripe. I keep it in my wallet, however. I can't seem to relax when hanging a cord around my neck that has a few thousand dollars attached to it. Why advertise.

Re:Nigger

[GnarlyNome]

Well if that how you would like for us to refer to you..

Time to get a lead lined wallet.

[Anonymous Coward]

Great, now all a pick-pocket needs to do is brush up against you and he's got all your credit card numbers.

Smart cards?

[TheQuietDan]

I think that maybe it might be based on the smart card, you wave it and it has an id number that is only good for that minute. The next minute the number is something else all together.

I can see a new Amazon patent

[DannyiMac]

I can see Amazon patenting 0-click technology with this...

Security?

[baloogan]

Think about it.... Some (insert evil persona here) would put somesort of recever anywhere near the sales counter and decrypt any data passed though the !air! Personally I like to think that they would need to have phisical access to the card to steal..... But then again im wierd....

War Driving For Credit Card Numbers !!

[Lew Payne]

Leave it to those narrow-minded visionaries at VISA and Royal Phillips to come up with an even more insecure method of deploying consumer credit card information... via RF (wireless) technology.

If you think credit card fraud is rampant now, wait until card thieves get hold of a portable RF reader and begin walking down crowded streets...

Hey, that's fine with me. This gives me enough lead time to come out with a copper-lined wallet that prevents RF credit card theft. In fact, I'm racing to the patent office now!

Stopping fraud?

[chrome]

Reading some of the comments here about the security of these cards, and it makes me worry somewhat.

I used to sysadmin for a shell account company, and we saw huge amounts of credit card fraud, mostly from kids looking to run bots on IRC, or just because they collected shell accounts.

One thing I came away with from that experience was the definite feeling that Credit card companies don't seem to think it is in their interest to stop credit card fraud.

After all, if the owner of a card is frauded, the bill goes on their card, and interest is accrued. If the owner of the card isn't diligent, its possible they might just automatically pay the card off, without even realise they have been a victim of card fraud.

Certainly, the credit card companies don't seem to go after the fraudsters as much as they should. One of my friends on Dalnet used to regularly give the full details of people that she had discovered doing carding. One kid was so blatant, he put up a web page, with pictures of him holding up all the crap he had bought with stolen card numbers.

He was 12, and his mother didn't care in the slightest he was stealing. And neither did the credit card companies. The police were interested though, but he didn't have much repercussions - just a couple of weeks in a counselling center for kids.

Anyway, I digress.

Proximity cards are a great ieda. It means I can just wave my wallet near the scanner to pay for an item.

But, if this is not couple with some new form of identification currently not in use with credit cards (a pin number would suffice, or something biometric such as a thumb-print), then I fear that fraud will just increase.

People will get a hold of the scanners, and set up their iPod to capture the card numbers of anyone in proximit to it, and just walk up behind people, snapping up numbers.

Maybe I'm just getting paranoid.

Re:Stopping fraud?

[Jesus IS the Devil]

One thing to add...

Another reason credit card companies don't care? They are not the ones to foot the bills when a chargeback is initiated. It's the merchant who is out of the entire purchase, some insane chargeback fee, and the lost product.

Credit card companies will never care as long as the monetary loss due to fraud is LESS than the actual cost of pursuing the criminals.

Re:Stopping fraud?

[Anonymous Coward]

Haha, nice work.

AC
www.utmostmusic.com

Re:Stopping fraud?

[Anonymous Coward]

Bad idea.
Pick-pocketing will be done merely by walking past people.
'nuff said.

Octopus

[ZarathustraThePolarB]

In Hong Kong we've had a similar technology for several years now. It's called the Octopus card and virtually everyone in the city has one. It can be used for payment on nearly all public transport and in stores where people make small purchases.

The EE Times article focuses on the technology is a bit light on details of what the card actually does, so I'm not sure if it is a stored-value card (like Octopus) or actually operates like a credit card. I would be surprised if it's the latter because of concerns about theft etc.

Re:Octopus

[kliment]

We have similar cards for the public transport system here in Helsinki, Finland. Remote-readable, range about 5cm (2 in) from reader max. They were being used to track people's use of public transport until people started complaining A LOT and it was found that it was illegal to do so. They were forced to destroy their database of trips and were only allowed to use the readers to count passengers, not store card numbers.

Re:Consolation prizes

[Anonymous Coward]

Warning... the second link is troll droppings.

You have been warned.

Oh, my damn eyes.

AC

Security

[oreomitch]

Wouldn't the PKI scheme be used? That is to say that the card and card-reader share some key. I suppose that this would be just another variation on chip-card technology (EMV, Proton etc).

actually

[Anonymous Coward]

other credit card industry players have had trials of similar systems in this field. also, Mobil has been using the Speedpass system for years which works in a very similar manner.

this really isn't anything new. put a very significant number of them out in the world and have a significant number of acceptance sites and THEN you have a first mover.

devil's advocate...

[inkedmn]

does anybody else smell the "21st century pick-pocket" here?

Re:devil's advocate...

[Anonymous Coward]

Not to nit-pick, but use punctuation properly. The first word should be "Does" and not "does".

npt

Re:devil's advocate...

[inkedmn]

not to nit-pick, but punctuation != capitalization.

have a nice day.

For the naysayers...

[SamMichaels]

The place where I used to work had these key fobs which worked like that. I thought it'd be cool that we just had to walk next to the door and it'd open it.

Not.

Even when directly contacting the sensor with the key fob in my pocket it didn't activate it. It had to be held infront of the device, almost touching it.

Whatever the range they say, I'm sure you're not going to be able to sniff out the RF signal by just sitting next to someone unless you have some expensive equipment.

Re:For the naysayers...

[Babylon Rocker]

I've got an idea for paying for that expensive equipment....

If there are six people in line...

[Robber Baron]

...how is it going to know which card to use for the transaction?

Know what I'm going to do? Pick the lineup with the most customers. That way I'll have a pretty good chance of not acxtually having to pay for my stuff!

This is prolly redundant already

[Fizzl]

But my first thoughst are...

Could it be too hard to snoop on the 'lil radiowaves or magnetic fields used in these things? I mean.. I'm first in line swiping a mall with a highpower transceiver for these things, harvesting credit cards. :P

Atleast there has to be an attached pin number or something.

And when you have to enter a secondary authentication token (such as the pin), I see no advantages over magnetic strips.

