Slashdot Mirror
Visa To Push Swipeless Credit Cards
BobPaul wrote in to mention an initiative by Visa to allow for swipeless credit card transactions. From the article: "...consumers need only wave credit and debit cards within a few inches of a reader to complete a purchase. And for purchases of less than $25, no signature is required...Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted". Update: 02/25 16:06 GMT by Z : References to RFID technology removed.
It is secure. They're using SHA-1 hashes.
This is a contactless credit card, ISO 14443. RFID is ISO 15693. They are different. The article never mentions RFID. Slashdot has inserted something that was never there. This is misleading, dishonest, and unprofessional. There are MAJOR DIFFERENCES between the technologies. You would think that a techie site like /. would know better.
Lasers Controlled Games!
to have the sales folks in a store be able to read the info, check your limit, and in *MY* case, simply leave me alone while i browse, since i'm always broke anyway and don't like to be hassled whilst i look at stuff i can't buy!
Yes, it's a joke.
And now a thief doesn't have to guess PINs. It will be enough just to steal a card!
From TFA:
Each transmission between card and reader has a unique code that cannot be reused even if it is intercepted, a key security feature, he said.
What protects consumers from fraudulent merchants waving some kind of electronic cash-sucking wand by your back pocket which contains your wallet which contains your RFID Visa card? There's no mention of this in the article at all!
It's a standard scam now for an unscrupulous merchant to charge millions of people a small amount of money fraudulently with the hopes that the vast majority won't even notice. Imagine what they will do when all they have to do is walk around a mall waving something at people purse's and backpockets!
I'm a big tall mofo.
You don't know what you're talking about and neither does /., or at least Zonk. This isn't RFID, these aren't the TI chips. This isn't ISO 15693. If you can break 3DES please let me know. I would be VERY interested.
Lasers Controlled Games!
BTW, the specs are out there if you care to look. Here's a hint for you: EMV
Lasers Controlled Games!
I've always wanted an excuse to carry around a wallet made of tinfoil.... it'll match my hat, and my under.... I mean socks....
Seriously. IT DOES NOT MENTION RFID ANYWHERE IN THE ARTICLE. Just so y'all realize. Why is slashdot so anti-RFID, anyways? Are you guys anti-barcode? It's just a longer range barcode. And the chipmaker can set the length. It's just a way to get small amounts of information in to a computer. Relax.
And, I'm inclined to listen to visa a little bit when they say their card is secure. I mean, they are not exactly a company that can win by skimping on security. If the system is hacked, they pay, not you.
Recursive (adj.): see 'Recursive'
So, when Wal-Mart incorporates this technology, can I just have the bag containing the stolen card near the reader to purchase my illicit goods? And *IF* I am questioned about it, I can say that I didn't know it was in there, and I thought it was going to read my REAL card.
Also, does this mean that around the holidays in the mall, I wont have to hand the card over along with my driver's liscence?
"No, you don't need my ID, maam. Don't you know those cards can't be faked? It's completely secure. Yeah, I heard about it on the news, too. Never need to see my ID again. Compleltly safe. Don't forget to put that $1,235.65 on "credit". okay?"
And while the article says there is a code that can't be re-used for other readers, wont a signal jumper (the ones used to grab car alarm frequencies) still be able to get the 16 digit card number, plus exp. date?
Yeah, sending important financial data through the air sounds like a great idea. To the tech savvy, this is the same as screaming the numbers to the woman behind the register. Would you do that?
There are no gods but ourselves.
All this looks like to me is credit card companies trying to generate a new revenue stream by getting existing merchants to pony up for the new technology required to use this system.
Is it really so hard to swipe your card through a reader as you checkout? Does Visa really think people are so lazy that swiping a card is too much work?
This is an example of technology being used simply because it exists. This adds ZERO value for the consumer and opens up huge security holes. Who believes for one second that this technology is actually 100% secure?
I guess we're supposed to be reassured by the quote from the Visa rep in the article reminding us that there is no consumer liability for fraud.
I can only imagine what is going to happen if they roll out debit/checkcards linked to actual bank accounts with this technology!
"While 3DES appears to be secure for now, it takes at least 3 times as long to run as DES, and this means that it is inefficient and slow compared to other available block ciphers such as the new standard, AES, which has replaced DES."
Why do I need a contactless transaction? What is so hard about running my card through the slot in the terminal?
Tracking down online transactions isn't necessarily so trivial or likely to happen.
It's not wasting time, I'm educating myself.
In order to process claims from a reader like this you're going to need a merchant account.
So let's say you try it, I'll outline the events for you in chronological order:
Question everything
It will be presented better in the dupe later today.
What keeps me going is my inertia.
Please excuse me while I get this personal pet peeve off my chest.
WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?
I Don't sign my cards. I write in bold letters on the back MUST SEE ID. Still only about 1 in 20 times am I asked for an ID, even when makeing a $50+ purchase.
