Slashdot Mirror
Are Contactless Payments Really Secure?
berberine writes to tell us Ars Technica has a closer look at whether the RFID technology behind many of the up and coming "contactless payment systems" is robust enough to prevent account fraud and the theft of personal information. "Concerns over the security of contactless systems were heightened last week by a Federal Reserve decision that will allow for even more casual, low-cost purchases to be made across the country. In recent years, credit card companies have waived their signature requirements for so-called "small ticket" items in order to get a slice of the action. Visa, for instance, doesn't require your signature for purchases at or below $25."
Except that banks magic money into existence so they're not actually losing anything (maybe but a little profit) when someone commits fraud.
Deleted
maybe??
--
Jaap van Ballspoogen
is contactless sex safe? ofcourse.. I rest my case, your honor..
It's simply not worth it for anyone to investigate and verify small charges. So why even bother paying to keep a paper trail nobody will ever use?
If it's a fraudulent charge report it.
It seems to me the usage based flagging works just fine anyway.
Look, encrypted or not the RFID chips simply send out a unique signal. A signal that, once trapped, can be recoreded and reused. For the true "contactless" payment systems this contact is the only one. Unless the number changes in response to some handshake (something that isn't being done in the present generation of Contactless systems) then possession of the key is the only security and, in absence of a signature or indefinitely stored security cameras, the only record of the card's use.
Lacking the independent verification this is begging for an attack.
It's obvious that contactless payments are vulnerable to at least one type of attack--a real-time relay. This usually would require two "attackers" working in tandem. The first carries a modified "contactless reader" in his pocket, and stands near somebody who is carrying a contactless card (perhaps on a bus or another crowded place where it won't be too obvious. The second attacker carries a device that can act as a contactless card "repeater", with a real-time data link to the first attacker's "reader". The second attacker walks up to the reader in a store, and waves his repeater at it (perhaps hidden in his wallet, in the same hand as a dummy card so as not to arouse suspicion). The store's reader sends a signal, which is picked up by the second attacker's repeater, transmitted to the first attacker's modified reader, then broadcast to the victim's card. It responds appropriately, and its response is relayed back to the reader in the store. It's not necessary to break any encryption to do this, and there's no real way to prevent such attacks except perhaps very tight timing tolerances.
I thought about all this when the bank sent me a contactless VISA, and I initially considered refusing the card. Then I realized that the bank will take the hit on any losses, and has presumably done the math to determine that the increase in risk of fraud is acceptable, at least for small purchases. In other words, it's secure enough.
This just doesn't track with me. The article fails to explain:
1) How Contactless is necessarily more or less secure than 'Magnetic Strip' cards. Both would require special technology to replicate. Both would store the same information. I'm assuming there's a threat vector of someone wanding your entire wallet, but that isn't in the article. Is it assumed?
2) Why do fewer 'small ticket' restrictions mean any more of a threat on Contactless than on Magnetic?
3) Why are 'small ticket' restrictions a threat at all? Isn't this just more of the same old credit card fraud?
Frankly if they'd just forbit the 'small ticket' waiver for not-in-person transactions, I'd be fine with it.
Who wants a Big Mac?
The other concern I have is that the onus is being shifted more and more onto me to identify when I may be at risk. While I admit, I should be aware if I misplace my card and should get the card immediately canceled, it certainly doesn't help matters when the card can be used without even handing it to the cashier (and they just click through the prompt that tells them to verify the signature).
I suppose its the same as any of the trade-offs we make in this society - I like the convenience, when it benefits me, but you can bet I'll be complaining should that ever come back to bite me.
Take it to the limit, everybody to the limit, come on, everybody fhqwhgads.
Since almost nobody checks the signature anyway (other than occasionally to check if the card has a signature), eliminating the signature requirement doesn't change much. However, using contactless for credit card transactions has the same security issues as any other contactless system. One of which is that the system can be surreptitiously interrogated by a fraudster. Sit down with your fraud-o-matic for 15 minutes on a Saturday in any mall, and collect hundreds of card numbers as people walk by. (and yes, if you RTFA, you'll find that some of the systems really do transmit the number in the clear)
Visa, for instance, doesn't require your signature for purchases at or below $25."
