The Universal Card

retro128 writes "Wired News is carrying a story about a new product from Chameleon Network that's supposed to replace all of your credit/debit/customer cards. It can read the information off of the magnetic strips of credit/debit cards, scan the barcode off of customer loyalty cards, and even memorize the RFID signals of devices like the Mobil SpeedPass. All of this information is stored in a device called the Pocket Vault, and is unlocked with the user's fingerprint. If you wish to use a magnetic strip card, you select the card from the touch screen and put a Chameleon card, which looks like and can be run in standard readers like a credit card, in the Pocket Vault. The Chameleon card will then assume the identity of the card you selected, but only for 10 minutes. In this way, if the card is lost or stolen, nobody can use it. In the case of RFID, you just hold the Pocket Vault up to the RFID scanner for a reading. For barcode-based cards, the barcode will appear on the screen and can be scanned by a standard barcode reader. Chameleon Network says this technology will be available in early 2005 and is expected to cost under $200."

Comments

Yes but what about bluetooth?

[eddie can read]

Seriously, seems cumbersome and delicate. Can I sit on one of these? You don't want me sitting on your lap (for various reasons) but my credit cards can handle it.

Re:Yes but what about bluetooth?

[Anonymous Coward]

all your cards are belong to us?

Re:Yes but what about bluetooth?

[sjwt]

no,
all your cards are belonging to others..

1) Steal/borrow wallet
2) Copy cards
3) ???
4) profit

but im sure theres a way to stop it reading
in someone else credit card details..

Re:Yes but what about bluetooth?

[dnoyeb]

Also seems like BS. You are not going to read an encrypted speed pass. I am assuming its encrypted like other RFID tech I have worked with.

I this case you require the cooperation of the card producer. Just like HomeLink universal garage door opener has cooperated so we get UGDO. But car alarm companies and car manufacturers have not so we do not have universal keyFobs.

I am more confortable with distribution/decentralization of my money access tools. This is why I dont use .NET universal login feature. though admittidly I tend to use the same id and pwd in most places...I have a spreadsheet full of ids and pwds I keep on my linux box.

Re:Yes but what about bluetooth?

[tambo]

all your cards are belong to us?

Yeah, that's the obvious problem. Who's to say that the information in the card database is for your credit card? Couldn't it be anyone's credit card?

Credit card companies have taken steps to link the physical card to the bearer - putting your photo on the credit card, printing on the card that merchants should request ID confirmation, etc. This completely sidesteps those mechanisms.

In short,this is the perfect tool for credit card theft. Work at a diner for a month, and scan every customer's credit card into your Chameleon. You can then take a great free vacation to another state and pay for every expense on a different credit card.

It took me about 14 seconds to realize this. And yet, some company spent $beeleeons developing it - probably relying on the old "we can paper over the problem with marketing hype" tactic/fallacy. Any chance the Chameleon is made by Diebold?

- David Stein

Re:Yes but what about bluetooth?

[The Only Druid]

One obvious solution (which admittedly isn't mentioned in the article, and thus shouldn't be assumed to be true) is that the device could/may refuse to hold cards for more than one name.

The average person (i.e. almost everyone) has precisely zero reason to carry someone else's credit card (and if they had them, many stores wouldn't accept one that wasn't yours since they're not supposed to do so). This device may simply make the valid assumption that all of your cards should have the same name (which is stored magnetically in the card, if I'm not mistaken).

This would, at least, prevent stealing more than one person's card.

Re:Yes but what about bluetooth?

[tambo]

One obvious solution (which admittedly isn't mentioned in the article, and thus shouldn't be assumed to be true) is that the device could/may refuse to hold cards for more than one name.

But everyone has to trust the device to enforce that restriction. A hack for this device, or a copycat device, would exploit that trust quite easily.

- David Stein

Re:Yes but what about bluetooth?

[malachid69]

I contacted them with some questions. Here is their replies:

*****

Dear Malachi,

Three-digit credit card security codes will appear on the Pocket Vault screen when you press the "card details" icon. For any card that is currently "issued" or active on the Chameleon Card, the Pocket Vault will then display the security pin and available credit and card balance at the last time the device was updated.

Todd O. Burger
President & CEO
Chameleon Network Inc.
30 Monument Square, Suite 300
Concord, MA 01742
TBurger@ChameleonNetwork.com

W (978) 287-0703
F (978) 369-4661
H (781) 863-1196
M (781) 820-2521

*****

Dear Malachi,

Credit and debit cards can only be loaded to a person's Pocket Vault while the Pocket Vault is docked to a PC or Mac and the legitimate owner of the Pocket Vault has established a secure Internet session.
(The computer and the Pocket Vault actually establish dual secure sessions in parallel on a standard dial-up or better Internet connection with the Pocket Vault website or the website of an authorized Pocket Vault dealer (for example, a major credit card issuing bank). The security and simplicity of our loading process are two of the elements that impressed card industry executives. The complexity is not visible to the consumer and the number of steps the consumer actually takes are few.

The Chameleon Card does have a conventional signature block on its back. Most security experts would acknowledge that the usefulness of the signature is no better than the skill of the average retail clerk who must perform on the spot handwriting analysis by "confirming" that the signature on the card matches the signature on the receipt or the signature entered on the pad at the cash register. Despite the limited value of such verification, we do not alter this verification element. Of course, we think the other security elements that essentially verify that you are the legitimate owner and user of the Pocket Vault represent the real substantive security, and that retailers will eventually come to a similar conclusion, tending to ignore the signature block on Chameleon Cards.

There are two types of places that take imprints: Those that do it as another security tool on top of magnetic-swipe capture of the account number, and those that are completely off-line (e.g., a taxi or flea market merchant.) Those that do it for additional security will no longer need to do this with chameleon Cards. For truly off-line merchants, (about 2% of total credit card transactions or less), the merchant will record the card number by looking at the screen of the Pocket Vault and writing this by hand on the slip. Since worn cards often leave illegible imprints that require the retailer to re-write the number anyway, there is not a great deal of difference here.

