Slashdot Mirror
Radio Credit Cards Move Closer
pvt_medic writes "CNN.com has an article about research that some major credit card companies (MasterCard and American Express) are putting into creating 'contactless' credit cards. These are similar to the Speedpass that ExxonMobil has been using for six years. What to people think about the prospect of this more widespread use of RFID? Is this something that will only lead to more credit card fraud, or will it provide more secure means of payment?" (The article comes from the Associated Press.)
We have a method of payment that can subtract electronic mone from your account, with no input from you, and without your card ever leaving your wallet? Yeah, thats a great idea....
I still have more fans than freaks. WTF is wrong with you people?
They better be sure their encryption is up to scratch. I was reading just the other day ( I believe it was on Slashdot) that there are supercomputers now that can break 128bit encryption in a matter of minutes.
When anger rises, think of the consequences.
Confucius (551 BC - 479 BC)
This will make charging people to walk past my house much easier. In the past it's been tough for me to collect the $50 that I charge.
I agree. Nothing's more annoying than handing someone $10.15 for a $5.15 bill and watching the other person take out a calculator.
Won't this make it easier to steal someones cc number now. Since all some will have to do is hide a sensor of some type in a mall or someplace that can pick up the radio frequency?
Another reason to sniff the wireless frequencies. You may not be able to get into most cell networks these days, but this will bring all kinds of fun the the quest. Someone will figure out how to hack this inside three months. At least right now I have to match a signature (though nobody checks the card) and my debit card has my picture on it. God knows I won't want to get one of these.
Standing on the shoulders of giants.
I predict a booming market in shielded wallets.
Transport for London's Oyster Card is a contactless ticketing system for the London Underground and London Buses.
At the moment, it can only hold season tickets, so it isn't a great problem if you accidently use it. From next year, you can hold other types of ticket in there as well.
It has some advantages, like being able to recharge it over the phone or online without having to wait for the tickets to arrive through the post.
You can get through the ticket barriers without taking it out your bag, though you have to hold the bag petty close to the sensor.
People don't like it because it allows TFL to trace your travel habits much more than they could before.
In the case of credit cards, I can't see how just holding it close to a sensor could be evidence of your approval of the transaction. You would need some sort of verification process like a signature or a PIN/password.
The idea that the merchant doesn't have to touch the card makes it pretty unlikely that they'll check the id and the signature of the buyer, so this encourages fraud. It should at least require a PIN.
Also, there is no way for the customer to control access to the card. My sister recently picked me up at Kennedy airport, and as she was holding the parking fee money out the window, the attendant charged the fee to her EZpass because he was too lazy to look up. There wasn't enough room on the pass so she got hit with a penalty. He wouldn't even look up from his paper when she complained.
So you'll have to keep your card in a metalic wallet, because the lack of physical contact means you can't really control when it's accessed.
It's interesting that I can build a wand and get someone's information off the license in their pocket. Now you could potentially get their credit card number too.
It may be slightly faster, but beyond that I don't see how it's better for the consumer or the business.
I am always suspicious of any new technology whose benefit isn't readily obvious to its potential market. So the value of RFID cards are that you don't "fumble" as much? That's ridiculous. Most outlets allow the customer to swipe their own credit cards, so what is the difference between holding it in front of a reader and swiping it? I know some idiots can't line up the mag stripe on their card sometimes, but do we really need a whole new technology because of that?
It's obvious where the benefit of this is: surreptitious extraction of information and account data. Sit down on a bench with a reader in it, and all your credit card data was just captured. Walk in the door of an establishment and your RFID cards are scanned and the next day you get junk mail.
I feel the same way about "debit cards". These afford the consumer less protection and security than credit cards (which are protected under the Fair Credit Billing Act of 1976) yet this new gimmick was foisted upon consumers offering more convenience. BS.
No thanks. This is not any technology that benefits consumers from any angle I can see.
Basically, the idea is that if both you and the authenticator know the secret password, but you don't want to transmit it, the authenticator sends you some random chunk of data, say message M. You encrypt it using some (presumably one-way) algorithm, using your password as the encryption key to create W. The authenticator also encrypts the same chunk, and, when you send back your W, compares it do his own known-good W. Assuming they match, it means you have the password. The password itself is never sent plaintext.
You seem to be assuming that there is one secret key for the whole system. This would be completely useless, and is obviously not the case. You would need one secret key per person, as I'm sure American Express knows.
The biggest security issue that I can think of off the top of my head (other than theft or loosing your wallet) is if there are scanners set up that might intercept your credit card information.
So here's a concept. When you make a purchase using the RFID credit card, these steps happen:
1. the cash register sends a HELO type signal
2. the credit card responds and requests an encryption key
3. the cash register randomly generates an asymmetric encryption key valid for that transaction only, and send the 'public' portion of the key to the credit card
4. the credit card encrypts the transaction information using the 'public' key it received and send it to the cash register
5. the cash register uses the 'private' key to decrypt the information and process the transaction.
This way, the only information being transmitted is either encrypted, or a public key which isn't useful in decrypting the information.
The other concern I can think of off the top of my head would be people carrying devices that could fake a transaction -- so a thief would just be walking behind somebody, making a transaction through a device in their pocket, and walk away without a trace. Not sure about this one, though the first step would be high security on the transaction protocol.
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
You know, currently theres a problem with waiters and waitresses and other service industry folk (a few) that take your credit card while you are paying your check and read the card with a pocket reader, storing the info for later for credit card fraud. I can see pick pockets now: You are bumped into while walking, you check to make sure your wallet is there, which it is, but your info has been stolen by a contactless RFID system.