I think they've finally realized a simple truth: cashiers aren't handwriting analysts. Nor would they have sufficient sample (ie, 1, from the back of the card) to perform the analysis if one happened to be so trained.
The signature provides virtually no up-front protection. As far as I can see, the signature serves one purpose: to allow the card company/merchant to investigate, after the fact, whether purchases you are claiming are fraudulent were actually signed by you (and even that's tenuous). At best, it allows them to compare a signature in question to your past signatures to see if it matches. A signature might, at best, prevent cardholders from buying something, getting remorse, realizing they can't return it, and claiming fraud.
If I have a stolen card (and preferably a fake driver's license to accompany), and practice the signature on the back of the card 100 times, there is no way it'll get spotted at the counter.
The existing, time-"proven" cryptographic methods are too expensive, from a power standpoint, to implement on cheap RFID systems. (between secure and cheap, cheap seems to always win). So manufacturers use proprietary hacks to allegedly achieve the same type of operations (e.g., authentication via challenge/response). However, these hacks are nothing more than security via obscurity.
The Raven
The industry says it has collectively invested in a substantial backend solution designed to dynamically validate contactless payments on the fly using card verification numbers (CVCs) that are securely generated and transmitted along with account information. How this system works exactly is not known to the public, and that makes security researchers like Fu very nervous.
Translation: The industry will rely on the DMCA for security.
P.S. RFID is crap. Get a clue!
It's not a question of whether they're secure. It's a question of the fiscal sense that it makes to require or not require contact. It's very possible that the cost to require contact is greater than the cost to rectifiy fraud.
"Since almost nobody checks the signature anyway"
Its been my experience that about 10-20% of the people I had my credit card to actually look at and read the signature on my credit card. I have "PLEASE SEE ID" written in that box and it would be a stretch to say that more than 1 out of 5 purchases result in the person asking for my ID.
Often times the cashier will flip it over and look at it, but won't bother to ask for my ID. I partially do this to see if they will ask for my ID. I hope that if I ever lose my wallet and someone tries to use my credit card that they get that 1 out of 5 that actually asks for the ID.
I also make an effort to thank the people that actually do ask for my ID.
Present This Our new Venture, www.immuneid.com - Patented and ready to be a terrific oportunity to move on. Immune ID works in a very simple, safe and practical way. With Immune ID on documents, credit cards and credentials, the identification device on them will always remain deactivated unless the user activates them through physical touch. Without human contact, any reading and/or writing attempt will fail. Thus, your information is protected from harmful use. The user will also have a visual and/or audio confirmation included in the device*. Immune ID is an innovative protection system for all electronic documents using technologies such as RFID, Rubee, Smart Dots, EAS, etc.: passports, credit cards, driving licenses, access cards, etc. Some recent and important information regarding the Immune ID initiative. Hillary Clinton Initiative: http://www.washingtontechnology.com/online/1_1/298 88-1.html?topic=daily_news (following our communication)
http://rfidlawblog.mckennalong.com/archives/federa l-legislation-senator-hillary-clinton-to-introduce -comprehensive-consumer-privacy-legislation .html
US Passports Shield Demo Vulnerabilities
http://www.youtube.com/watch?v=-XXaqraF7pI
http://www.theregister.com/2007/03/06/daily_mail_p assport_clone/
http://www.infoworld.com/article/07/02/26/HNblackh atrfid_1.html
http://www.infoworld.com/video/archives/2007/02/rs a_ioactive.html
Translated article appearing in German site about Immune ID
http://64.233.179.104/translate_c?hl=en&ie=UTF-8&o e=UTF-8&langpair=de%7Cen&u=http://www.gulli.com/ne ws/immuneid-den-angeblichen-2007-01-24/&prev=/lang uage_tools
Sincerely,
- Fernando Catania
fernando@immuneid.com
Why the hell do people think having to sign something ever made anything even remotely secure?
a, it only has to match whats on the back of the card anyway
b, noone ever checks
c, even if they do, if you have the card you can copy it from the back
d, if you clone the card, you can sign it yourself in any which way you please
*ANYTHING* would be more secure than requiring the purchaser to make some arbitrary random mark on a piece of paper.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
It's time for a RFID-blocking wallet!
Those of us who think they know everything annoy those of us who do.