Oh yeah, except. "magnetic". These things prolly would be harder to destroy accidentally.

How am I suppose to impress people then?

[mrklin]

With my American Express black Centurion card if I don't take it out?

I kid. I don't have one and you can't "apply" for one either. Read more about it here and see it here.

Jedi credit card trick.

[tallackn]

(waves hand) "You will sell me these goods." :)

Re:Contactless? Great!

[w00tKore]

wqerqewrqewrqwerqwerqwerqwerqwerqwer test

Japan has contactless credit cards already

[gkanai]

Japan has had contactless debit cards for quite some time, with technology developed by Sony. The Japan Railway East 'SUICA' cards are similar to the Octopus cards in Hong Kong.

http://www.tcvb.or.jp/en/hot/sizzling/0112/sizzl in g_12c.html
and
http://edition.cnn.com/2003/WORLD /europe/02/18/biz .trav.smart.cards.ap/

Also the EDY cards use similar technology and are embedded into credit cards so one card can be both a swipable credit card as well as a contact-less debit card.

http://www.sony.net/Products/felica/contents04_0 1. html

One use that springs immediately to mind....

[grahamlee]

Waves AmEx These aren't the droids you're looking for...

Obiwan was a bribe merchant!

Buying drinks...

[warriorpostman]

...for women in a bar will be an even more graceful gesture than ever... Who says geeks can't be smooth!?

Signature on credit cards?

[millwall]

I've asked many people this but no one can give me a decent answer...

What kind of security check is it to write your signature after using your credit card?

I mean the signature is on the back of the card!

It's like having the password to your computer written on a piece of paper stuck to your monitor...

Re:Signature on credit cards?

[Anonymous Coward]

A signature is not a password, it is a biometric.

Remote pickpocketing counter measures

[xyote]

This is a problem with rfid type technology. The problem is that rfid is passive and to read it, you need an active rf source. Which makes you, unfortunately, very very visible. I'd like to see the Artful Dodger dodge a HARM missle.

Re:Remote pickpocketing counter measures

[uspsguy]

Unless, of course, your pickup device just happens to be near a real working terminal and just quietly listens.

Why no SARS in USA?!?!?!

[Eric Ass Raymond]

Why are there no (nada, zilch, forget it!) SARS cases in the USA?

Makes you wonder...

Re:Why no SARS in USA?!?!?!

[Anonymous Coward]

there will be once a dirty canadian visits. just like with aids.

the Bush card

[js7a]

They should name these card after presidents Bush. You can run up a huge deficit without touching anything.

Re:the Bush card

[Eccles]

Hey, dummy. It is Democrats who want to spend, spend, spend. ...which is why the last two presidents to submit balanced budgets were Clinton and Johnson, and Carter's deficits were ~1/5 the average deficit Reagan submitted.

Democrats want to spend, so do Republicans. The Democrats are just more honest about it.

Re:the Bush card

[Izrun]

You do realize that by percentage points, the deficit is smaller than it has been in years, right? Let's say you make $1000 a month, and you spend 1100 bucks a month. You're running a 100 dollar deficit, which is 10%. Now, let's say you make $10,000 a month, and spend $10,200 a month. You're running a 200 dollar deficit, but it's only a 2% deficit. Which is worse? By your (and other liberals) math, the 100 dollar deficit is better. By my (conservative) math, the $200, 2% deficit is better. So I look at this as the deficit will be the smallest percent of our GDP since before Clinton, whereas you see it as the largest amount ever. You tell me which makes more sense (hint, my way, which follows logic).

Re:the Bush card

[Nu11.org]

Democrats want to tax and spend. Republicans want to cut and spend.

Re:the Bush card

[Anonymous Coward]

We had a negative deficit for a few of the Clinton years, so you lose.

Re:the Bush card

[js7a]

You do realize that by percentage [of GDP], the deficit is smaller than it has been in years, right?

Wrong. The interest required to maintain the national debt only looks small right now because intrest rates, as set by the Federal Open Market Committee are at an all time low. And since O'Niell was fired for trying to amortize, the Fed is pissed off.

Perhaps you remember what the "conservative" Fed did in the months leading up to the 2000 election? Perhaps you noticed that they had to give away almost all their interest-lowering power in a failing attempt to make up for their political meddling? Bush filed his papers this month. It's time to pay the piper.

Re:the Bush card

[OwnedByTwoCats]

In 1999 and 2000, the deficit was a surplus. So the deficit/GDP ratio was the other sign.

More telling than deficit/GDP, is debt/GDP. It goes up dramatically after things like the Civil War, WWI, the Great Depression, WWII, the 1980s, and the 2000s.

Re:the Bush card

[Shivetya]

Actually your wrong.

The percentage versus the GDP is smaller. We are not comparing the interest required to maintain the debt, only the dollar amount of the debt.

The real problem that exist right now is that the Republicans in Congress act just like 80s Democrats, and the Democrats are more than happy to play along with them.... spend spend spend.

Bush isn't the problem, neither is his tax cut. It is Congress, always has been, and apparently always will be. Regardless of who is in power there the Senate is corrupt to the core.

Its our money, let us spend it. We, the people, know far better how to appropriately spend our money than the damnable politicians who only spend to keep their own jobs. They don't give a shit if we have one.

Re:the Bush card

[Izrun]

All right. I see what you mean. A couple of my points were off, but I didn't feel like doing research before. Here are the facts (by percent of GDP) (from the governement)

• 1992: -4.7% 1993: -3.9%
• 1994: -2.9%
• 1995: -2.2%
• 1996: -1.4%
• 1997: -0.3% see end of post for more info)
• 1998: +0.8%
• 1999: +1.4%
• 2000: +2.4% 2001: +1.3% 2002: -1.5% 2003: -2.8% (estimated) 2004: -2.7% (estimated)

Now, Clinton should only get blamed for half of the 1992 deficit, because he was only in office half the year. The same with the 2002 surplus. So that makes the total average deficits:

• Clinton: -1.20625%
• Bush: -0.7875%

The numbers are also based on proposed GDP fron current growth. If the tax cut does what it supposed to do (and almost always does), then this deficit might just go away (see below). So you see, this might be the "largest deficit ever," but it is not even close to that by percentage of GDP (actually, the last time the deficit was this low before the .com boom was in 1981. My point in the previous post was not that Bush's deficit isn't bad (I think the government needs to cut spending, which neither party wants to do), but that this "biggest deficit ever" basically means nothing.