The Pocket Vault can store a license type photo (and family and pet photos as well) and associate that photo with any photo ID. The photo displays on the Pocket Vault screen while a photo ID type card is issued.

Please feel free to post this information. You are one of many that has asked such questions, and we are unable to answer all of them. We hope the flood of orders we are seeing (and hope to continue to see) convince card industry executives that we have something here of broad interest to consumers, which could accelerate our efforts.

Thank you for your interest in our product and services.

Todd O. Burger
President & CEO
Chameleon Network Inc.
30 Monument Square, Suite 300
Concord, MA 01742
TBurger@ChameleonNetwork.com

W (978) 287-0703
F (978) 369-4661
H (781) 863-1196

Re:Yes but what about bluetooth?

[malachid69]

Another response from some questions I asked.

*****
License and Other Photro IDs
If we have an agreement in place with the AAMVA (American Association of Motor Vehicle Administrators) or the individual state MVD, it will be the official license image. Otherwise, it will be your photo associated with a Driver's License number. In about 15 states, the license is simply a tool to use in a police cruiser to check the state license database to see if the license is current and in good standing. In those states, a Chameleon Card may be accepted sooner than it is elsewhere.

Fees
There are no fees for use of the card and we do not take any percentage of a transaction (in fact while our Chameleon Card may be used in a transaction, we would be unaware that such a transaction ever took place). Depending on what services a consumer opts in for, there could be monthly charges for the use of the Pocket Vault (updating, backup, promotions and discounts, etc.). If the consumer does not opt in, there will be no further charges.

Loading Non-financial Cards
You will be able to load any card with a magnetic stripe, bar code, smart card chip or typed information card, most photo ID cards, and many (though not all) RFID cards (e.g., contactless cards for parking garages and building access). In some states, you will be able to load your driver's license, in others, we will need to establish a relationship with the Dept. of Motor Vehicles to enable this feature.

Todd O. Burger
President & CEO

Chameleon Network Inc.
30 Monument Square, Suite 300
Concord, MA 01742-1858

Main 978-287-0800
Fax: 978-369-4661

Email: TBurger@ChameleonNetwork.com
www.ChameleonNetwork .com

You want me to pay for that?

[ObviousGuy]

200 bucks for you to know everything about me?

How about YOU pay ME.

Re:You want me to pay for that?

[Turgon33]

yeah, just what i need. one single device that can decide to call 'home' with all of my purchasing habits on it.

Re:You want me to pay for that?

[Anonymous Coward]

RTFA - It stores all of the information locally. The only one that knows everything about you is you.

My vote: the current system

[DaHat]

This just seems too complicated. I enjoy the simplicity of looking in my wallet, and having only a glance of the card I want, pull it out and use it, no need to select any menus or buttons on it, just pull it out, insert, replace.

Warning: Vaporware Company Detected

[LostCluster]

Any company that has a hyperlink marked "Investor Information" above-the-fold (shown without a need to scroll down on a typical 800x600 setup) is automatically a bit suspect.

I fear that Slashdot's logo is now going to get added to their brag-about-press-coverage page. For the record, the "Boston's WB in the Morning" program they brag about was canceled in 2002.

I'm not suggesting that this company's technology doesn't exist, but their product is pure vaporware and they have lists of good reasons why a merchant, bank, or large company should partner with them, but they can't name any merchant, bank, or large companies who have agreed to partner with them. At least they have a patent appilcation pending.

Re:Warning: Vaporware Company Detected

[joshmoh]

I agree. Even if it isn't vaporware, this sounds like a "Hey, let's get-rich-quick with our hot cool idea" company. Their order form raises a big red flag:

For a total of 50% discount, will you pay in advance?

I will not buy into your scam.
I will not buy it, Sam I am.

Re:Warning: Vaporware Company Detected

[FearTheFrail]

So does this mean I should scale back the work on my planned competing product, the "Carte Blanche?"

On a more serious note, how much of a far-fetched idea did universal remotes appear to be when they were first being developed? While they can be a little bit cumbersome when switching between multiple devices (for those of us who still rig our cable between the VCR, satellite dish, microwave, Bose wave radio, ham radio, heat pump and Tesla coil), it still seems to be generally less hassle than having to switch between remotes to find the appropriate one(s) to use.

Of course, the likelihood of needing multiple cards at one location would be rare, but could this be just the first shot at a product that's bound to come to us eventually, anyway?

Re:Warning: Vaporware Company Detected

[C10H14N2]

...it will not be implemented because it would be far to easy to use the little bugger as a swipe-and-steal device. Even if the things were ever actually manufactured and sold, I imagine 99.99999% of vendors would not honor them. I sure as hell wouldn't. Besides, they've been circulating this idea for YEARS and they have yet to get beyond the gee-whiz idea stage.

Re:Warning: Vaporware Company Detected

[Kris_J]

It's also stupidware. I might have enough IR remotes for it to be worth me investing in a universal remote, but I do not have enough cards in my wallet to equal the bulk of a unit like this. And with a ten minute TTL, you've got to carry it everywhere.

Meanwhile, I've got a bunch of Swatch Access watches with contactless smartcards built-in. Why can't we upgrade to something like this instead?

Great idea....for thieves!

[Damiano]

So I can grab any card I get my hands on for even a second (as a waiter or working at a gas station for example), run it through this toy and it saves the mag strip info to its internal memory. After getting several hundred (or when I max out the devices memory) I and my friends can then go on a HUGE shopping spree using stolen credit cards. Conveniently, as soon as I think the credit card companies might realize the first number is being used by an unauthorized person, I just switch to the next one. Sign me up! *sigh*

Re:Great idea....for thieves!

