Slashdot Mirror
The Universal Card
retro128 writes "Wired News is carrying a story about a new product from Chameleon Network that's supposed to replace all of your credit/debit/customer cards. It can read the information off of the magnetic strips of credit/debit cards, scan the barcode off of customer loyalty cards, and even memorize the RFID signals of devices like the Mobil SpeedPass. All of this information is stored in a device called the Pocket Vault, and is unlocked with the user's fingerprint. If you wish to use a magnetic strip card, you select the card from the touch screen and put a Chameleon card, which looks like and can be run in standard readers like a credit card, in the Pocket Vault. The Chameleon card will then assume the identity of the card you selected, but only for 10 minutes. In this way, if the card is lost or stolen, nobody can use it. In the case of RFID, you just hold the Pocket Vault up to the RFID scanner for a reading. For barcode-based cards, the barcode will appear on the screen and can be scanned by a standard barcode reader. Chameleon Network says this technology will be available in early 2005 and is expected to cost under $200."
200 bucks for you to know everything about me?
How about YOU pay ME.
I have been pwned because my
This just seems too complicated. I enjoy the simplicity of looking in my wallet, and having only a glance of the card I want, pull it out and use it, no need to select any menus or buttons on it, just pull it out, insert, replace.
Help Brendan pay off his student loans
Any company that has a hyperlink marked "Investor Information" above-the-fold (shown without a need to scroll down on a typical 800x600 setup) is automatically a bit suspect.
I fear that Slashdot's logo is now going to get added to their brag-about-press-coverage page. For the record, the "Boston's WB in the Morning" program they brag about was canceled in 2002.
I'm not suggesting that this company's technology doesn't exist, but their product is pure vaporware and they have lists of good reasons why a merchant, bank, or large company should partner with them, but they can't name any merchant, bank, or large companies who have agreed to partner with them. At least they have a patent appilcation pending.
So I can grab any card I get my hands on for even a second (as a waiter or working at a gas station for example), run it through this toy and it saves the mag strip info to its internal memory. After getting several hundred (or when I max out the devices memory) I and my friends can then go on a HUGE shopping spree using stolen credit cards. Conveniently, as soon as I think the credit card companies might realize the first number is being used by an unauthorized person, I just switch to the next one. Sign me up! *sigh*
It's not quite clear if Visa or Mastercard will allow its member stores to accept Chameleon Cards in place of real plastic cards. Afterall, that card won't be able to mimic the Visa or MS holigram, the color-printed signature strip with code number on it, or the physical impression of the card numbers.
Accepting non-original cards opens up the risk of accepting any card with a magnetic stripe as being a stand-in for the real credit card. It would effectively turn all in-person credit card transaction to being as insecure as a web transaction. There's a reason why web merchants have to pay more for their credit card services, and it's that insecurity.
So, it's near certian that Visa and Mastercard accepting stores will be ordered by the card networks not to accept Chameleon Cards from customers. Game over for this technology... it works in the lab but won't work in the real world.
I don't know about you, but I'd much rather have it use a password. I think most people would happily give a sufficiently threatening criminal their 4 digit PIN number (or any style of password) without too much of a fuss, but I'd rather avoid giving anyone any incentive whatsoever to leave me short one digit. It would be a very small consolation to cancel my credit cards after such an incident.
Tm
Support TBI Research: http://www.raisinhope.org
Let me list the reasons why
1) Cumbersome
2) Breakable
3) All eggs in one basket
4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?
5) What do you do when the batteries run out
6) What happens when the OS crashes and the information is wiped out?
So many reasons...
This is without a doubt the best thieves's tool!
... ) card, and pasting it on a cardboard card, and write your name and number up on the front. And then TRY to use it in any shop. I am sure they'll just ask for some other card.
The only thing that could be done to prevent this is to make it hold only a small number of each type of card. Like only 10 Credit Cards. Still, its pretty much simplyfies the "printing" of stolen cards.
OTOH, i wonder if this will ever work. CC companies must back this up to work, i mean try taking the mag strip off your AmEx (or visa, or
Not only that ... the stolen card database would be encrypted and protected by his own fingerprint should he ever be caught.
Making him decode the cards would be akin to making him testify against himself, hence making it unadmissible in court.
Plus he could always claim (farfetched, yes, but possible) that it was all some kind of equipment glitch or Chamaleon card mixup in a bar or something along these lines
I think it would be much easier to start with a simpler problem: digital cash. I would love to have a card that can hold up to about $100 that is anonymous and which I could use for bus fare, parking meters, road tolls, or small purchases like meals. This would be a natural for on-line purchases of paid content (iTunes, archived news stories).