As far as Clinton's budget goes, I found something interesting while looking. Take a look at his proposed budget for 1996. He did not know about the surplus from the .com bubble. His budget estimated that the deficit from 1996 - 2000 would be as shown below:

• 1996: -2.7
• 1997: -2.7
• 1998: -2.4
• 1999: -2.3
• 2000: -2.1

Doesn't quite look as pretty, does it. If the tax cuts do as they should, Bush's deficit could go away as Clinton's did. Isn't that exactly what Bush's is for 2004, and Clinton didn't even have a war on terror to take care of....

Re:the Bush card

[js7a]

The percentage versus the GDP is smaller.

You haven't seen the FY 2004 budget yet have you?

If you care to take a look, you might be interested in the 6% tax increase planned for 2005. On Table S-1, row 11, reciepts as a percent of GDP it jumps from 17.0 to 18.0 percent right after the election.

We, the people, know far better how to appropriately spend our money than the damnable politicians who only spend to keep their own jobs.

Sweden has about twice our tax rate as a percentage of GDP, but voters there are happy with their progressive tax structure which removes great burdens from the working class, grows their middle class, gives them plenty of money for education, keeps their unemployment low (4% in 2002), keeps their inflation in check (2.2% in '02), and gives them a high enough standard of living to be judged the best place to be a mother (the U.S. was the 11th.) Businesses in Sweden (e.g. Ericson, Ikea, Volvo) aren't significantly harmed by their top-bracket tax rates, if robust international sales are any measure. Sweden also has robust small businesses.

They don't give a shit if we have one.

A year from November, Bush is going to wish the three million who lost their jobs had somewhere other than the polling place to go. That is why it is so important to make sure the Democrats pick a good candidate in the primaries.

Re:the Bush card

[js7a]

If the tax cuts do as they should, Bush's deficit could go away

Oh, brother.

Reagan's budget director, David Stockman, called trickle-down economics "unbridled greed." President Bush's father called it "voodoo economics" when he ran against Reagan, but was forced by the popularity of Steve Forbes' ultra-regressive flat tax to make a promise about not raising taxes that he knew he couldn't keep. President Bush is now in the same predicament that his father was in. He fired Paul O'Neil for using accrual accounting which adds the amortized cost of the health care and pensions for the hundreds of thousands of newly-activated soldiers to the deficit, because it made the deficit look five times larger than with the cost accounting method used by the OMB.

You want to know what's going away? Jobs in the Bush economy.

Re:the Bush card

[Anonymous Coward]

The only thing Democrats do is raise taxes and spend money. The Democrats NEED money to spend. The only good democrat (such as Dean) is an unemployed democrat.
Bush has trumped all the things the Democrats have tried to pin him with. The only reason there is a huge deficit is because Democrats are unwilling to cut things that really are not needed, but unfortunately, the Democrats will do something like "because we have such a huge deficit, we can't extend unemployment benefits". Just to get people mad at Bush.
Democrats are just mad because the American public doesn't want to listen to the lies and bullsh*t that the democrats shovel. They say the tax cuts will only help the rich, but they don't tell you that they consider any family with a combined income of $80,000 a year and over to be rich!!!!!!
It's tuti-fruity Democratic scum like you that is bringing our nation down a long spiralling tunnel of destruction with the sociallist agenda and fag rights agenda. If you scums get those, what will the next generation push for in order to one-up the previous generations rebellion? Probably rights and exceptance of pedophiles, necrophiliacs, and beastiality!!!!
There's two sad parts to those who believe in the Democratic causes!!!! The first being that you are too blind to see the long term effects of what you are pushing for currently. The second is that you don't realise that the democrats will not allow their goal to be finished until society is ready for what they want to push on it next (such as pedophilia). They keep stringing these poor souls along. You are stupid!!!

Re:the Bush card

[js7a]

The only reason there is a huge deficit is because Democrats are unwilling to cut things that really are not needed

At present, the Republicans have control of the House, Senate and the presidency. They have increased the deficit to about $44 trillion when health care and pensions for the baby-boomers and the recently activated soldiers are amortized in. Three years ago there was a surplus. Since then, the stock market lost $7 trillion and more than 2 million voters have lost their jobs.

unfortunately, the Democrats will do something like "because we have such a huge deficit, we can't extend unemployment benefits". Just to get people mad at Bush.

On the contrary, both of the recent unemployment benefit extensions were authored by Democrats.

If you ... get ["a long spiralling tunnel of destruction with the sociallist agenda..."], what will the next generation push for in order to one-up the previous generations rebellion?

This recent Mothers' Day, Sweden was voted the best place in the world to be a mother, while the U.S. was 11th. Do you think Sweden is socialist? Their tax rate as a proportion of GDP is about twice ours, but they have low unemployment (4%, 2002 [CIA]) and inflation (2.2%) and plenty of money for education, which correlates with increased levels of respect for all human rights, decreased crime rates, and increased property values. Their taxpayers love their tax rates because they have reasonable progressivity. If you're making $500,000 per year, who cares if half of it goes to pay taxes for universal health care, universal day care, and free college tuition? What percentage of the Swedish youth are rebelling against their government? If incarceration rates are any measure, I think you will find a lot more in the U.S., where more than 1 in 100 are in jail.

the democrats will not allow their goal to be finished until society is ready for what they want to push on it next (such as pedophilia)

I believe you are mistaken. Which plank of the platform are you referring to?

Re:the Bush card

[Anonymous Coward]

No, that required a signature too.

Hip to the idea of a credit card update

[zakezuke]

Let's face it... credit cards are based on pretty old technology. Hell, there was a nice little 1970's film, can't remember the title off the top of my head, where one of the sub plots was a lady geek got fed up getting a job at a bank, proposed a security upgrade for their cash machines, got the cold sholder, and decided to rip off the cash machines. While I think it's a little far fetched to do such a thing from the safty of a van without modifying the equipment, it would be easy enough to visit a 2nd hand shop, buy a credit card terminal, modify it to relay all information it recieves, all the CC information as well as the pin associated, and transmit it to an outside source, which could be via radio or heck even one of those pay as you go phones. And because the technology is so dated, one can easily build a credit card writer, in fact I know 2600 had an artical on one you could build using cassette heads and a steper motor from a teac floppy drive (though 5.25 inch hard drive stepper moters are a whole lot more fun).