[Genda]

I'm not as frightened about misuse with credit or debit cards (since those have a fair variety of built-in security.) I'm much more concerned with the ability to scan somebody's card key and enter virtually any building that uses an RFID card key system.

This is going to be the kind of tool that buglars stay up all night praying for!

Genda

potentially inconvenient

[sjalex]

This sounded cool to me for a few seconds until I thought, what happens when the cashier at the quick-n-go tries to verify your credit card against your license? Stephen

Re:potentially inconvenient

[osmodion]

You just show them the icon for your driver's license and go on your merry way.

Gimmie your wallet!

[mikeophile]

and your thumb!

Re:Gimmie your wallet!

[Phurd Phlegm]

and your thumb!

I see the parent is modded as "funny," but this is actually a realistic threat. If someone steals my current batch of credit cards, all they need to do is forge my signature, or maybe not even that. No real inducement to harm me, and actually an inducement to keep me from even knowing a theft took place. Now there's a bonus for taking my thumb.

My suggestion: use your little finger. Then either you'll be able to convince them that they should take the less valuable digit, or if they're real Dr. Doom types, they'll mistrust you enough to just take both entire hands. D'oh!

Secondary suggestion: use a toe. This will also put a lid on those impulse buys that have been blowing your budget, since it takes more effort to take off your shoe during a purchase....

A card is more than just a magnetic strip...

[LostCluster]

It's not quite clear if Visa or Mastercard will allow its member stores to accept Chameleon Cards in place of real plastic cards. Afterall, that card won't be able to mimic the Visa or MS holigram, the color-printed signature strip with code number on it, or the physical impression of the card numbers.

Accepting non-original cards opens up the risk of accepting any card with a magnetic stripe as being a stand-in for the real credit card. It would effectively turn all in-person credit card transaction to being as insecure as a web transaction. There's a reason why web merchants have to pay more for their credit card services, and it's that insecurity.

So, it's near certian that Visa and Mastercard accepting stores will be ordered by the card networks not to accept Chameleon Cards from customers. Game over for this technology... it works in the lab but won't work in the real world.

Re:A card is more than just a magnetic strip...

[dj245]

Its been my experience that merchants give a crap what your card looks like as long as it scans the first or second time and doesn't create problems for them. My personal card has a hole drilled in it (to facilitate key-chaining), the hologram is worn off. The 3-digit security number on the back is also unreadable (memorized). A good chunk of the Mag stripe is worn to the bare plastic and its actually plastic-white. Merchants couldn't care less. They need it to scan, and little less.

If nothing else, credit cards are remarkably resiliant to damage.

Re:A card is more than just a magnetic strip...

[LostCluster]

If the machine doesn't prompt for the attendant to veryify the physical presense of the orignal card, then the card transaction slips from a card-present transaction to a card-not-present transaction, and a higher fee is due to the credit card issuers or the store has to eat the higher risk of fraud.

A debit card transaction can get by with just the pin and no physical verification... but that also means an even higher merchant fee. This is why Wal-Mart is no longer accepting MasterCard debit cards as debit cards when the card is capable of supporting a credit card transaction, because that's what's cheaper for the store to do.

Re:A card is more than just a magnetic strip...

[LostCluster]

That's not about the fee, that's for two other reasons:

1: Stores get the money credited for debit transactions immediately. They have to wait for credit card payments. That float is meaningful.
2: A credit card transaction is a lot easier to reverse... simply complain to the credit card company. Even if the complaint is invalid, the store's payment for the transaction is held in escrow until that is declared. (Reversed-by-complaint credit card transactions also carry steep penalty fees on the merchant side... the card issuing bank has to eat all fraudulently presented card cases.)

So, for $3 transactions, the debit card is better than the credit card mode because the store is just willing to eat the loss if the transaction goes fraudulent. For $300 transactions, not so much. Trust me, there's a dollar value somewhere at which point the default behavior will spin around... and you as a consumer never will want to use a debit card so long as you have a credit card in your wallet somewhere that can take the hit without incuring intrest.

Re:A card is more than just a magnetic strip...

[Anonymous Coward]

I am always _very_ surprised to hear, you american people, describe their credit card system.

It sounds like middle-age era to the europeans.

For more than ten years now, we have anbandonned the use of the magnetic tape (not to speak of imprinting...).

Every credit card is equipped with a chip, is protected by a password (a four-digit code) that has to be typed on the card-reader for _anything_ you buy. And if the price is higher than some limit (say $100), the system contacts your bank.
No signature is ever used.
If you want to steal a card, you have to ask for the code (still better than to be asked for your thumb, btw).

It is difficult to copy a card. You cannot simply read it and make a copy. There have been some breach in the past, they have been somewhat fixed afterwards. They have remained small in their extend, and the bank had to cover any subsequent loss themselves (by law). It would be possible to do something even better, but apparently, the costs of upgrading the system are higher than those induced by fraud.

I guess it is the same issue that makes you keep your aging system.

Re:A card is more than just a magnetic strip...

[LostCluster]

Yes, but when a physical transaction goes fraudlent, the store is to blame for being fooled, and therefore the store eats the loss. When a non-physical transaction goes frauduent, the credit card companies have to eat it.

Re:A card is more than just a magnetic strip...

[Electrum]

When a non-physical transaction goes frauduent, the credit card companies have to eat it.

Where did you get that idea? The merchant always loses, not the bank. The bank is more than happy to reverse the transaction and collect their chargeback fee.

Re:A card is more than just a magnetic strip...

[Jonah Hex]

I am always _very_ surprised to hear, you american people, describe their credit card system. It sounds like middle-age era to the europeans

I think it's probably due to the different economic and social pressures involved, the strongest being the fact that most US card producing companies are mostly of the large, monolithic type. I've been in an actual room where First Chicago - National Bank of Detroit produces CC's, and not only is the entire Haggerty Road Tech Center building under tight security but the CC creation room itself has several additional layers of security that would be more at home in a maximum security prison; all protecting it and all those rolls of magnetic tape, holograms, cars, and of course the weird "loom and stamp" machine that winds it all together. Speaking as a computer geek not as a security expert, I'd guess the security on the CC room was 10X greater than for their large mainframe computer area. I'd say that tells much about how the large financial institutions view CCs.