If you don't like the RFID on your card, you can always apply a hammer.
but transactions are tracked and they can disable it and get the plate of the car that has a cloned tag you should be able to do the same thing with other contactless payment systems.
More and more places are putting the card reader on the customer's side of the counter, so the cashier doesn't even have a chance to look at the signature on your card. Sometimes the card reader will ask you to show the card to the cashier, but I've never had to do it, and never even tried to give it to them.
Long answer: not so much.
Slashdot: you ask, we answer.
If brevity is the soul of wit, then how does one explain Twitter?
This is a play by the banks to privatize the role of the Treasury as a no-cost micro-transactions service provider.
Consumers already assume all costs of payment card fraud and rewards programs. Most are stupid enough to let this go too.
I anxiously await the uninformed posts to follow.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
As if nobody was ever robbed of their remaining cash soon after completing a cash transaction.
As if the correct change is always given.
As if a wrong bill (50 instead of 20, for example) has never changed hands.
As if counterfit money is not an ongoing problem for the last several centuries.
Keep it in perspective, people — a new technology does not need to be bulletproof to deserve a chance. It does not even have to beat an old one in all respects. Better in some respects and merely comparable in the others...
In Soviet Washington the swamp drains you.
Bad form to reply to my own post, but it occurs to me that this topic might get some people thnking about how to game the system.
For any youngsters out there getting ideas... card companies also work closely with major retailers to identify a reverse type of fraud.
One case I saw related to a woman who generated false receipts for small dollar amounts (box store multimedia retailer) and returned product that had been stolen for the purpose of reducing her credit card bills with the refunded amounts.
She was allowed to continue this activity for over a year after we were notified so that she would exceed a particular dollar amount at which time she was prosecuted and convicted at a higher level than would have been possible if she had been busted immediately.
Once again... these guys are serious. Always have refunded amounts put on the card with which you made the purchase or accept store credit instead (though one or two instances won't matter much any sort of pattern over time will). It really isn't worth getting a flag put on your account. You may never know of an investigation that takes place, but you may have a higher risk level associated with your account that can change balance increases or future offers.
r. These guys are serious and have entire departments dedicated to identifying patterns of fraud.
Thanks for perpetuating the myth that banks care. The banks place an enormous burden of proof on the retailer. The bank is assuming no liability whatsoever.
Question: what the retailer does to cover his fraud costs?
Answer: Raise prices.
Funny, nowhere in there are the banks assuming any risks.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
If the merchant has to verify that your signature matches the card, what should be on the signature box on the transaction slip?
Gasoline hasn't needed a signature for years whether it is under $25 or not.
Most any online purchases don't need signatures. Some ask for the special 3 digit code, but many don't.
-- -- Warning. Do not stare directly at the sun.
What it comes down to is that our current monetary system directly related to how much debt we have. The more debt, the more money and vice versa. Lenders make money on the interest of funds promised to be paid back - those funds don't really exist (or at least most of those funds don't - a fractional portion does).
Let's say a bank has $1,000 in the vault. In a fractional reserve system with a fractional reserve ratio of 9:1, the bank is allowed to lend up to $9,000 based on the $1,000 it has and since the federal reserve system is a closed circuit of banks, the money lent from one bank will be necessarily deposited into another bank wherein that bank can lend out a fractional percentage of the deposit (which was imaginary money from the first bank). You can see after a few iterations of this, you've generated enormous amounts of fictional money from very little actual money all based on the promise of the borrow to repay the amount borrowed.
Because the system is so prevalent and there's so much support in the federal reserve system the only way to create a real run on the bank (which would likely cause the collapse of the system) is to have everyone, everywhere withdraw all their money at the same time -- clearly something that could not happen because the bank doesn't really have the money to back up the numbers in your accounts.
Likewise, if we were to eliminate all debt, the circulating money would cease to grow because there would be no debt on which to gain interest nor any need to pull new money into existence for a loan and they system would collapse because the value of the paper money is in reality not backed by anything of value.
Scary huh?
...and that's the way the cookie crumbles.
Money well spent, for you would have looked like a fucking retard if you got 2nd post.