Now in the states this would be considered to be a federal crime, probally a felony, so kids don't try this at home. Damn sure this is a high crime in other parts of the world as well. My point is the struture of these cards we carry in our wallets are well documented and it's painfuly easy to create a credit card. Unlike paper currency, clerks often times don't even look at the piece of plastic you are shoving through the machine, and it's not like a cash machine cares. Again, don't try this at home, screwing with banks is bad... m'kay.

I would not be opposed to some form of smart chip, something that is a might bit more difficult to reproduce. I'm not nessicarly opposed to cards that use RF, provided that some form of physical authorization is required, like pin number, signature, thumb print. Both smart cards and RF cards can also be forged, but requires a bit more then essentally cassette tape, cassette head, stepper motor, and interface. Plus I want some form of authentication to demonstrated that I actually authorized a purchace.

Re:Hip to the idea of a credit card update

[Cackmobile]

I actually heard of a scam like this is the US. They put in a fake ATM which had a laptop installed. The machine would take in the card aand then you would enter your pin. It would then say your card has been retained blah blah blah. THey put it in the middle of a big mall. Perfect.

Re:Hip to the idea of a credit card update

[zakezuke]

Oh yea, I know some people in my region got caught for this scam, though it was more along the lines of, "we are experencing trouble, please try your card again later" sorta deal. After all outright theft of card and it gets reported stolen. {remember kids, don't try this at home}

On a side note... I've noticed that it's practicaly impossible to return a lost card. I know in two cases i've actually noted cards in cash machines. I thought i'd do the honest thing and actually try to contact the card holder and say, "look, found you card, I think you might want that". In one case it was from an Alaska Credit Union, thinking to my self the holder living so far away is probally on vacation I'll try my damnest to contact the bank and work out some sorta arangement to return the card to the card holder. This does not work... I understand they don't give out addresses of card holders, what I don't understand is them not taking my address / number to give to the card holder, and they can actually phone the card holder. Basicly it was a "please destroy it", which I thought was a waste, esp when I was willing to return the card to prove it was *lost* rather then *stolen*. After a week I gave up, and I think I used it to apply epoxy to my car.

For future reference, I think i'll stick to returning lost purses / wallets. usually there is some form of ID in them where I can contact the owner without getting frustrated by banks who are not equiped to handle someone trying to be nice. And if all else failes, the US postal service will return them provided there is something with an address inside.

No way to make it secure

[AdamInParadise]

This idea is complete BS. There is no technical way is reach an adequate level of security using anything contactless to actually pay for something. Even with badass security measures like EMV (think personalized certificate in your smarcard, coming to a wallet near you very soon), there is still perfectly reasonable concerns, like "How am I sure that I'm actually talking with the right card/reader and not the one 2 meters away."

Now contactless cards can be very useful in one situation: identification. All those metro passes could be contactless because money isn't actually withdrawn from your account: the system just makes sure that you're you and that your account allows you to access this area. Also, from the point of view of an hacker, there is no way to make money by impersonating the backend system. They could try to make new cards, but the GSM system proves that you can actually prevent this from happening.

Now it seems that credit card companys are willing to take the risk. Fine, but who's gonna pay for fraud? Well, the user of course, and that means you and me.

Finally, the article is kind of vague. I'm not actually sure that they will allow you to pay wirelessly. I'm thinking that Visa and Phillips are actually building a contactless card/reader combination, but that the journalist elaborated mindlessly over this idea, as usual. Also he seems to be rolling contactless cards with application cards, which is an orthogonal feature altogether

I think this is sound technology.

[anubi]

"Even when directly contacting the sensor with the key fob in my pocket it didn't activate it. It had to be held infront of the device, almost touching it."

I betcha this is the design which doesn't have any batteries in the tag.. it uses the RF energy from the sensor for its power. The data is sent back synchronously with the pulses of RF being fed to it. Using spread-spectrum techniques, you can get the signal-to-noise rejection ratios quite high as the sensor receiver acts as a "lock-in" amplifier, correlating the data received with the known transmitted exciter. Sniff it? Hardly. It looks just like white noise, except to the interrogating device which is interrogating the tag with something that also looks just like white noise.

There is an infinite sea of number sequences out there which look just like white noise.. but if you know precisely which sequence you sent, and what to look for, no one else is privy to it and can't see it at all.

Remember, the power ( RF "illumination" ) drops off as the square of the distance, so if you set this thing right, you hold the tag close, it will work, but pull it an inch or so out of range, forget it. Insufficient power to do a thing. And if its not illuminated with the correct source, it can't return data in sync... so this thing oughta be really hard to spoof.

Looks really neat to me.

Useability problem

[Frantactical Fruke]

The idea that just waving a card in the proximity of a reader will make you poorer makes people uncomfortable. Poor feedback.

Our bus services recently switched to cards like that. People keep wondering, if the reader actually took the charge at all or charged them twice.
The fact that the card itself has no display to show its balance and the reader a mere 20 character display increases the discomfort.

If these cards aren't surrounded by proper interfaces, they will not get popular. ...um...

Argh, I forgot the "Didn't cost anything: I paid with my Visa" effect that guides people into personal bankruptcy. They seem very comfortable with that. So forget I said anything.

Re:Useability problem

[raju1kabir]

Our bus services recently switched to cards like that. People keep wondering, if the reader actually took the charge at all or charged them twice. The fact that the card itself has no display to show its balance and the reader a mere 20 character display increases the discomfort.

That's what audio feedback is for.

Another victory for germaphobes!

[SecGreen]

To bad they'll probably still make us type a pin on that greasy keypad.

As for previous posts about portable scanners, this could easily be solved by:

- Limit the range of the rf elements in the credit card.
- Have a scrambler card in your wallet that has greater range & RF output
- Build in some kind of biometric (like your picture showing up on the authorization terminal, privacy - blah blah blah...)

But what's the point?!

[nmg196]

Can someone please answer this really obvious question? What is the point? With all the disadvantages mentionned above (stealing card details without you knowing, problems with multiple cards in a wallet meaning you have to take it out anyway etc etc) why would you want a proximity card anyway? There isn't any problem with normal chip cards as they are... (except they don't require a pin or anything yet). Why not just increase the security of normal chip cards first, which could probably be done without issuing anyone with a new card. The proximity concept doesn't solve any problems at all and simply adds more new ones.

