Slashdot Mirror
Privacy Pitfalls in No-Swipe Credit Cards
Nrbelex writes to mention a New York Times article about the privacy pitfalls of 'no-swipe' credit cards. Despite assurances from the card companies, researchers Tom Heydt-Benjamin and Kevin Fu were able to easily retrieve data from the new cards ... data available without encryption and in plain text. From the article: "They could skim and store the information from a card with a device the size of a couple of paperback books, which they cobbled together from readily available computer and radio components for $150. They say they could probably make another one even smaller and cheaper: about the size of a pack of gum for less than $50. And because the cards can be read even through a wallet or an item of clothing, the security of the information, the researchers say, is startlingly weak. 'Would you be comfortable wearing your name, your credit card number and your card expiration date on your T-shirt?' Mr. Heydt-Benjamin, a graduate student, asked."
Let them do this. I think it's time these idiots suffered a really big catastrophe; it'd probably the most (only?) effective way to really set the tone re. RFID.
Meantime, don't carry these cards yourselves, and avoid banks that use them...
Tired of Political Trolls? Opt Out!
In the old days, you used to actually have to stick your hand into someone's pocket or purse.
In the new days, you apparently only have to sit next to them on the bus.
When did we get too lazy to swipe credit cards?
If you're too lazy to have any security, you won't have any.
I mostly agree with your point of view, but I would like to react on magnetic strip:
-Yes, it is better than the good old carbon, but it is still easy to copy in a couple of sec with 50bucks of equipment. The PIN-protected chip is the only relatively safe part of the card.
-As long as you can still buy stuff on the net or by phone with only the card number and validity date, the thief only needs a good visual memory or a camera to steal that from you when you are removing your card from your tinfoil wallet to pay for your grocery.
Not yet. But it sounds more and more tempting.
Seriously. When the law turns against you, it's time to turn against the law.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
You honestly think a minimum wage counter jockey at the 7/11 is going to perform a proper signature analysis on your credit card slip? Why would they check your signature? They are in no position to validate it against the one on the card anyway. The only reason you sign it is so that there is a record in case you contest the charge later. It gives the CC company a way to try to prove you DID buy something.
Finkployd
I've only ever had to use a PIN in a debit card transaction and never in a credit card transaction. Why? Because when they ask for your PIN, it's being processed as an ATM transaction and I assume you don't want to pay for your groceries or gas with a cash advance at 25%APR. The reason they try to get you to use your PIN when paying with debit is that it's significantly cheaper for the vendor to accept PIN debit than signed credit. On the other hand, you will most likely get charged by your bank for using "another banks'" ATM. They're pushing the cost of accepting plastic onto you.
How many fulltime jobs can one man have?
I probably sound like a paranoid nut, but banks are pushing this 'touchless' card technology because we buy more when we use it. By 'we' I mean consumers. And we buy more when using plastic than when using cash. In this USAToday article - http://www.usatoday.com/money/perfi/credit/2006-10 -09-credit-cards-usat_x.htm - a great quote sums it up:
Merchants, too, benefit from faster no-signature transactions, credit card companies say, because the stores can serve more customers -- resulting in higher overall sales. And "people will spend more if they come in with a card vs. cash," says Gareth Forsey of MasterCard Worldwide (MA).
"People will spend more".
So, if people already spend more by putting a card in a reader, it stands to reason that they'll spend even more when they don't even have to get the card out of the wallet - just wave it around in front of the reader. The speedpass technology is pretty much doing this already, and McDonald's adopted it a few years back. Obviously it was a pretty big expense for them to put the machines in, refit their networks to accomodate it, etc. Why would they do it unless it meant people were buying more? In fact, Visa's own website (http://merchants.visa.com/solutions/qsr.jsp) states that
A recent Visa study of 100,000 QSR transactions showed that customers using payment cards spent an average of 30 percent more than those who paid with cash. Other industry studies suggest that the average spread may be even higher.
So for everyone saying "when did we get so lazy?" and similar notions, it's not that we're lazy. We simply spend more the less psychologically painful it is to do so. If I lay down 5 $20s to do my grocery shopping, it's more painful than swiping a card, because it's not as real at that moment. When I get view my statement later, yes, it all tallies up, but there's no difference between using plastic for groceries, clothes, the movies, or anything else, even if all the prices are wildly different.
creation science book
Encryption isn't magic. All you've done is substitute one set of unique information for another set of unique information, the fact that the information means nothing to you doesn't change it. If I read "CastrTroy, 1234-5678-9012-3456, 12/09" from a credit card, stuck ", $1000" on the end and sent it to the credit card company, that's no different than being able to read "oinasdfomasdfpmweasdfhqervsad, $1000". The credit card company still associates that random crap with you. It's always the same, so it means nothing.
:P
There are ways around this, but maintaining the physical security of the card is one of the better ways. Not being able to shoot your wallet with radiation and get money back seems like a good first step.. having the data only available after physically plugging/sliding the card in to a reader AND be encrypted while still on the card (smart chip) using a public key granted to the store (so the store would be able to reproduce the data, but you wouldn't have any real information available to you to use on a different place, so all the stolen transactions are quite quickly tracked back) would be a good first start.
There's probably flaws in that plan that I'm unaware of.. though the fact that my credit card has one of these chips and I didn't ask for it to and have no idea how to turn it off is one of the flaws, I'm suspecting.
signatures are next to useless, they don't actually check that it match one that they have on file, only that its there.
i'd know, my signature is always different and no one ever called me about it, removed a charge, or made any kind of inquiry about it. not on credit cards, not on checks, not even on loan applications.
it's a social convention based on honor that was extended further that it was ever meant to go
I'm far more worried about the minimum wage employee handling my credit card info or someone digging through improperly discarded credit card receipts than I am of a technophile taking the time and effort to build a mobile card reader.
While I agree that the first scenario is more likely than the second, OTBE, I'm always more wary of the smarter thief.
Your fantasies contain the seeds of important concepts.