Then I realized that the bank will take the hit on any losses
No. You and I absorb the costs of fraud because the retailer pays a penalty and loses the income from the fraudulent activity. The retailer raises the price of her goods and services to cover these costs.
You and I also pay the costs for rewards card programs and contactless cards. Nowhere in the process does the bank assume any liability.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
As a former engineer of DigiCash in Amsterdam, I know a little about smartcard technology. There are a number of problems and risks:
1) The technology used is very old and few improvements have been made over the last 20 years or so.
2) The latest technology can cost over $10 while the older chips are a few cents.
3) Banks and politics have done their best to stifle development and have mostly succeeded.
In a word: NO. Chances are you get some 'exportable' model that supports 40bit crypto if money is involved. Otherwise, say for transit use, it may be a simple account number that is (usually) broadcast at 13.1MHz. Just because the readers appear to work at only close range does not mean the information cannot be intercepted at a range of 10's of meters or more.
The very expensive units can support 128bit or better crypto. Apart from being costly, they may be 'export restricted' and there are a number of governments that only allow very weak security. 40bits will take about a half hour to crack on a 'high-end' desktop and only a handful of minutes on a halfway decent workstation. A shielded wallet may be a common item if these chips see widespread use. A card (or passport) carefully wrapped in aluminium foil will work (to prevent unauthorized use/interception) despite any propaganda that may be out there.
As long as the 'value' is very low and you can accept losing it, there is really nothing wrong with using them. Keep in mind the chips can be destroyed accidently a number of ways and easy verification and recovery of funds is doubtful. Banknotes are still better and their use for 'small ticket' purchases is not likely to go away anytime soon.
Consumers already assume all costs of payment card fraud and rewards programs. Most are stupid enough to let this go too.
Uh...yes, they do. And who else should assume those costs?
No, not even should, who else can assume those costs? The credit card company? If the CC company doesn't pass on the costs of fraud to the consumer, the CC company goes out of business (note: using their profits to cover the cost doesn't work - if they still have profits left over, they can be accused of building the cost of fraud into their interest rates and fee schedules, which is passing the costs on to the consumer. The only way to satisfy not passing the costs to the consumer is to operate at zero or negative net gain).
If the government absorbs the costs of fraud, it takes that money from the taxpayer. Taxpayers fall into pretty much two groups: consumers and businesses. If the government passes the cost of fraud onto consumers, we haven't gained anything. If the government passes the cost onto business, then we're back to the business has to operate at zero or negative net gain, otherwise they can be accused of passing the cost onto consumers.
Perhaps the CC companies could outsource the risk to insurers - but then you just shift the profit problem up to the insurers, and you haven't gained anything (the CC company will pass the cost of the premiums onto the consumer, and assuming the premiums are such that the insurer makes money, the consumer is paying for more than the cost of fraud).
You could make a case for rewards programs just being scams, insofar as any consumer who benefits (net) from one is costing another consumer who isn't. I don't know that I buy into this, but I accept that there's a rational point of view there.
Complaining that consumers bear the cost of fraud is just silly, though. Of course they do, and there isn't another way to do it.
This is a play by the banks to privatize the role of the Treasury as a no-cost micro-transactions service provider.
I don't even know what this means. I admit, my intial reaction is that you sound like you're about to bust out a conspiracy theory starting with fiat money and ending with Roswell by way of fringed flags in courtrooms, the Kennedy assassination, and the Time Cube Truth...but I'd be more than happy to entertain your idea if you'd care to explain further.
Reality has a conservative bias: it conserves mass, energy, momentum...
This is what you all should have learned in high school.
Except. I don't agree with the outcome of eliminating all debt.
1. There will always be *some* need for credit. It's just human behavior.
2. People will always find something shiny and new to pay more than they paid last year for something a little less shiny.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
Don't you guys in the new world have chip and pin yet?
Its a million miles from perfect, but it certainly speeds up small payments and means that a crook has to clone the card *and* shoulder-surf for the PIN. Not sure any system can be high security *and* not hack off customers. OK, we use it for big payments too (perhaps they should limit the amount to 10% of the PIN!)
Alternatively, instead of setting a per-transaction limit, have a system where the *user* 'loads' the card with cash and when that is exhausted they have to provide extra verification. Otherwise, crooks just go from shop to shop notching up small purchases. I've noticed some stores limiting how many packets of cigarettes they'll sell on a card, presumably for that reason.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
There have been many descriptions of challenge/response protocols to prevent a reader being conned by a recorded message.