The spec has successfully been used by the German transmit authority to curtail fraud in their system.
It uses challenge-response encryption so it is very resistant to "man in the middle" attacks and snooping. Operates on a near-field magnetic-load method of communication.
This means that the main transmitter senses changes in the energy load as a method communication. The RFID tag just gets its power from the magnetic carrier and changes the magnetic load to communicate. This makes it more difficult to snoop than RF because the energy and communication transfer is bound into a closed loop.
One other point, magnetic load technology has a range that is proportional to the antenna. A 18 centimeter antenna has a range of 18 centimenters if it is built correctly. With a fundamental frequency of 13.56Mhz, the theoretical maximum range is 3 meters (16% of wavelength is the maximum range for the near field). This means that you would need a 3 meter (~10 foot) antenna to reach ten feet. People would tend to notice this.
Just some info.
..are that your credit card number is everywhere. If people want numbers, they will get them. If they get yours - then thats bad luck. All you have to do is keep an eye on your credit card statements and make sure all the charges are yours. If they aren't call the credit card company and tell them. It's easy as pie. I kills me when I see people overly paranoid about thier CC#'s. I mean, comeon...you go to a restraunt and GIVE your waitress or waiter your card to carry across the room away from your eyes and run it through the machine. If they wanted, it wouldnt be hard for them to copy the numbers. Then..up on the net in a flash. Point being...security for this type of thing is nice, but don't let yourself get lazy depending on it. Keep checking those statements!
adventure-today.com
Who says that it has to be that insecure? I envision a little device that goes on a keychain (similar in that respect to SpeedPass), which has a little button on the side of it. You squeeze the button as you pass it over the scanner. Only when the button is squeezed does the transmitter in the device emit anything.
BTW, why are you so paranoid about a contactless credit card? Do you eat at restaurants and pay with a credit card? Chances are, if you do, some potentially sleazy waiter has taken your credit card out of your sight for a few minutes. Not only can he copy your card, chances are that he knows what city you live in and can then get your home (think billing) address out of the phone book. On top of that, he can look at what kind of clothes you wear and car you drive and make a guesstimate about your credit line.
now wears a tinfoil hat.
Ben
Work Safe Porn
Look. Here is what I care about with my credit card:
- If reasonable proof can't be shown that I personally authorized a transaction, I will not be held responsible for it.
That's it. That's all. The line of credit is between me and the issuer... the card is simply a token that represents that. Historically, you had to be there in PERSON to use one.. but everyone looks the other way for convenience, online work, etc.
I don't care what method visa or whoever comes up with to represent that token. If it's less convenient for me, I won't use it. If it somehow rips me off, I won't use it. If it makes me more liable for fraud, I won't use it. If they take all the risks, I don't care if it's a smart card or a credit card or a proximity card.
Now.. that said.. having proximity cards / RFID type cards does bother me.. it seems like a bad move. It doesn't give ME, the customer, anything I really want. So.. it simply won't fly.
I won't have my credit card dictated to me.. its' not about the card, it's about the agreement... and about credit.
The card is usually passive (without an internal battery) and consists of an antenna and an RFID ASIC (Application Specific Integrated Circuit). During operation, the transmitter sends out an electro-magnetic wave to establish a zone of surveillance. When a card enters this zone, the electromagnetic energy from the reader begins to energize the IC in the tag. Once the IC is energized, it goes through an initialization process and begins to broadcast its identity.
So it seems like the cards use induction to get just enough juice from the radio waves to power their internal circuitry. No battery needed.
It is ONE LESS form of identification for someone to have. Instead of having a credit card with your signature and possibly picture on it, now you have a little piece of plastic with some embedded silicon that the sales person doesn't even have to LOOK at to verify you.
How is having some bits in a RFID chip any stronger security-wise than having bits on a magnetic stripe?
There is no consumer benefit to this. The only one who benefits is the company making the sale because it makes things easier to buy. That's just what we need. As if things werent' easy enough to buy already.
The only POSSIBLE benefit I can see to this for a consumer is it sounds more durable; no stripe to get worn down.
-- Having a Creationist Museum is like having an Atheist place of worship
Why can't we just put a button on the little RFID dongle you would put on your keychain? Answer: we can. And this is what the CC companies should do. I know, speedpass doesn't implement it. But it would be very, very simple to do and go a long way toward easing my fears about this. I'm envisioning something similar to a Photon light.
Even better, why not pair it with an always-on RFID in your wallet, and only allow transactions when both are present? This'd prevent simple theft by valets, pursesnatchers, etc.
...but this is slashdot, after all.
However, the thief would have to get quite close to his target or have a very sensitive reader.
Hmmm. Build a powerful RFID reader and walk through a large crowd of people collecting RFID numbers. Warwalking!
Also, the account number on the contactless cards is useful only in the RFID system -- it's not the same as a user's credit card number. A crook would thus not be able to use the card number to go on a fraudulent Internet shopping spree, for example.
But you could use it in person - build a RFID transmitter. After, the key fob never has to leave your pocket - how does the clerk know if it's real or the PDA-sized RIFD cloner in your pocket.
American Express makes the RFID reader verify the card's authenticity with a "challenge-response" exchange that depends on 128-bit encryption encoded on the chip. That strength of encryption is considered safe against "brute force" attacks, in which a hacker tries every possible combination.
It's good to know that some people have a clue in designing a secure system.
MasterCard says it uses a different security system but would not provide specifics.
I'll reserve judgment.