By being anonymous, my privacy would be protected (at least in theory). It would also be completely unconnected to my credit cards and bank accounts, so it could never be used to steal more than $100 from me.
This is not a trivial problem -- it has some of the same problems as voting (anonymity & non-repudiation).
I think this is already being done in Europe. If only the US would catch up.
- It's expensive. Too expensive for a trinket that might be lost/damaged in everyday life. Credit card lost? No biggie - you just cancel it, request new one. At worst you pay few bucks fee for replacement card.
:) - logos and all. And if you expect chameleon cards to be allowed to display those logos, think again. Not to mention that a chameleon card would either have to display gazillion different logos (fishy, wouldn't pass in most stores without tons of education and approval of credit card companies), or you'd need a custom card for every card you have - in which case the whole toy is useless.
- Lose this trinket, and you just gave *every damn card/id thingy ya had* to a thief. Yeah yeah its fingerprint keyed. So what? The data is inside and everything is ultimately hackable.
- It can obiviously be used to swipe magnetic strip data off other people's cards you may be able to handle. As a bonus if it can 'dupe' smartcards, Visa & co wont be happy - they just spent gazillions in moving every (insecure) magnetic card to ones with chip inside. I think their timetable is something like by end of 2005 every Visa card is a smartcard. I'd expect credit card companies to sue the pants off this company for unauthorized reverse engineering of their security features against duplication in the cards. DMCA will be used to pwn these guys. (And if it does *not* dupe smartcards, it will be useless in couple of years when every card becomes one)
- Big credit card companies will just tell to the retailers not to accept anything except Genunie Visa(r) Card(tm)
- Huge hassles with most clerks refusing the cards 'swiped on' with this trinket even without guidance from credit card companies - "that's not a visa card, are you trying to fool me with some thieves tool with copied card data?". The education required to train every damn minimum wage clerk in the world to identify and accept this thingy in place of a real card would be astronomical - EVEN if the card companies would go along with it.
Dot.com boom coming back? This company is beyond loony to even attempt to develop something this stupid.
The Benefit of this thing is essentially that, lacking your fingerprint(the value of biometrics can be discussed elsewhere), it cannot be used
But that's the complete opposite of the truth. It needs the fingerprint of whoever owns the vault, not whoever owns the original credit card. This scheme simply means that if I DO get access to your credit card briefly that I may also have a cheap consumer device, that I don't need to be coy about using, that allows me to easily copy your card. Instead of walking round with a pocket full of stolen cards I have a single vault that nobody else can access.
Any "security" features of the original card are rendered irrelevant because of course I do have a completely valid chameleon card.
Signature confirmation goes completely out because either there is no signature on the chameleon card or, again, it's the signature of whoever owns the chameleon card not whoever owns the original.
To try to spin this as giving added security to owners of genuine cards is absurd.
Hell, just make it a free government service
Free? Free to who? There are no such thing as "free" government services. They cost tax $. My tax $. Maybe I don't want to pay for your personal convenience. Maybe the guy next door doesn't care to pay for it either.
"An unarmed man can only flee from evil, and evil is not overcome by fleeing from it." Col. Jeff Cooper
This is the real problem. These guys sound like they have done a great job of protecting the consumer. In the process they have completely ignored the fact that they have created a method of forging credit cards that requires no expertise or special tools.
I think it will not be very long before the card associations tell their merchants that they must not accept these cards.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Yeah, that's the obvious problem. Who's to say that the information in the card database is for your credit card? Couldn't it be anyone's credit card?
Credit card companies have taken steps to link the physical card to the bearer - putting your photo on the credit card, printing on the card that merchants should request ID confirmation, etc. This completely sidesteps those mechanisms.
In short,this is the perfect tool for credit card theft. Work at a diner for a month, and scan every customer's credit card into your Chameleon. You can then take a great free vacation to another state and pay for every expense on a different credit card.
It took me about 14 seconds to realize this. And yet, some company spent $beeleeons developing it - probably relying on the old "we can paper over the problem with marketing hype" tactic/fallacy. Any chance the Chameleon is made by Diebold?
- David Stein
Computer over. Virus = very yes.
One obvious solution (which admittedly isn't mentioned in the article, and thus shouldn't be assumed to be true) is that the device could/may refuse to hold cards for more than one name.
The average person (i.e. almost everyone) has precisely zero reason to carry someone else's credit card (and if they had them, many stores wouldn't accept one that wasn't yours since they're not supposed to do so). This device may simply make the valid assumption that all of your cards should have the same name (which is stored magnetically in the card, if I'm not mistaken).
This would, at least, prevent stealing more than one person's card.
"Stumble before you crawl"