Ultimately any transaction comes down to trust at some point. The trick is to reduce the number of parties that you need to trust in the process.
Engineering is the art of compromise.
Once, when a duplicate charge showed up on my statement, I chewed out my bank for not checking the signature or time stamp. That's when they clued me in what data they really do receive. Then I had the opportunity to talk to a guy who writes code for CC machines (I worked with him). You know, the ones by the register. He confirmed it.
Don't believe me? Next CC purchase, I don't care where - including online - sign your name Heywood Jablowme, Dick Hertz, Mike Hunt or Whatever. Your charge will go through and nobody will ever contact you about it.
I've doing this for years with the same bank. Credit Card transactions were never safe - they're made safe by the CC companies taking the risk of BS charges.
I prefer Flambe as apposed flamebait.
Let me preface this by saying I don't like government control of the money supply for the same reason I don't like government control of anything. However, that's no reason to permit flawed arguments against either, which is why I feel the need to address these points (I'd do the same for someone too gung-ho about the Federal Reserve):
What it comes down to is that our current monetary system directly related to how much debt we have. The more debt, the more money and vice versa. Lenders make money on the interest of funds promised to be paid back - those funds don't really exist (or at least most of those funds don't - a fractional portion does).
I don't understand this: they are being paid in some medium that can purchase real goods. That's all it needs to be real money.
Let's say a bank has $1,000 in the vault. In a fractional reserve system with a fractional reserve ratio of 9:1, the bank is allowed to lend up to $9,000 based on the $1,000 it has and since the federal reserve system is a closed circuit of banks, the money lent from one bank will be necessarily deposited into another bank wherein that bank can lend out a fractional percentage of the deposit (which was imaginary money from the first bank). You can see after a few iterations of this, you've generated enormous amounts of fictional money from very little actual money all based on the promise of the borrow to repay the amount borrowed.
First of all, the bank is lending $9000 out of $10,000 that was deposited in it. Instead of having $10,000 in the vault, it has $1,000 and $9000 worth of bonds (loans). All of the money it lent is backed.
Because the system is so prevalent and there's so much support in the federal reserve system the only way to create a real run on the bank (which would likely cause the collapse of the system) is to have everyone, everywhere withdraw all their money at the same time -- clearly something that could not happen because the bank doesn't really have the money to back up the numbers in your accounts.
If that happened, the Federal Reserve would, as lender of last resort, buy the banks' loans at par value. (Part of its goal is to maintain liquidity in the loan market so you can get the "full price" of a loan you sell, when you'd otherwise have to wait for someone to be available.) If this sudden desire to hoard caused the banks' debtors not to be able to repay their loans, the Federal Reserve would eat the loss.
Likewise, if we were to eliminate all debt, the circulating money would cease to grow because there would be no debt on which to gain interest nor any need to pull new money into existence for a loan and they system would collapse because the value of the paper money is in reality not backed by anything of value.
Even if no one, at any positive interest rate, ever borrowed money, you could still grow your money by buying shares of businesses. All that's necessary for the money to grow is that people not save all of their money.
Apology to Ubuntu forum.
the chip sends a identifier and a security number. It then performs some mathemagical calculations based on the card identifier and the security number. It then processes the charge, and flashes the chip with the newly created security number as a seed for the next security number, then reads the security number to make sure it worked....You can even have a system that sends an email to a specific address whenever it is used.
Its just like the keyfobs that change every few minutes, the security code changes every time you use it, only the CC processing house and your card know the currently valid security code. If your codes are ever intercepted, the next time the theif uses it, their card gets the new code. Your card would not get the new security code, so the next time you tried to use it, its refused and you know you've been fraudulently charged... This does not allow for charges over the phone, or internet, unless you create a personal card swipe to be used for this purpose, but it allows the RFID signal to be used for convenience while minimizing risk.
The other person on /. who knows something about the payment card industry.
Read the post carefully. It's 100% right.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
it's probably not an average american debit card.