I also want to touch on the social aspect, as you can see by a few posts thru this topic many folks are very much against the idea of combining all their cards into an all-in-one, and I will bet that most of them are from the US as I am. We are all trained into considering our cards much the same way the banks do, as well as having the added social pressures of both: freedom from privacy violations by biz and government (real, imagined, or socially engineered by some faction), and the "group trends & fads/social network/urban legend" aspect which plays such a large part (along with advertising/entertainment) in how the American people live.

While I'm mildly aware of the one card situation over in the EU, and also both one card and replacing cards with cell phones over in Japan, it seems like there are probably the same factors at play in both those situations, only in altered ways due to CCs being introduced at different times and ways in the different areas. Often times being the first country to implement an idea or proccess is not necessarily the best way for innovation to occur, especially where a large amount of infrastructure and/or business processes are put into place to support the early versions. Countries that implement such ideas later have the luxury of buying into second, third or even higher generations of the tech, which may very well be an almost totally new system such as comparing the US's credit cards with the EU chip card and the Japan cellphone "card". However having such widely varied systems in place in geographically seperated areas will give future innovations in this industry a chance to select the best aspects from three real-world viable and operating systems. I'll take a stab in the dark here and say this also might help keep the "keepers of the cards" from becoming a monopoly.

Jonah Hex

Re:A card is more than just a magnetic strip...

[Dave2 Wickham]

I take it you aren't including people who live in the UK as Europeans (signatures used, along with magnetic stripes).

completely compatible?

[way2trivial]

what if you want to imprint the card?

or verify a signature?
not too good..

Big Ouch at the ATM

[breakinbearx]

One has to wonder... what happens if the ATM eats your card? Then again, if the ATM is likely to eat your card, you probably don't have the cash for this gadget anyways.

give up one digit or four?

[Daniel Quinlan]

and is unlocked with the user's fingerprint

I don't know about you, but I'd much rather have it use a password. I think most people would happily give a sufficiently threatening criminal their 4 digit PIN number (or any style of password) without too much of a fuss, but I'd rather avoid giving anyone any incentive whatsoever to leave me short one digit. It would be a very small consolation to cancel my credit cards after such an incident.

Been done (errr, thought of)

[irokitt]

That's right, this is the card that Ford Prefect swipes from his new Editor so he can hack into the basement computers with the help of his pet robot and....

This just in, new tool for ID Theft just released!

[Tmack]

To me this just screams Identity theft. All a clerk has to do is have one of these in their pockets and swipe customer's cards to get a copy of it. No more need to cash it out on the spot (as with carrying around a second whole credit card scanner), they can use it anywhere they want, and have it report their name on the peice of plastic. And by capturing rfid tags? Doesnt that beat the "security" Speedpass and others like it are supposed to have built in? This thing doesnt seem to check whos card its scanning in, just asks for a finger print. This is essentially a credit-card coppier thats pocket sized. Sure its a little secure against itself being stolen and used by ID theifs, but what about ID thiefs using it against other consumers?

Tm

Stacks of Credit Cards?

[wideBlueSkies]

I don't know about other folks, but I've got 3 credit cards, a NYC Metro Card(transit fares), an Employee IS and a drivers license in my wallet.

I wouldn't call that a stack and it's manageable. Never even though of this as being a problem before reading the article.

If someone were to use this gadget, they'd have the 'stack' of cards, AND the gadget to worry about. Right?

Sounds like a waste to me.... Nothing to see here, move along please.

wbs.

ATM?

[cybermint]

How am I going to stick that thing into an ATM?

The Ident-i-Eeze!!

[tylernt]

It wasn't insanely exciting to look at. It was rather dull in fact. It was smaller and a little thicker than a credit card and semi-transparent. If you held it up to the light you could see a lot of holographically encoded information and images buried pseudo-inches deep beneath its surface.

It was an Ident-i-Eeze, and was a very naughty and silly thing for Harl to have lying around in his wallet, though it was perfectly understandable. There were so many different ways in which you were required to provide absolute proof of your identity these days that life could easily become extremely tiresome just from that factor alone, never mind the deeper existential problems of trying to function as a coherent consciousness in an epistemologically ambiguous physical universe. Just look at cash point machines, for instance. Queues of people standing around waiting to have their fingerprints read, their retinas scanned, bits of skin scraped from the nape of the neck and undergoing instant (or nearly instant-a good six or seven seconds in tedious reality) genetic analysis, then having to answer trick questions about members of their family they didn't even remember they had, and about their recorded preferences for tablecloth colours. And that was just to get a bit of spare cash for the weekend. If you were trying to raise a loan for a jetcar, sign a missile treaty or pay an entire restaurant bill things could get really trying.

Hence the Ident-i-Eeze. This encoded every single piece of information about you, your body and your life into one all-purpose machine-readable card that you could then carry around in your wallet, and therefore represented technology's greatest triumph to date over both itself and plain common sense.

Ford pocketed it.

Wow, how convenient.

[the_skywise]

Instead of stealing one or two cards (since I don't carry all my credit cards with me at one time)
A thief can now just steal my vault and get access to not only my credit cards, but get discounts at my grocery store!

I gotta go with the last line... It sounds cool, but it's just more hassle to actually use come purchase time.
"Honey, this was a lovely dinner of sushi, are you sure this isn't too expensive"
"No problem, I'm just going to pay with my pocket vault... and...uh"
"What's wrong?"
"I've got soy sauce on the fingerprint scanner and now it won't authenticate me and give me my credit card!"
"Don't you have cash?"
"I don't use cash because I have the pocket vault! AUUGGGHH THE BATTERY WENT DEAD!"

