Slashdot Mirror
Chase Deploying "Touchless" Credit Cards
Rick Zeman writes "As reported by Money Magazine, J.P. Morgan Chase, the US' 2nd largest bank, is rolling out 'contactless' credit cards, presumably using RFID technology. 'The new payment method doesn't require a customer signature, making it more convenient and time-saving for consumers' which leads me to wonder if the next crime wave of the future will be criminals walking through crowds with readers to grab customer info. Chase says, however, that 'new cards are embedded with encryption software to prevent duplication and data theft' but since RFID has been cracked before, and the criminals are usually more clever than the vendors...."
store it in a shielded sleeve until you use it?
if you want people to think you know what you are talking about, just put ".com" at the end of everything you say.com
Having to waste 5 seconds looking through my wallet for my Credit Card, and having to manually swipe it...
vs.
Having my Credit Card details stolen and sold.
I think the choice is easy.
HK has been using a contactless cash card since 1997 called Octopus It's proprietary RFID system (built before the standard appeared), that seems to work quite well for public transport and retail.
Two wrongs don't make a right, but three lefts do.
I was just thinking about this. I doubt banks will make it THAT easy for people to steal identity. Remember, it's money here we're dealing with and if it becomes too easy to steal the banks will lose money as well and customers' good will and trust, which you want in the finance industry.
In any case, I can imagine it working like this:
1. Terminal sends some string of random bytes, p.
2. Card processes it using some one way function f(p,q) and returns the value s where q is some secret info.
3. Terminal takes the results and sends p and s to the bank to verify. Bank runs f(p, q) and see if it matches s. If so, return true.
That's just a simple scheme I hatched up where you don't have to reveal your secret info to verify yourself. I'm sure there are much better ways.
EvilCON - Made Famous by
RFID is a very good idea for many things, such as grocery tagging. For credit cards it's awful. There are only two possible states of an RFID credit card:
1) Safely in a sleeve, where no one can read it
2) Out in the open, where everyone in a certain radius can read it
In other words, you can't spend it without exposing it. Joe Hacker can hang out next to the checkout line at your grocery store for 5 minutes and get a dozen credit card numbers.
I don't care how much you encrypt it: it'll be cracked, and sooner rather than later. The fact that they are compounding this with no regulation of requiring signitures is one of the worst security decisions I've ever heard of - far worse than anything Microsoft has ever put out, and that INCLUDES ActiveX. Because ActiveX breaches don't immediately and directly cause credit card numbers to get stolen en masse unless combined with social engineering.
I dress like a slob, so I am not a mugging target, and I don't spend what I don't have, so I don't have any credit card debt.
When the clerk asks for personal info, even if it is just "Can I have your zip code, sir?", I say "No".
Sure, I could get a couple of percent on "the float", but just not hassling with big bills is worth it. Paying for a meal you excreted a month ago sucks.
Pay as you go. Be happy.
This issue is a bit more complicated than you think.
Are they joking about the encryption thing? Do they honestly believe there's even the slightest chance that it wouldn't be cracked?
Banks tend to be pretty good with encryption. When negligence could easily cost you several billion, security is worth it.
You know those electronic key badges/fobs that you can hold up to a door to unlock it? Same type of technology. Notice how close they have to be for the reader to read the key. That's how close an attacker has to get his reader to your ass.
Unless they increase the power and put on a more sensitive antenna.
Remember, BlueTooth wasn't meant to transmit over a mile, either...