Slashdot Mirror
RFID MasterCard
starburst writes "MasterCard introduces a
RFID MasterCard called PayPass in Orlando Florida. They tout the convenience of no more swiping or giving your card to cashiers. They claim the card has to be within an inch of the reader to be read -- how long till criminals are walking the malls, or next to you in line with portable readers getting your card information?"
How long until I can buy a wallet with a woven copper grid liner?
NetInfo connection failed for server 127.0.0.1/local
If my photo had to be on my Credit Card and also I had to enter a Secret PIN to use it - would that stop a load of Credit Card Fraud??
If I am at the store, they compare my photo to me?
However I guess some people would not like carrying an ID card (which it could make the Credit Card?) around with them??
Just my two bits (0&1)
time for a tin foil hat for my wallet.
Evolution or ID?
Tank of gas - $22.47
Pack of cheetos - $1.25
1 Liter of Mountain Dew - $1.50
Stolen card # via RFID - Priceless (or your max on the card)
I'm haven't read much on RFID tags, but I thought the power came from the reader, so the only thing that would have to be more powerful for the cards to be read from more than an inch away would be the reader, not the card.
Banaaaana!
How much more efficient is it really to put a card an inch next to a pad merchants will have to buy instead of swiping it through a card reader that already exists everywhere?
Look, the 5 seconds per month people will save with this aren't going to be worth the costs of embedding the RFID, so eventually this will go away based on simple economics.
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
There's something similiar in Canada called Dexit. But it's not a credit card. It's a type of debit card with a $100 limit so if you lose it or anything you're not really out all that much. You can refill it anytime online, over the phone, or automatically from your account. It's used for fast food, candy, newspapers, whatever.
Support the First Amendment. Read at -1
I think that's a make up on the current insecure credit card framework, which is hopeless. Credit cards are so propagated through the world, and it would be very costly (and disastrous) to build a brand new security mechanism so anyone can understand why MasterCard does such kind of show-off, without doing actually anything.
This quote is worth any comment:
"PayPass is guaranteed as safe and secure as all MasterCards."
Oh, then that gave me a very strong and confident feeling. (Read this as: secure my ass)
This card is not about RFID, it's about making card use in scenarios like drive-throughs easier. Also, it's currently limited to <$25 transactions currently according to the FAQ.
Assuming one likes the idea of small plastic transactions at all, I wonder if it wouldn't be a better idea to _combine_ 2 accounts in one card: one account for the higher-value mag-stripe, and an RFID account with a low credit limit that needs to be constantly replenished.
"Now I've got enough money to build my robot. My girl robot. This is going to be the best prom ever."
How long till plainclothes cops walk the malls carrying detectors that sense the self-incriminating probe of the would-be pickpacket?
Seeing bad movies only encourages them. Watch responsibly
The kind of contacts I'm talking about would be the ones that measure the resistance across two contacts a few mm apart, in order to use the card your finger(s) have to be on the contacts, otherwise your card doesn't send or receive RFID crap.
da w00t. mtfnpy?
Once again, just because something can be done, it has been, totally without regard to whether or not it is actually a _good_ idea.
...". The same thing happened to microprocessors in the mid-80's, and we started seeing truly idiotic applications, uP-based Toasters, Staplers, Golf Tees, etc.
RFID's on personal ID's or credit cards have to be a security nightmare. How easy would it be to hide a collection device under a bus or train seat and collect ID's for a whole day or two?
Not to mention that a transmitter generates EM fields, which might be strong enough to erase your other mag-stripe cards in proximity.
RFID technology is now getting into the "buzzword" phase of electronic manufacturing/production, it's now cheap and common enough to start getting idiotic designers thinking "gee, wouldn't it be neat if we put an RFID in
History repeats itself once again.
-- You are in a maze of little, twisty passages, all different... --
It's nice to say "you have to be within one inch of the reader for the card to be read", but WHERE is this limit built in?
a) If it's the card itself (a "hacked" RFID that has a very weak response signal), we're on the "safe" side.
b) If it's in the reader (i.e. the reader sends out a weak signal, so that only cards within a few centimeters are capable to receiving to the signal), then we're in trouble.
Given - option B gives stores the "peace of mind", that they'll always read the "correct" card (i.e. the stores won't get in trouble for accidentally charging YOUR purchases to the guy next in line).
BUT - option B means, that crooks can use stronger readers that can scan your card from a few meters away (all that while the user thinks that even crooks need to make it to within an inch of their cards).
Before I'd go for such a card, I would most definetely like THAT question answered...
I had my credit card number stolen - still no idea how. May have been random card number generation for all I know - I did nothing particularly unsafe (using your credit card at all is pretty unsafe). I was immediately contacted by my bank who were suspicious because the charges were (a) out of line with my current spending pattern (b) in a completely different country to my previous charges. I simply verified that no, I hadn't been to Spain recently, they faxed me some forms (basically just signing to say that no, the following charges were not made by me) and 3 days later my new credit card arrived by courier. everything else was handled by the bank.
In some ways I got lucky because the nature of the spending raised flags, and because my bank actually has incredibly good service. The catch is, it is up to the credit card companies to wear the cost of stolen cards etc. presuming you take reasonable precautions. If they want to embed easily readable RFID tags and have to cover a shitload of costs for easily stolen card numbers... well, more power to them. They'll be out of that business soon enough.
Jedidiah.
Craft Beer Programming T-shirts
I love the Shielded cap. All the benefits of an aluminum foil beanie, without the strange looks.
The people working for mastercard and other financial credit companies are as smart as we are, and they stand to lose millions in fraud if they don't secure their customer's cards.
I would be very surprised if the cards didn't have built in challenge/response cryptography to send the information. These cards are available now, and cheaply in bulk. Further, they would likely only contain a database link to the credit information which can probably be invalidated without changing the credit card number.
Of course, this means the bad guys only need to break one (or maybe a few) keys to gain access to everyone's card, but then they have to go around and collect them by hand.
The assumption that companies are stupid or lazy is actually based on the fact that they have to make cost/performance decisions. What seems stupid to us generally is cheaper including all the incidental and security costs. I doubt that the cost/performance ratio here would favor a 'stupid' solution.
-Adam
Are there any documented cases of Mobil Speedpass RFID's being stolen and cloned? I do recall reading a slashdot story about a product that could be used for this purpose.
There are already millions of these out, and the infrastructure for using them has already been in place for years (atleast in my neck of the woods).
It's nice to say "you have to be within one inch of the reader for the card to be read", but WHERE is this limit built in?
Even an inch is too much. Pickpockets often have a "bumper" who distracts the target so he doesn't notice the touch on his wallet. Now the pickpocket can lift your card information by bumping into you in a checkout line.
Then a little careful observation as you enter your PIN and your account is toast.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way