Did you read the parent post?

[Anonymous Coward]

He wasn't saying it would be easy for thieves to steal the universal cards themselves; it would be easy to actually store stolen cards (be it credit cards, debit cards... whatever) into memory very easily and efficiently! He makes an excellent point and I think it's rather scary. A thief would only need the card for a second, and they would have card in their little database.

Re:Did you read the parent post?

[Tensor]

Not only that ... the stolen card database would be encrypted and protected by his own fingerprint should he ever be caught.

Making him decode the cards would be akin to making him testify against himself, hence making it unadmissible in court.

Plus he could always claim (farfetched, yes, but possible) that it was all some kind of equipment glitch or Chamaleon card mixup in a bar or something along these lines

Re:Did you read the parent post?

[qqtortqq]

Making him decode the cards has nothing to do with him testifying against himself. If a judge sees probable cause to believe there is evidence stored on the device, he can issue a search warrant requiring the criminal to give access to the device. Its just like taking a breathalyzer or getting a blood test to determine if you have been drinking and driving, you aren't testifying against yourself, but rather being compelled to assist in providing evidence, even if the evidence is being used against you.

Re:Did you read the parent post?

[Kierthos]

Er, no. I mean, fingerprints are routinely used as evidence in court cases. Just because one is needed to decode these silly things does not mean that it would, all of a sudden, become inadmissable. And, you know, they do take your fingerprints when they arrest you.

Furthermore, even assuming you had some wierd judge who bought that claim, do you honestly think the company that makes these gadgets wouldn't have some back-door into their own system that would allow them to retrieve information if necessary?

And, odds are, they'd want to help the cops because any continued risk on stolen cards makes their little gizmo look bad.

Kierthos

Credit cards are free, why pay $200?

[eddie can read]

Let me list the reasons why

1) Cumbersome

2) Breakable

3) All eggs in one basket

4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?

5) What do you do when the batteries run out

6) What happens when the OS crashes and the information is wiped out?

So many reasons...

Re:Credit cards are free, why pay $200?

[pboulang]

1) Cumbersome

Picture shows that it fits in a wallet

2) Breakable

You can always use your real credit cards. What if a palm pilot breaks? You write things down on paper. . .

3) All eggs in one basket

Agree with this.. would rather not have everything linked in one breakable / trackable / hackable system.

4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?

You spill pasta sauce on your sweater, you buy a new one and are much more careful if it is expensive.

5) What do you do when the batteries run out

Considering the plethora or small handheld devices out there, why is this one so much harder to track charge for?

6) What happens when the OS crashes and the information is wiped out?

Well, you reload the data from either the credit cards again or the backup that was made

Re:Credit cards are free, why pay $200?

[LostCluster]

1) Cumbersome
Picture shows that it fits in a wallet
Picture is clearly photoshopped. The real consumer product has yet to ship.

2) Breakable
You can always use your real credit cards. What if a palm pilot breaks? You write things down on paper. . .
That's nice, but you're still out the $200 device.

3) All eggs in one basket
Agree with this.. would rather not have everything linked in one breakable / trackable / hackable system.
Good, so there's no risk of you wasting $200 on this.

4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?
You spill pasta sauce on your sweater, you buy a new one and are much more careful if it is expensive.
My solution is to not wear $200 shirts very often, and definitely not to eat pasta while doing so. A $200 device had better be durable if it's going to live in my pocket.

5) What do you do when the batteries run out
Considering the plethora or small handheld devices out there, why is this one so much harder to track charge for?
Because having my MP3 player stop playing music isn't as embarassing as not being able to buy what I just took to the checkout.

6) What happens when the OS crashes and the information is wiped out?
Well, you reload the data from either the credit cards again or the backup that was made
You're most likely to discover such a failure while shopping... again, the embarassment situation.

OMG you are a genious.

[Tensor]

This is without a doubt the best thieves's tool!

The only thing that could be done to prevent this is to make it hold only a small number of each type of card. Like only 10 Credit Cards. Still, its pretty much simplyfies the "printing" of stolen cards.

OTOH, i wonder if this will ever work. CC companies must back this up to work, i mean try taking the mag strip off your AmEx (or visa, or ... ) card, and pasting it on a cardboard card, and write your name and number up on the front. And then TRY to use it in any shop. I am sure they'll just ask for some other card.

Re:OMG you are a genious.

[John Courtland]

You can remagnetize a carelessly discarded card. ALWAYS cut your discarded credit cards. Use it at a shop that is lax on security (why do you think some clerks ask for photo ID and are supposed to type in the last 4 digits of the CC #?). However, this wouldn't even need that. It comes with a "chameleon" card that can change its number. Use that and you're set.

Re:OMG you are a genious.

[Anonymous Coward]

Having to post anonymously, due to a previous life of crime that my present life must not acknowledge.

The criminal element factor was my first reaction to this. Back in the day, I worked as a bartender in a restaurant. I also knew a few people who were 'connected', as it were. These nefarious people had access to a magnetic card writer. I had access to a great many credit cards. I'm sure you can make the connection.

I was paid a non-trivial sum for every credit card number I delivered to them, and more for American Express Platinum cards. I was also paid another amount for pilfering credit cards from the office safe -- you'd be surprised how many people leave their cards behind at a bar and never reclaim them. We would always get at least 5-10 a night, and there was a stack of 100's that people had never claimed.

These people would then re-encode the pilfered cards with the stolen numbers and go on a spending spree. In the event of a store with a last four numbers check, or if security was a concern, they just used another corrupt employee like me to type in the correct four digits. I even recieved a few of these cards as bonus payments myself.

Luckily for me, I got out of the business before it attracted too much attention on my part. However, to this day, I will not use a debit card in place of a credit card. At least with a credit card, you have protection. A debt card just comes right out of your bank account. I certainly tried to not give the criminals debt card numbers, but I'm sure a few slipped through the cracks, and I know that there were co-workers less scrupulous than me.