And the debit cards. The advertising on them is insane. They have some celebrity come out and get asked for ID then say - "With our Check Card, you Never need ID" And how is this supposed to be a good thing? I'm supposed to be happy that it is even easier for someone who has stolen a card to go and clear out my checking account? Who the heck goes out with their credit cards, but skips their ID? Who the heck runs around without an ID in the first place? What, your going to go into your wallet or purse, take out the debit card, and leave your licence/ID in there?
With all the credit card fraud and identity theft gong on, why would anyone make it even easier to ruin your credit rating and entangle you in hours upon hours of sometimes futile effort to get it set straight?
Mind you I will screem like hell if somebody REQUIRES me to carry an ID all the time - but cash spends fine without any verification.
Thanks.
People wave this "it only works from inches away" bullshit without having any idea how radio works.
Its simply a matter of using the right antenna with the right gain. See the bluetooth sniper rifle for details (kilometer range! With bluetooth!). If the antenna is too big to hide on your person, set up shop in a dark alley somewhere and scan the masses as they mill by unaware.
And yeah, tinfoil would work but make it all the more stupid. Not only would the old lady have to fumble the card out of her purse, you'd be sitting around watching her try to unwrap it and wrap it again afterwards. Just swipe the damn thing already!
If I have been able to see further than others, it is because I bought a pair of binoculars.
Hey, Visa, if you think your RFID system is so secure, publish all the nice technical details on how it works, so we can be confident of its security.
They're all published and available.
The basic chip and communications specifications are contained in ISO 14443. It will cost you a few dollars to buy a copy. You purchase your copy from your national standards organization; if you live in the USA, that's ANSI and they charge $18 for each of the four parts. The fee isn't to keep this stuff out of your hands, by the way, *all* ISO standards are copyrighted and cost money to obtain. That's how they fund the standardization and publication processes.
Above that basic level, most of these cards will be Java Cards. You can get the specifications for Java Card from Sun. They're free.
Moving up, most of these cards are also Global Platform cards. GP defines an extra set of features above Java Card, mostly to specify security-related characteristics. The specifications are found at the Global Platform web site.
In Visa's case, their recommended smart card platform is the IBM JCOP. You can find the details of IBM's implementation of Java Card and Global Platform here.
Note that not all issuing banks will use Java Card, or even a programmable card. Visa's recommended non-Java platform is the IBM MFC card operating system. I don't think the MFC team has a web site.
Finally, the actual payment application, and the component that matters most from a security perspective, is EMV. You can find complete EMV specifications at the EMVCO web site. The specs are mostly written towards contact smart cards, not contactless, but good smart card protocol designers *always* assume an attacker can get between card and reader, whether it's directly connected via a contact plate, or whether it's over RF, so the contact-oriented security does just as good a job in contactless mode.
Regarding signatures or no, it's not clear yet how that is going to be handled. EMV provides for several modes of operation, the best being "chip and PIN", which is what's being deployed in the UK right now (with contact cards, not RF). In that mode, you provide your PIN to the card reader through a PIN pad, and that unlocks your card to perform the transaction.
EMV also allows chip and signature and chip-only (as well as providing for fall-back modes that don't use the chip and rely on the magnetic stripe or even on getting a carbon copy of the embossed card number). The decisions about which mode to require will be made by individual banks issuing cards.
There is a lot to EMV... so you've got a few weeks worth of serious work cut out for you if you really want to understand it all, but the information is public and peer-reviewed. The countries that have deployed EMV have seen card skimming fraud drop to zero. That's right, so far, there has been no known case of an EMV card being faked or duplicated, and as far as I know, no one has deployed cards with DDA (dynamic data authentication) enabled. They're all SDA (static data authentication), which carry digitially-signed but static data on the chip which is read out every time. The US banks are talking about doing DDA, which involves a cryptographic challenge-response protocol and is vastly harder to duplicate.
At, say, $24 each, in a large crowd, you could amass quite a bit of money, and many people would never know it happened.
LOL. Dude, think about what you're saying. Credit card transactions are completely auditable. When dozens of people complain that they didn't authorize those $24 transactions, the issuing banks are going to go back to the merchant who performed them, and his acquirer is going to notice the extraordinarily high level of complaints, *and* that they're all for sub-$25 transactions. The theif will be in prison very shortl
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Even better.
Wear a T-shirt saying "pencil $19.95", "ask for a refund if not satisfied" and walk around in a crowd handing out pencils whenever your battery powered and cellphone internet accessed credit processing system successfuly charges someones credit card for "pencil" at $19.95 bucks.
"Thank you, Here's your pencil sir"
they look at you funny and take your pencil cause your some crazy guy wearing a backpack with antennas sticking out all over and a tin foil hat and they don't want to mess with you.
You sold them a pencil, what crime was commited?
They can ask for a refund if not satisfied...
Lifes a game play to win!