Nick...

Isn't that how the SpeedPass works?

[192939495969798999]

I think that's how SpeedPass works. It's really a faster way to buy things, but seems incredibly unsafe. If someone swipes that thing, you're done!

Re:Isn't that how the SpeedPass works?

[phillymjs]

That sounds exactly like how SpeedPass works, but losing a SpeedPass is not as big a deal as you make it seem. AFAIK, you can only use it to buy gas and whatever the Mobil/Exxon mini-mart is selling, though I think in some areas McDonald's is testing its use in their drive-thru.

If you lost it, all the finder could really do to abuse it would be to call up all his/her buddies and meet somewhere to go fill their tanks up, en masse. Anyway, the thing is supposed to be kept on your keyring, and if you lose your keys you tend to notice that pretty quickly. You just have to call Exxon/Mobil and give them the code number imprinted on the SpeedPass (you did write it down and keep it somewhere, right?) and they'll kill it and give you a new one.

~Philly

Re:Isn't that how the SpeedPass works?

[dtabraha]

I agree that this idea is on a larger scale than the SpeedPass, but Exxon/Mobil definitely owns the rights to the "proximity charge" idea.

That's why you don't see a BP/Amoco-pass yet, the patent is still in effect.

They'll probably just ask for a big royalty check and it'll be done.

Who's paying for the infrastructure?

[Anonymous Coward]

Let's forget about the security issues for a minute.

Who's going to PAY for all these nifty new readers? Practically every store in the whole damn country takes credit cards, even all the mom-and-pop stores that have a little Tranz-330 behind the counter.

What is the store's incentive to spend what, probably $500-$1500 for a card reader for yet another kind of card (especially if they were already burned by a smart card program?)

And what is the public's incentive to get a card that nobody accepts? It's like the AmEx Blue - it's got a chip in it, but has anybody ever used it? I doubt it.

There have been various attempts to get non-magstripe cards as cash substitute cards in various US cities, and none ever do anything, because they can never surpass the chicken-and-egg deployment hurdle.

Better for Hookers

[Anonymous Coward]

This is great. I'd much rather not slide my Visa through her slot.

Please, please don't support Esso/Exxon/Mobile

[Erisian Pope]

Their rapid payment thingies may be inovative but these are guys that still claim there's no such thing as global warming or human rights in third world countries they exploit. Their track record is terrible. They're totally apallingly disgusting. If you really must drive, at least buy gas from somebody like BP who at least pays a little attention to the environment.

For more info stopesso.com

Who's talking about security?

[JoseMonkey]

All of these threads about security seem off-topic to me. I don't think anyone really intended proximity cards as a way to improve security at all. Considering how dismal cc security is, it probably won't make it worse, either.

I think the point is that proximity scanning is (slightly) easier than swiping -- especially since swiping isn't always straight-forward in my experience. (i.e., Clerk swipes card. Pause. Clerk swipes card. Pause. Clerk swipes card. Pause. Clerk enters number manually.) It might be nice to have the reading of a card number not be dependent on 1) the supple wrist of the user, 2) the condition of the card, 3) the speed and direction of the swiping motion . . . the list goes on and on.

Also, the wear and tear on the cards might actually be reduced enough to make them last more than a few months . . .

I see a problem

[Anonymous Coward]

Now someone can pick your wallet just by walking by.

Oops. Bumped into you. My bad. = Credit card info stolen with a portable reader.

Huh? CCs have no PINs in the US? Here they do

[Anonymous Coward]

..at least I know they do here in Germany and also in France. There, you have to enter it all the time wherever you pay. I don't know about here cause I pay in cash - CCs aren't used for small purchases here due to high fees the merchants have to pay.
Which leads us to an interesting point: the CC companies used to put the risk of fraud on the merchants. AFAIK, a German court toppled that some time ago, ruling that the CC company has to compensate for fraud and denied payments.
The result? Loads of online stores, possibly thousands, had their contracts terminated, only the big players offer payment by CC without high fees (usually 4% with PayPal) now.
If you can read German, read this: http://www.fun.de/deutsch/news/presse/pressespiege l/PS_2002/spiegel.htm

That's what happens when something becomes unfavorable for the financial business - they drop the service.

Best solution for security convenience...

[Scratch-O-Matic]

This sounds interesting, but I think the best overall solution would be a card that works by its proximity to Redmond, Washington. Proximity in this context means any distance that can be covered by a provately owned network of satellites. A bank of customer service reps and security experts there could approve/disapprove each transaction, as well as compute the substantial tariffs/licensing fees. The process could be streamlined by including reps from the MPAA/RIAA.

Hey wait! Gotta go...I'm off to see my patent attorney, who is on retainer.

sugar daddy

[djupedal]

me! me! pick me! I'll do it!! Pick me!!!

No more shop lifting

[HermanAB]

with RF ID tags on merchandise and a proximity credit card, the stores can just ding a shoplifter when he/she walks out the door - or ding anybody else within range...

Maybe I'll pass on this idea - too much scope for fraud by the shop owners!

Your PIN usage is pointless

[A nonymous Coward]

Choosing EFT does't improve your own security unless you are worried about having picked up somebody else's card by mistake. It doesn't have beans to do with the guy who steals your card; he has no obligation to choose EFT.

Tips for Mitigating Credit Card Risks

[Col. Panic]

Receipts carelessly tossed in a garbage can outside of certain stores (yes, many of them do print your full name, card number and exp. Date)

Shred receipts you don't need and keep secure those you do.

Hacking insecure online servers (many have 1000s of cards in plain text or weakly encrypted)

If you are going to purchase online via credit card, never allow the website to store the data "for your convenience" because then it is in their database. The site should have to ask for your cc# for each and every transaction. If they don't have the option not to store your card info, don't shop there and let them know why.

Consider getting a single, low limit card that you use exclusively for online purchases, particularly one that advertises online purchase protection.

Check you statement monthly or more often (if online statements are available.)

Grab your mail

This is a federal offense, but anyway. Don't forget your mail carrier at Christmas, Kwanza, Hanukah, whatever.

Look in your recycling box

Shred, shred, shred.

Look at your card over your shoulder

Be aware of your surroundings.