However, I also wonder if you'd be able to use this device in any store. With all the security in place today, I wonder who would accept this as a valid credit card. I can't even buy things without having the back signed half the time. Then again, it's not like the self-checkout lines at Wal-Mart ever physically inspect my card.

Re:OMG you are a genious.

[Ironica]

However, to this day, I will not use a debit card in place of a credit card. At least with a credit card, you have protection. A debt card just comes right out of your bank account.

It comes down to bank policy. My credit cards, by law, have a cap of $50 of personal liability if they are stolen. But my debit card, by WFB policy, has a cap of $0. Which card will *I* use? Hm...

Re:OMG you are a genious.

[fdiskne1]

that is why NONE of my cards are signed but say in big sharpie ink.. "CHECK MY ID!"

Technically, if you DON'T sign it, it is not valid. I can see your point about putting "CHECK MY ID!", but according to most terms of credit cards, it shouldn't be honored. Now, if you don't sign the card and don't put "CHECK MY ID" on it either, you are just asking for trouble. Let's say a thief gets a hold of an unsigned card without "CHECK MY ID" in the signature box. All the thief has to do is sign your name with his own hand. Viola! The signature will match every time.

If it goes by fingerprint...

[eurleif]

Then how do you let a friend borrow your card?

On no, not another learning experience!

[AndroidCat]

[..] and even memorize the RFID signals of devices like the Mobil SpeedPass.

That gives me lots of confidence in the security of Speedpass cards. I predict wonderful "learning experiences" as RFID reading/duplicating technology moves down to individuals. Of course, legal threats are already being used to try to keep that genie in the bottle. (Previous story on Slashdot about nasty letters to people who bought smartcard readers for legitimate reasons.) Sure, that'll work...

Fun with Fingerprints: Chamelon Card

[Burstwave]

The Chamelon Card system uses a fingerprint reader to secure the data vault. Fingerprint readers can be defeated using a simple hack involving common household items. I refer interested readers to the following article: http://www.schneier.com/crypto-gram-0205.html.

To quote George Carlin...

[Eric_Cartman_South_P]

"...get a hold of some fucking cash, will ya?"

What about replacements?

[sydbarrett74]

What if my Chameleon Card is lost or stolen? With conventional plastic, I can call the issuer, report the card lost/stolen, and have a replacement sent within a couple of days for free (be wary of those companies that would charge you for this service). What is my recourse with Chameleon? Ponying up another $200? Also, what if I destroyed my original cards when transferring their data to the Chameleon device? Is there an online backup somewhere? Or am I shit out of luck?

And the difference is...

[algf2004]

So I should stop using my wallet because it is too big and instead use a handheld computer that is as big as my wallet?

Right...

Start simple -- digital cash

[code_rage]

I think it would be much easier to start with a simpler problem: digital cash. I would love to have a card that can hold up to about $100 that is anonymous and which I could use for bus fare, parking meters, road tolls, or small purchases like meals. This would be a natural for on-line purchases of paid content (iTunes, archived news stories).

By being anonymous, my privacy would be protected (at least in theory). It would also be completely unconnected to my credit cards and bank accounts, so it could never be used to steal more than $100 from me.

This is not a trivial problem -- it has some of the same problems as voting (anonymity & non-repudiation).

I think this is already being done in Europe. If only the US would catch up.

and even memorize RFID signals of SpeedPass

[frovingslosh]

and even memorize the RFID signals of devices like the Mobil SpeedPass.

Hey, slick, it can memorize a SpeedPass code. Gee, what could posiably go wrong with this?

Now we gotta wrap our speed pass in tin foil too!

A Lord Of The Rings Moment

[Valen0]

One Card to rule them all, one Card to find them
One Card to bring them all and in the darkness bind them
In the Land of Cameleon Network where the Shadows lie.

This interested me...

[sirReal.83.]

Any company that has a hyperlink marked "Investor Information" above-the-fold (shown without a need to scroll down on a typical 800x600 setup) is automatically a bit suspect.

...so I did a tiny bit of research.

Yeah, what did you mean by "suspect?" Are EMC or IBM guilty of producing vaporware? Is NewsCorp not far-reaching enough for you? Granted, not all of these are the most ethical companies in the world... but just an example.

France has it

[code_rage]

From about a year ago: this article says France has a system like what I want. It's not clear from thaat article whether you can use it for all of the purchases I mentioned, but it's a start.

Seriously.

[cryptochrome]

That's $200 you're whipping out in front of everyone. So easy to lose, and so tempting to steal (even if they can't get the data in it).

Here's what would make more sense: All credit/debit cards require the reader to verify and register the purchase. Instead you open up a meta-account with a debit card that you register ALL your cards and bank accounts with, and then use just that card, allowing the meta-account to distribute your money for maximum savings or returns. Since interest is compounded daily, paying/investing daily could save/make you a fair chunk of change. Hell, just make it a free government service and make it your driver's license or id, so you don't have to carry anything extra.

Oh, and if you lose it you're not out $200.

Re:Seriously.

[Anonymous Coward]

The Benefit of this thing is essentially that, lacking your fingerprint(the value of biometrics can be discussed elsewhere), it cannot be used

But that's the complete opposite of the truth. It needs the fingerprint of whoever owns the vault, not whoever owns the original credit card. This scheme simply means that if I DO get access to your credit card briefly that I may also have a cheap consumer device, that I don't need to be coy about using, that allows me to easily copy your card. Instead of walking round with a pocket full of stolen cards I have a single vault that nobody else can access.

Any "security" features of the original card are rendered irrelevant because of course I do have a completely valid chameleon card.

Signature confirmation goes completely out because either there is no signature on the chameleon card or, again, it's the signature of whoever owns the chameleon card not whoever owns the original.

To try to spin this as giving added security to owners of genuine cards is absurd.

Re:Seriously.

