Slashdot Mirror
Privacy Pitfalls in No-Swipe Credit Cards
Nrbelex writes to mention a New York Times article about the privacy pitfalls of 'no-swipe' credit cards. Despite assurances from the card companies, researchers Tom Heydt-Benjamin and Kevin Fu were able to easily retrieve data from the new cards ... data available without encryption and in plain text. From the article: "They could skim and store the information from a card with a device the size of a couple of paperback books, which they cobbled together from readily available computer and radio components for $150. They say they could probably make another one even smaller and cheaper: about the size of a pack of gum for less than $50. And because the cards can be read even through a wallet or an item of clothing, the security of the information, the researchers say, is startlingly weak. 'Would you be comfortable wearing your name, your credit card number and your card expiration date on your T-shirt?' Mr. Heydt-Benjamin, a graduate student, asked."
Of course, I found this interesting blog post from several years ago: http://www.spy.org.uk/spyblog/2004/02/foiling_the_ oyster_card.html
I just wish TfL would get the bloody Silverlink / North London Line railways on the system rather than posting stormtrooper rent-a-cops at selected stations on random mornings. I actually do pay my fare, but I'm deeply distressed by the rudeness of some of the non-TfL staff. Treat customers not as potential fare-evaders but customers!
Okay, magnetic swipe cards are better than the old way of making a carbon from the raised info on the little plastic cards, but what is the advantage of an RFID credit card? I still need to get the RFID-thing out of my wallet or out of my pocket to use it. Is saving five seconds such a big deal that I wouldn't spend that five seconds in order to protect my identity?
Upgrades for the sake of the "wow-factor" are stupid.
Here will be an old abusing of God's patience and the king's English.
...swipe cards aren't secure? Hell, I'm still waiting for CREDIT cards to become secure.
I've been waiting for 2 years for cashiers and salespeople to check my signature whenever I buy something with my credit card. Sometimes I'll sign "Mickey Mouse" or "Donald Trump", or even write a phrase like "Yankees suck!", and I still have yet to be asked even once. With the lack of security on older cards, it doesn't surprise me that these newer ones are no less safe.
On a really cold winter's day up here in Canada, I'd quite like a system that didn't require removing the card from my wallet while wearing heavy gloves. That would require a keyfob that worked from several feet and had some form of passcode required of course, but it would be awful nice.
- Michael T. Babcock (Yes, I blog)
There seems to be a really huge gap between the security research community and the companies developing RFID credit cards, RFID passports and voting machines, in other words, the people making the practical applications. It is clear that these companies have absolutely no competence whatsoever regarding information security and don't care to ask anyone for advice either. Beautiful. Security by obscurity is the default and often there's not even much obscurity..
Aren't there any rules regarding the handling of sensitive customer information? No laws? Is it enough to just say: "Don't worry. Your data is safe with our technology." when it is actually not?
Wouldn't it make more sense to leave all the information on the credit card encrypted, have the information left encrypted and sent to the credit card company, still encrypted, and only be able to decrypt the information at the credit card company? It seems to me that even if you need physical access to copy the number it's still not that secure. It would make much more sense to have a card that's blank and devoid of any identifying information than to have something that just about anybody can get the information off of.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
You know, when there is enough money behind it, they will outlaw the stuff that makes it stupid, so get ready for an FBI investigation next time you shop around for one of these components....
I have one of those cards. I lined my wallet with as soon as my bank informed me that I would received an RFID-equipped credit-card at no extra charge!
These 'old days' you talk about ended long, long ago. These 'new days' you predict started decades ago. I'm far more worried about the minimum wage employee handling my credit card info or someone digging through improperly discarded credit card receipts than I am of a technophile taking the time and effort to build a mobile card reader. A stolen credit card is a stolen credit card, regardless how it's done - and we already have measures to counter this. I fail to see how this 'new world' is any different than today's status quo.
"All you've done is substitute one set of unique information for another set of unique information, the fact that the information means nothing to you doesn't change it."
Yes, but it's information that's harder to obtain. I mean, you can't read it off the card's front, you have to scan to get it, and once you get it, you can't use that series of encrypted info at the online stores, you have to find a credit card of a similar type and "flash" it to that encrypted series.
I hear zapping chips in microwaves toasts them pretty quick; if you have a stripe to fall back then the card wouldn't be useless, but I don't know if it would survive.
Does anybody know how magnetic stripes respond to being microwaved? Not much use if you toast that too. And how long do you have to zap a chip to burn it out? (Sub-second?)
(Note the stripe only has to be significantly more robust than the chip, it doesn't have to be immune to microwaves. If there's a range where the chip dies but the stripe still works, it doesn't matter if the stripe would stop working in another ten seconds.)
My wife's CC was recently skimmed. They made face-to-face transactions totalling $5100. In these cases, according to the bank, they make a card with their own information on the front and our information on the magnetic strip. In this case, an ID check would have shown that the card was being used by the apparently correct owner. We need to implement PINs and smart chips on our CCs to eliminate these types of fraud.
Working in the hotel business, I handle a large number of credit cards. The trend I have seen for people wanting to "disable" the RF portion is to use a hole punch through the chip. I've seen about ten or so this past month, all have the little radio icon on the back and a hole punched right through the card. Not a bad way to do it I must say.