Hidden cameras, crooked cashiers/waiters etc

see: "Check your statement monthly" above.

Set up a fake online store selling a few products very cheaply.

Set up a cheap porn site. (ala the Eros Island scam)

Discover USENET pr0n, which is free. You don't mean you actually *pay* for pr0n do you?

SARS in USA

[jeepliberty]

There were two confirmed SARS cases in Florida reported the Florida Today newspaper several weeks ago. The actual location(s) were not divulged. (To prevent panic)

I wonder how many other locations in the states have confirmed cases of SARS? Conspiracy theories anyone?

what if they invent ultraportable scanners?

[pimpinmonk]

I can picture it now... some girl rubs herself up on me at a bar, but little do I know she's actually buying herself a drink on me through my pants! Talk about beating the system!

Jason's Deli...

[rulethirty]

I've seen something like this in Jason's Deli where you somehow have your credit card hooked on or glued to your cell phone and just quickly swipe it by to pay for overpriced food... Anyone know what the difference is between this and the one I am seeing in the Deli? On another note, I hope my girlfriend never gets a hold on one of these!

Good in theory

[56ksucks]

This idea is good in theory, it would certainly solve the worn out strip problem. However, it would only be a matter of time before a smart hacker genius crook would come up with a portable device he could carry around with him. He could steel money from your card just by brushing up against you on the bus or in a croud, or just by walking around the mall. Also it'd still need a strip for all the thousands of busineses that won't migrate to this technology until it catches on.

The Final Result

[Burlynerd]

Contactless credit cards seem to be merely the next insecure step in a series of steps that make our financial transactions more vulnerable to fraud. The legalization of digital signatures, and even the implementation of direct charges to checking accounts were earlier parts of this vulnerability process. The fraud that results from this perpetual weakening of our financial transactions will eventually be so common that people will demand a solution to the problem. The final result is the mandatory use of biometrics for general identification. The mark of the Beast would be required to buy a Big Mac. Barcodes on your forehead, anyone?

W.A.S.T.E.

[drwho]

We Await Silent Trystero's Empire

SARS in Florida

[jeepliberty]

A google search of florida+sars reveals several links during April 2003 related to SARS in the Florida Panhandle. See WESH-TV report or Miami Channel 10.

Curiously, many of the Google links display "story not available". Are six week old stories normally flushed from on-line archives? In such cases use Googles's "cached" link to see the story.

Contactless Credit Cards available here

[cgenman]

http://www.mycreditcarddetails.co.uk/

Not only is there no magnetic stripe to swipe, but they are animated to the theme song from Magnum P.I.

Mark of the Beast

[rubmytummy]

Contactless credit cards, and RFID implants. Hmmm. Who else is reminded of a mark on the forehead, or the right hand, without which no man might buy or sell any thing?

American Express Also Has This...

[cve]

AMEX TESTING KEY-FOB TECHNOLOGY
CardLine (Thomson Media) (Front Page), May 23, 2003

American Express Co. is testing a contactless key-fob product that the card issuer plans to use small-ticket purchases. The product, which is called "ExpressPay by American Express," uses radio-frequency technology, says David Bonalle, AmEx's vice president and general manager for advanced payments and enterprise development.

Bonalle tells CardLine today that he can't talk about a rollout, but "we definitely see there is a lot of opportunity." So far ExpressPay is being used solely by AmEx employees, and it is accepted at only a few locations, including the cafeteria in AmEx's big processing center in Phoenix, and some local stores.

Users who wave the key-fob by a payment terminal reader can spend up to $150 per day. The average transaction takes 8.9 seconds compared with 12.4 seconds for cash and 15.4 seconds for credit card sales requiring no signature, according to Bonalle, who spoke today at Thomson Media's 15th Annual Card Forum & Expo in New Orleans.

Value for the card can be prepaid or charged to a regular AmEx card account. Users can get online monthly statements. Bonalle would not discuss pricing other than to say that AmEx is "following the discount-rate policy that's in place for mag-stripe (cards)."

AmEx began planning for a micropayments product late in 2001, he said, and AmEx is working to ensure that ExpressPay's technology is interoperable with other key-fob radio-frequency products such as Exxon Mobil Corp.'s Speedpass and MasterCard International's PayPass.

It's already out there - at least for truckers...

[archaic0]

Where I live this technology is already in use. There are gas pumps here in Kansas labeled with a square area and a SPEEDPASS logo.

Speedpass Site

I don't know anything about the underlying technology, but it would seem phillips and visa have been beat to the punch.

Simply Waving it?

[Anonymous Coward]

"These aren't the droids you're looking for..."

Delamination?

[tetsuji]

To get this right, they will have to figure out a way to make the antennas a bit more durable than the one in my current work passcard, at least. I once made the mistake of keeping it in my wallet and it delaminated and the antenna broke after being sat on for a few days - and I only weigh 150 pounds! I replaced the card, and the second one delaminated after accidentally being slept on on the couch.

Great!

[scovetta]

This is a such a great idea. I can't begin to tell you how many hours I spend in frustration trying to line up my credit card with the swiper. Not to mention the huge amounts of dirt and grime that i have to clean off my cards every night!

Maybe they should just surgically implant a credit card in my brain so i can just *think* about buying something and it's done.

airborne credit info

[CaptainFrito]

perfect. maybe now the crackers will leave WLANs alone and go straight to the source.

First they better check out Cypak

[TheLoneGundam]

I think they better first check out the so-called "Smarter Card" from Cypak a Swedish firm that has a card with embedded CPU and RF, and a keypad built onto the card which requires the user to enter a PIN to validate use of the card. Seems to me that Cypak already has most of the relevant technology.

Unintended consequence

[gokubi]

The last proximity card I carried in my wallet erased all my credit cards. Does the new card erase itself after a few months, and take your $1700 balance with it?

Re:too long range (maybe)

[axxackall]

There has been talk about contactless smartcards for the past 10 years.... while Europe and Far East is using smart cards for same time period.

That just proves that American society cannot progress any more. I think Internet was the last Big Thing (TM) we've got from there.

Not any more convenient

[gfw123]

The best thing about my proximity access card is that I don't have to take it out of my pocket or wallet to use it. I know that I carry at least 2 credit cards and 1 debit card. If I get my wallet close to the machine which one would it withdraw funds from?