[Zeinfeld]

But that's the complete opposite of the truth. It needs the fingerprint of whoever owns the vault, not whoever owns the original credit card.

This is the real problem. These guys sound like they have done a great job of protecting the consumer. In the process they have completely ignored the fact that they have created a method of forging credit cards that requires no expertise or special tools.

I think it will not be very long before the card associations tell their merchants that they must not accept these cards.

This will never fly

[Jarnis]

- It's expensive. Too expensive for a trinket that might be lost/damaged in everyday life. Credit card lost? No biggie - you just cancel it, request new one. At worst you pay few bucks fee for replacement card.

- Lose this trinket, and you just gave *every damn card/id thingy ya had* to a thief. Yeah yeah its fingerprint keyed. So what? The data is inside and everything is ultimately hackable.

- It can obiviously be used to swipe magnetic strip data off other people's cards you may be able to handle. As a bonus if it can 'dupe' smartcards, Visa & co wont be happy - they just spent gazillions in moving every (insecure) magnetic card to ones with chip inside. I think their timetable is something like by end of 2005 every Visa card is a smartcard. I'd expect credit card companies to sue the pants off this company for unauthorized reverse engineering of their security features against duplication in the cards. DMCA will be used to pwn these guys. (And if it does *not* dupe smartcards, it will be useless in couple of years when every card becomes one)

- Big credit card companies will just tell to the retailers not to accept anything except Genunie Visa(r) Card(tm) :) - logos and all. And if you expect chameleon cards to be allowed to display those logos, think again. Not to mention that a chameleon card would either have to display gazillion different logos (fishy, wouldn't pass in most stores without tons of education and approval of credit card companies), or you'd need a custom card for every card you have - in which case the whole toy is useless.

- Huge hassles with most clerks refusing the cards 'swiped on' with this trinket even without guidance from credit card companies - "that's not a visa card, are you trying to fool me with some thieves tool with copied card data?". The education required to train every damn minimum wage clerk in the world to identify and accept this thingy in place of a real card would be astronomical - EVEN if the card companies would go along with it.

Dot.com boom coming back? This company is beyond loony to even attempt to develop something this stupid.

Re:This will never fly

[Jarnis]

USA is bit behind Europe in this regard, but they are coming - in five to ten years magnetic strips will be history. Who would invest in a technology that is known to become obsolete in a few years? Especially when the usability and value of the whole trinket is dubious at best. The company in question is TOAST.

Not to mention - here in europe mobile phones/SIM cards are rapidly trying to wrestle themselves into this position. At first they'll be used as coin replacements - you can already buy soda from a vending machine or a bus ticket using a phone in Finland. Next step is to allow you to pay your purchases using a phone in stores. Naturally this bit has much more resistance from the established credit/debit card companies as phone operators are dreaming of taking the cake from Visa and other heavyweights. I'd guess than when the dust settles, there will be something like 'MobileVISA' - basically allowing you to pay using your mobile phone and the purchase showing up in your credit card bill, with the phone operator getting teeny cut out of the action for providing the authentication and linking to the customer's credit card data. Yes, there are naturally security issues - mobile handset theft would become a lot more lucrative if you could pay with one - but give 'em time... sooner or later you have one thingy that you always carry around that functions as a phone and an 'electronic wallet'.

So what's the reason to have this trinket then? There isn't one...

Re:Netherlands has chipknip.

[mtenhagen]

The netherlands has chipknip (free translation: chipwallet)

See this pdf for a nice english description about.
http://www.protonworld.com/downloads/pdfs/ netherla nds.pdf

It isnt such a succes as they planned. But it is used pretty much and most stores accept chip payments.

There where some rumors about security leaks do. Chipknip is integrated with your bankcard so not anonymous

Re:Use fake telephone numbers

[FreeForm Response]

Remember, /. people are intelligent, and intelligent people conceal identity whenever possible.

So Linus, RMS, that ESR guy... they're all dumbasses then?

There's a difference between concealing your identiity and making sure that your private data stays that way.

its a strip and a chip

[DavidDeLux]

Well, Visa and Mastercard are moving over to smart credit cards - with the embedded ICC - so the Chameleon Card will not only have to produce the right magnetic strip, but also the right applications to the ICC... and you can't just stick a smart card into a reader and duplicate it. BTW, anybody else notice that the team members of Chameleon contain more than one Unpublished name... so if some of the people behind it don't want their name public, what faith can you put in their product.

Size matters, but in the spy business...

[srussell]

... smaller is better.

This'll be great if it takes up less space in my wallet than a half dozen cards. Otherwise, I'll wait for a future, slimmer, version.

Seriously, though, this could be a great idea. Three credit cards, a driver's license, three insurance cards (dental, medical, and auto)... plus a bunch of other cards I don't carry because I rarely use them (voter's registration card, etc) and are therefore at perpetual risk of being lost; this thing has a lot of potential.

The owner is in control of the information on the device, and it appears actually safer than carrying regular credit cards since it can't be used by thieves (assuming it also proves to be secure). My only questions center around the RFID tag, but they could be easily satisfied.

Free?

[bryanp]

Hell, just make it a free government service

Free? Free to who? There are no such thing as "free" government services. They cost tax $. My tax $. Maybe I don't want to pay for your personal convenience. Maybe the guy next door doesn't care to pay for it either.

Not on the strip

[Gyorg_Lavode]

So what about the material not stored on the magnetic strip? The security number, and such. Not all the information on a credit card etc is on the strip and to truely be effective it's going to have to store this information.

Plus, can I sit on it?

Is it just me.....

[L0rax23]

Or is this just an open invite for an even more high-tech form of identity theft.

Who do you want to be today?

o)

This is bad and misunderstands cc theft

[BeerSlurpy]

Credit card thieves dont physically steal the card anymore. Most often they have their own card reader like this device and they will swipe your card an extra time under the table and pretend it didnt go through the first time.