Maybe they shoud have moved to the latest standard: AES. Deploying 3DES solutions today is deploying legacy.
Or maybe not.
Many security architects aren't going to use AES for a while yet. It's too new. It has received a fairly large amount of scrutiny from the cryptographic community since its birth, so that gives us some confidence, but nowhere near the confidence we have in DES.
DES has stood up to 30 years worth of attacks and remains essentially unbroken. Sure, the key size is too small, so the cipher can be brute-forced relatively easily, but 3DES fixes that problem and does it by building on the fundamentally solid security of DES.
The bottom line is that there is really no need to move to AES, since 3DES is perfectly adequate, and the odds of AES being broken sometime in the near future are at least as high as DES being broken. 3DES is, currently, the best choice from a pure security standpoint.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
The real goal is fraud reduction. Visa isn't aiming for a perfect system, they want a better one that prevents skimming of your mag stripe. This means that they are no longer the low hanging fruit and the fraudsters will target traditional magstripe cards.
Lasers Controlled Games!
And how exactly do you expect this to make you any money? Cash is magically going to fly out of their credit card and into your bank account? Or do you actually expect VISA to start cutting checks to your house for charges made on your stolen card reader?
What happens when shopping malls decide they don't generate enough revenue by rent alone...
1)install reader in door frame
2)print EULA on doorstep stating there is a $5 charge to enter. "By stepping over this threshold you agree to the following terms...."
3)...
4)profit!!
or Blockbuster:
1)Take out advert at superbowl "THE END OF RENTAL FEES"
2)Place item at #296 in the website FAQ - "There will be a $15 charge for entering the store
3)...
4)profit!!
You don't seem to have read the spec - this is more about how air core transformers work than radio. These ISO 14443 cards use inductive coupling to power the card, not RF field strength. From this ISO 14443 overview:Having a crypto processor on board (especially the exponentiator) requires way more power than can typically be delivered by RF field strength (far field tags vs near field tags). EPC tags are RF field powered, and can be read from several meters away. Magnetically coupled tags can only be read from a few cm.
73 de k4det
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
No signature needed for under $25, works from a few inches away?
I forsee myself building a better antenna for my visa charging device and running through a crowded area charging everyone 24.99 as I pass by.
11*43+456^2
WHY, do companies and stores think that NOT showing ID when using a credit card/debit card is something that people would want?
Generally as a customer I don't. Not that I think showing ID is bad idea but I generally find the signature and to a lesser extend ID security measures to be as pointless as most of the airline "security". They're half heartedly implemented, irritating, and as implemented don't really do much to stop crime. It's appearance of security without substance. I wouldn't mind people asking for ID except that almost no one does, so what's the point? And the signature matching is a stupid since any thief with half a brain (admitedly some lack even half) will just look at the card and make at least a half-hearted effort to copy it. It's not like he has to look hard for it...
Let me be clear. I have the mistfortune of being a man with a name that is very rarely associated with the masculine gender. As irritating as that is to me, I should get asked for my ID all the time. But I don't which tells me that the the store management and credit card companies don't really percieve it as a problem. And they have the data to know whether it is or isn't. It's not like they're guessing. Furthermore, when I do get asked for ID, it's almost always at places like an airport (where I've been asked for my ID 20 times) when buying a $4 magazine, never for the $1000 printer. As a customer, I'll admit that being asked for ID is irritating and I don't like being regarded as a potential criminal but if it were a widely implemented security measure, I could deal. But since the credit card companies and most retailers don't regard it as enough of a problem (actions speak louder than words) to ask for ID consistently, I'd rather they save me the irritation and not bother at all.
It gets repeated here ad-nauseum that authentication consists of some combination of what you have, what you are and what you know. The signature is worthless as a security measure because it is simply two instances of something you have in the same item. Someone who takes my credit card also has my signature. Asking for photo ID sort of gets at what you are, though it can be forged by an ambitious criminal. But it could slow down the smaller thefts were it actually used. A pin code is actually useful IMO because it is something you know but is not used (for cost reasons mostly) for credit cards here in the US. And unlike biometric ID, it can be changed if there is a mixup.
While I'm venting, what really irritates me is when they have those swipe-it-yourself pads but still ask to see the signature! I've already mentioned that I think signature comparison is worthless as a security measure, but this practice just wastes both my time and the clerk's time. Furthermore they don't physically have the card at the right time if the credit card company tells them to hold the card. If they want to see my signature, the clerk should swipe the card him/herself and check. By having me do it, they don't save any time and they don't improve security. If they are going to ask for something they should ask for ID at that point, not a signature.
Once again, please quit spreading dis-information. Visa has not ever, and hopefully will not ever issue a merchant account with an "anonymous" pay-to system/account/email address! There's a lot of paperwork and verification involved. Sure someone could steal a scanner and rack up charges, but unless they're a verified, bonded, merchant, they won't see that money.
Period.
You have a constitutionally protected right to be wrong, and I the right to ignore you.