The push for contactless credit cards

[iblink]

is not really about looking for another payment method. After all, it's easy enough to pull out a wallet. The new technologies are designed to help retailers build loyalty programs unique to their chains. Speedpass was one of the first applications. Their RFID keypass is not only about payment, it's about providing a service that makes loyal customers. Since a driver already has his keys in his hands, and he is often in a rush, a keychain fob makes sense. I think about 6 million Speedpass tags have been distributed. To my knowledge, fraud has not been a big problem. Companies like Visa and Mastercard have brought out better tag technology that will eventually allow retailers to offer rewards and loyalty points based on purchases, like the airlines. There's even a company in Virginia that offers retailers just the loyalty tag -- without the payment. The point here is that shopping will soon be more like that on Amazon: your purchases will be tracked in real time, and special offers (based on previous purchases or similar aggregate data) will be tailored just for you.

Pros & Cons

[Anonym1ty]

Pro: My card won't wear out before it expires 6 years from now

Con: Now I can have my number stolen without comming into physical contact with the theif
--This could be a pro if you consider it could make getting robbed a whole lot safer .

Re:It's already out there - at least for truckers.

[Kadin2048]

Speedpass is one use of the same technology. In New England we have several (competing, non-standardized) systems for paying tolls on the interstates. You put a box about the size of a pack of cigarettes on your windshield, and then you can just drive through a special lane at the tollbooth without stopping. A light on the booth tells you that it has "talked" to your box and you're free to keep going. Very popular with truckers, commercial drivers, etc.

In both cases, Speedpass and the toll system, the heart of the device is a small radio transmitter that is actually powered by an RF field in the vicinity of either the gas pump or the toll booth. When bombarded with enough RF, a chip in the transponder sends back its serial number. The difference between the mini ones for Speedpass and the big ones at the toll booths are that the toll ones have to work much further away from the tx/rx antennas. I've never taken one apart, but I expect the antennas are much larger.

The problem with using a system like this for a credit card is that the transponder is dumb--it doesn't know what it's transmitting to, or whether it is appropriate to transmit your credit card number at that moment. If it gets hit with enough RF to energize the circuit, it transmits your account number. This would be very dangerous, for obvious reasons.

If I were building them, I would put a little 'fail-safe' on the top of the card: two metallic patches separated by a few millimeters, that you have to cover/connect with your thumb in order for the card to transmit. I'm not sure how complicated the circuit would be, but I have personally seen devices that have metal bars like that and use the capacitance to know whether a human hand is touching it or whether it's brushed up against an inanimate object.

Competing electronic-payment devices

[hudsucker]

There was an interesting article in the Dec 2002/Jan 2003 issue of Technology Review magazine: "How You'll Pay: Which of the competing electronic-payment devices will we choose?".

The article discussed the pros and cons of smart cards, radio transponder devices, etc.

The article on the Technology Review website is subscriber only, but you can read it here.

easy theft

[Anonymous Coward]

Maybe I'm missing something but couldn't a thief just walk around in a crowd downloading people's card IDs? Then using a reverse process, transmit that info at a card reader and presto... he'd get what he ordered.

This is different from ordering online or anthing like that because the card never has to leave my wallet.

I don't think this is a problem with current RFID cards (such as SpeedPass) because it's not worth it (gas prices are low and the cost of the hardware is not trivial) but if this could be used for ANYTHING I think the motivation would be there.

Am I missing something?

The Final Phase of Window Shopping ...

[Anonymous Coward]

'cuse me sir, you just bought this purple-metallic minivan with golden rims ... where would you like us to ship it?

Increased Credit Card Theft?

[SharkPork]

So, someone gets a dummy card that looks real and holds that in their hand. but the stolen card is up your sleeve, and activates the electronics. Visual verification by the cashier? sure! Of course the signature looks right, you wrote it! But it seems like it might be a halfway decent technology if they can figure out how to avoid abuse like that. ah well, just my 857,345,246.4 rubles.

Did anyone RTFA?

[jhines0042]

Looks to me like just a speedier way to suck money out of your bank account and charge you for the service to boot!

I don't know about everyone else but I go running scared when I see things like (paraphrased) "...standard method of allowing consumers to purchase content in their home..."

I can see it now.... "please wave your contactless credit card to watch this channel"....

Esso Speedpass Proximity Keychain

[iamstilgar]

Canada already has this. Esso gas stations can issue you a proximity keychain called the "Speedpass" which is linked to a Credit Card account you already have. Wave the thing in front of the pump, gas up, and go.

What Yoda really said

[Anonymous Coward]

"Credit leads to debt.
Debt leads to interest.
Interest leads to...
Depreciation of capital expenditures over the lifetime of the loan."

oh no!

[aap]

The security card I use for work functions while it's still in my wallet. That's not a feature I want for my credit cards.

credit card companies suck

[Deadplant]

this is yet another example of why credit card companies blow goats. Do they have no concept of security?

fucking pathetic. security by insurance is not security at all.

Speedpass is the answer

[sulli]

Very easy to use, trouble free. I've thought for years that this was the future of e-cash - would love to use it in supermarkets.

If theft is a big issue (and putting it on the keychain would mean that you would report it instantly if it's lost), requiring a PIN wouldn't make the experience much worse.

Plus they have those cool Pegasus and Tiger logos that light up when the Speedpass is accepted. Much better user interface than those damn supermarket card readers ("Press OK to approve, yes the GREEN OK button, no, swipe again please...")

Re:It's already out there - at least for truckers.

[archaic0]

With speedpass (and the other toll systems I would have to imagine) your credit card number isn't sent, only an acct number that can be referenced to your charge information on file.

So, one can't capture credit card numbers, but one could capture your acct number and transmit it manually to pay for tolls or gas on your dime.

Re:My 2 yen...quid pro quo

[Networkpro]

Hmm not to sound like I have my own holy grail, but the SIM card in Europe is already used as a contactless form of payment. If you look at alot of vending machines for small items you'll see a phone number you can call :)

Re:My 2 yen...quid pro quo

[DNS-and-BIND]

Yeah, but is it integrated into your cell phone?

Why

[kruczkowski]

Why bother with this?

If it's speed, then why don't you make stores have 24x7 links, or develop a wireless network for moble merchecnts (like hot dog vendors). Verrifiying cerdit cards takes far longer than to pulling it out of your wallet.