A week or two later they make a fake card with your magnetic stripe and usually go on a 5000 dollar (the usual single day limit on most cards) spending spree and then fence the goods. The consumer discovers 5000 dollars on his card, usually from stuff purchased when he was in another state, at work, on the international space station, etc and calls the bank up. They issue a new card and reimburse the money.

This happened to me, and not ONCE did my card leave my wallet.

The only real solution to credit card thievery is to have intelligent software that tracks the spending habits of the legitimate user and requires extra verification before allowing out-of-the-ordinary purchases. Like if someone normally buys nothing but gas and groceriers with a credit card and suddenly buys 3000 dollars worth of stereo equipment 200 miles from where they live.... red flag!

Small Problem

[Rick the Red]

"John Q. Public"

"Jonnie Public"

"Johnathan Public"

"J. Q. Public"

"Johnathan Quincy Public"

Re:Small Problem

[ilsa]

Don't forget his new wife: Jane Marie Average-Public, who is still trying to get her Social Security Card re-issued with her married name. Double the fun if she answers to her middle name, triple if people routinely mispell any part of her name (Jayne Mary?)

Card Reader

[severoon]

What do you think of this?

You get a single card that can store all your info, and a card reader at home. You slip the card in before you head out and unlock all the elements of it using the card reader and some kind of authentication thing like a public key (I like codes that thieves will not expect you to know off the top of your head, like a 4-digit PIN--that's dangerous...but can you see a crook saying, "Give me your Universal Card and your public key"?). You could say, unlock all my credit and debit until 8pm tonight, and leave the Visa and Mastercard unlocked until 10pm.

You have to choose a default credit account that stays on all the time, but if you make too many purchases with it while the rest of the card is locked, the credit card company calls you and lets you know. That's it. They don't shut it off, they don't even have to have a live person call you. They just call you and say, "Someone's charging on your locked card, is it you?"

Of course, if you prefer the credit company to be liable, then you have to allow them to shut it off if purchases don't match your typical buying profile whether it's locked or unlocked. If you want the freedom to never have your card shut off, then you agree to pay the charges.

I don't see the point of keeping things the way they are. I don't know about you guys, but I keep all my credit cards right next to each other, so if I ever get mugged, I'm going to lose them all anyway, along with my ID. So I say stick 'em all on the same piece of plastic so I only have to track one thing. And you have to admit, it's definitely more secure than cash any way you cut it. Someone gets your cash, and what recourse do you have?

sev

I hope you never travel

[grahamsz]

In the UK at least if you dont have a real signature on your signature strip then they will most likely refuse the transaction.

I know someone who on some occasions had the write the words "check id" to the upper right of her signature because people interpreted it as part of her sig.

Stores REALLY need to start reading the smart chips on cards. I've got 4 or 5 cards with those, but since moving to the USA they haven't been checked once.

Re:Size DOES matter!

[malachid69]

I have to admit, even with the various concerns I have (and the ones listed here), I pre-ordered.

Why? Because I have thought of designing something like this for myself in the past. Even though I no longer carry half my cards anymore (BiMart, et all), I somehow still manage to have WAY too many... Obviously, i could not replace my drivers license (no Mr. Officer, really, this is valid)... looking through my wallet while replying to this, I found 12 cards that I could easily get rid of. Wierd thing is, I thought there would be more, but 1/2 my cards wouldn't work with this (I think), like Social Security Card, OMMP, etc -- because there is no barcode/smartChip/magStripe/RFID on them. IF it was able to simply show me the front and back of any of my cards, like a jpg or something, then I could easily double the number I could get rid of. Of course, at that point, it would probably be really useful for all those damned business cards that manage to get into my wallet too.

Malachi

What are they hiding?

[Salamander]

Is it just me, or does it seem a little odd to other people that several of the principals listed on their web page (including the CTO) remain anonymous? Why the heck would anyone do that? Most companies at this stage splash the identities of their principals everywhere. These guys must have some pretty bad skeletons in their closet to hide like this.

May not be as insecure as you think

[TekMonkey]

You have all posted very valid reasons why this new system would be unsecure, but don't you think Chameleon would have taken some measures to secure this?

I have no proof or way of knowing if this is what Chameleon does, but if they're smart, they've done something along these lines:

If someone stole your chameleon card, they wouldn't be able to use it without your fingerprint.

I assume Chameleon wouldn't let just anyone load any Chameleon card into their pocket vault. I'm sure they assign a single card to each pocket vault/user, and it won't accept cards that do not match the pocket vault's number.

So if someone stole your card (account #001) and tried to put it in their pocket vault (account #002), it would deny it because the card isn't account #002.

If someone stole your credit card and scanned it into their pocket vault, again I assume each pocket vault would have one user assigned and if it didn't match, it wouldn't accept. For those of you who say "What if a wife wants to use husband's card and vice-versa?", Chameleon probably lets you assign both the wife and the husband's name, so she can use his cards and he can use her cards.

Leeloo Dallas Mul-ti-pass. Mul-ti-pass.

[Powerdog]

Leeloo: Leeloo Dallas mul-ti-pass.
Korben: Yeah.
Leeloo: Mul-ti-pass.
Korben: Yeah, multipass, she knows it's a multipass. Leeloo Dallas. This is my wife.
Leeloo: Mul-ti-pass.
Korben: We're newlyweds. Just met. You know how it is. We bumped into each other, sparks happen ...
Leeloo: Mul-ti-pass.
Korben: Yeah, she knows it's a multipass. Anyway, we're in love.

Re:hmmmmm

[Rick Genter]

Every time you use it you are charged by the bank or CC company just to utilize what is rightfully yours(well maybe not so much in terms of CC).

I pay no charge to use my debit card, because I maintain a certain minimum balance in my account. I pay no charge to use my credit cards, because I pay off their balance each month, and use no-annual-fee cards.

A Universal card, properly secured, would be very attractive to me.