Thanks but no thanks

[gone.fishing]

Crooks have creative minds. Some crook somewhere will figure out that they can read the card while it is still in the wallet and then find a way to steal hundreds or thousands of credit card numbers.

I no longer use my credit card number over the telephone. I made a $9.95 purchase from an 800# on a TV ad and ended up being charged $99.95 three months later. In order to get credit for this charge, I had to report the fraud, cancel the credit card and have a new one issued and then contact all of my automated payments and change the card number.

It was a hassle I would rather not go through again. My boss was also hit by credit card thiefs and had a very similar experience. Two women I know had their identity stolen. It is NOT an uncommon crime and it can screw up people's lives pretty badly. I hate to think what would happen if the process were "automated" through the use of hidden electronic readers!

Thanks but no thanks. I like my mag-stripe card.

Some Cards do need to swipe !

[Anonymous Coward]

er not technically true - Visa Electron and Solo need to have an intact magnetic stripe. Terminals will refuse these sales if the card is not present as these are a confirm before sale card the till terminal will always call the bank to ID the card / funds

Anonymous man-in-the middle attack

[rfmobile]

In case someone hasn't already mentioned this:

Here's the idea for making a mess of the contact-less credit card.

1. Person "A" stands close enough to victim's purse or wallet to get a weak RF link with the contact-less CC.
2. Person "A" is also connected (WiFi, cellphone or whatever) to Person "B"
3. Person "B" is standing in the checkout line of everyone's favorite electronics store purchasing stuff using a contact-less CC that has been modified.
4. The modified card passes the data all the way through to person "A" and forward the return data back to the cashier station.

It's like creating a wireless extension chord that extends the cashier station's contact-less card reader's "reach" to well outside the store, down the street, or into the next zipcode.

Ouch.

rick

Stealing Proximity Cards

[JWSmythe]

I read a few articles on "stealing" proximity card data. It's aparently not very hard..

One proximity card that I use requires almost physical contact to the reader, which is appropriate for a doorway.. But another card I use (same building, same card type) to open the garage gate reads the card within about a foot of the reader. I roll my car slowly by, casually holding the card out, and it reads with no contact.

With the appropriate equipment, you can read data from just about anyone's card at a distance. How close do you have to be? People get kinda close in elevators, or you can just be polite, and be holding an outside door for them while they walk by your briefcase/laptop bag/purse. For that matter, I guess your reader could be in the brown paper bag that appears to hold your lunch.

H2K2 had a lecture on it. Here's the lecture description. in July of 2002

"Proximity Cards: How Secure Are They?

Sunday, 6 pm
Area "B"

They're used everywhere but they could be making you even more vulnerable to privacy invasion. Delchi has been working with proximity based card systems for two years and has developed a method of casually extracting data from proximity cards in a public environment. Riding in an elevator, subway, or just walking down the hall, a person can bump into you, say "excuse me," and walk away with the decoded information from the proximity card in your pocket. It could then be possible to build a device that can capture and replay these snippets of information on demand or to even brute force a proximity card system. This talk will focus on the vulnerabilities of the systems and show a low power working prototype. Alternatives will be discussed, as well as other vulnerable aspects of proximity based building and computer access systems."

I've read some design information on it also, but can't seem to find the links right now. I don't know what the options are for protection of proximity cards.. Keep them in a foil pouch?

These aren't the droids we're looking for.

[Anonymous Coward]

These aren't the droids we're lookin for.

First Sploit!

[blair1q]

So then I walked through the mall with my card scanner on and picked up about 15 valid numbers from people I passed.

Wanna go shopping?

regarding signatures

[Anonymous Coward]

I'm a student, took a class with Ed Felten last semester. We talked about credit cards, security, fraud, etc. and realized a few things

1) Signatures aren't really used to check your identity. They are used to dispute claims LATER: the store shows you the signtature on their receipt, you can see if it is yours or not. People are very good at recognizing their own signatures.

2) There is a lot of fraud, but the main issue is cost of fraud vs. cost of prevention. Implementing "secure" credit cards with microchips, forcing stricter requirements on merchants, etc. has a cost. If this cost is greater than that of the fraud, you accept the fraud as a necessary evil.

In the shape of a wand..

[Anonymous Coward]

Why stick with the rectangular plastic card, can we make it into the shape of a Harry Potter wand that I can just wave around at the checkout?

i got a better idea

[ironfroggy]

file format to describe a bill to be paid. this file is transfered to your cell phone, pda, or whatever the hell we'll call them in 5 years. then a thumbprint reader will verify you are you and that you authorize the bill being paid, transfering the payment authorization, signed with your private key, to the bank.

signed, PLEASE ASK FOR ID

[STREMF]

What if your signature actually was "PLEASE ASK FOR ID"?

Re:Contactless? Great!

[weighn]

yay ! Now I can spend money I don't have without even openning my wallet.

Re:It's already out there - at least for truckers.

[Kadin2048]

Correct--and that's why Speedpass is relatively safe. By only transmitting an account number, there is an extra layer of "insulation" between what could possibly get stolen or 'cloned' (the key fob) and your credit card.

If you had contactless credit cards, there would be no such 'insulating' layer--the credit card would have to by definition transmit your credit card number in a usable form.

Visa offers an

[Archfeld]

online PIN function that you can sign up for. The idea that the brick and mortar vendor is going to check your signature vs the one on the back of the card, and the added bonus of a picture is supposed to make it even more secure. Reality is that the merchants rarely even glance at the card, and the most frequently stolen numbers come from resturants....
The problem with an EFT is the vendor HAS your money and you have very little leverage, with a credit transaction they've yet to be payed and you can use VISA as a moderator to deal with vendors who refuse to live up to their word.
In all cases KNOW your transactions and check often (daily)...

Re:Nigger

[Anonymous Coward]

What was your first, honest thought to this post?

I ran across this while meta-modding, and my first reaction was "WTF?". A post with that title seemed very out of place here on /. Then I read the post and thought, "Hmmm ... clever sociological experiment." Then I clicked through to the context (I rarely do that when I meta-mod) and read the other comments. *That* was interesting. Then I posted this response. BTW, if I had mod points, I would have marked it "Off-topic". But I didn't disagree with the Moderator who marked it Flamebait. After all, it certainly drew flames! Please let us know how your experiment turned out, and the reasoning behind this particular experiment. You're welcome.