Some systems store currency value on the card. No complex or burdensome network necessary. Most authentication is handled between the chip and the terminal. Secure. Simple. Efficient. Much cheaper than letting American banks handle micro-transactions.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
OK, so let people who for whatever reason desire this no-swipe charge method, but also let people who don't trust it to keep a swipe-only method or ability to disable the RFID in their credit cards if we so choose.
Check your accounts online every day. Report any suspicious activity to the CC company. I saved myself twice by doing this. One time the number was used in the same town as a recent e-purchase, and the other turned out to be a bartender using my number to buy *free* rounds for his friends.
A promise.
Really that's it. The monetary system is backed by trillions of promises. No problems there then, and, credit card debt is unsecured (even if that wasn't a farce). Even if no one, at any positive interest rate, ever borrowed money, you could still grow your money by buying shares of businesses. All that's necessary for the money to grow is that people not save all of their money. Most of the growth on the stock market is simply inflation. Increased supply of money making it's way into the the investment markets. It just isn't called inflation. Sure some companies increase efficiency and profitability, but most of it's just soaked up liquidity.
So anyway. Back on topic. There's really no need to worry about credit card fraud, the credit card companies don't care so why should anyone else? Just check the statement with a fine toothed comb and make sure they take any fraud hit and not you. I've already explained they aren't actually taking a loss, just a slight reduction in profitability.
Hell, I wouldn't even worry all that much about declaring bankruptcy. It used to mean virtually the theft of gold, hence the rather nasty punishments. These days all it means is a little bit more inflation.
Deleted
Businesses love to trot this argument out -- Fraud raises prices -- but unfortunately, it's just not true. Say it with me -- Prices are already as high as they can be, and the cost of materials doesn't enter into it. Prices reflect demand, not costs.
Most people assume, and it used to be this way when the catholic Church ruled Europe, that prices are set by adding material cost, plus labor, plus reasonable profit. For instance, I sell chairs. I paid 10 bucks for the wood, I had to pay the carpenter 10 bucks to cut and assemble the wood, and I want to make 10 bucks profit so I'll sell the chair for 30 dollars.
This is not the way prices are set. Chairs are priced at What the Market Will Bear. I ask as much as I can get away with for my chairs, and I can even plot a curve between price and sales. There's a point on that curve where I maximize my profit, and that's where prices are set.
What, you think I'm only going to ask $30 when the market would pay $100 just because I'm such a great guy? No business ever, anywhere, at any time, has ever really "passed the savings on to you." Sorry, Crazy Eddie at the Furniture Store is lying to you on late night TV.
My costs don't enter into it. If the price of wood is higher than the market will bear, I don't raise the price of my chairs -- I stop making chairs.
Now, there is one case where increased costs do result in increased prices, and this is when true scarcity enters the picture, because scarcity alters the supply/demand ratio. Crop failure results in increased prices for lettuce because supply falls below demand and thus prices rise.
But costs that aren't tied to scarcity, don't alter the price. This is why when Sams began frisking you on the way out, prices didn't fall, and why when banks began requiring fingerprints to cash checks, fees didn't fall.
Businesses aren't going to leave money on the table. Prices are already as high as they can get away with.
He put his boots up on the table and made a face. "The sig," he smirked. "You can waste your life in search of the sig."
I have 3 cards, only one is signed on the back. Merchants never check or seem to care. I often sign "best buy sucks" or "wal-mart sucks" and it doesnt seem to matter, even when they can see it on their screen.. Or just draw a smiley face or whatever on that touch/pen pad thing... seems a bit pointless and for a few years now signing that way has never ever caused me any problems.
s/©//g
ar..err what?
finally i can read u crap articals.
how u survive this long. accepting.
anonyomous browser(whts that bwosers?) coonnections?
how friendly.
anyway what the f##$ck u think is an enemy now?
a "highly" connected stated with only (how can they
afford it anyway?) 6 million people state?
or some random selfmade (where are/ who are we)
people on still so cooool
dial-up?
get lost already.
see the signs. the REAL ones. no poins, sorry (>>)
http://www.rpi-polymath.com/ducttape/RFIDWallet.ph p
You're right if you look at most of the contactless payment mechanisms that have been deployed in the US. They are what I would call RFID, not contactless smart cards, and they're dumb, and replayable.
You're wrong if you look at what has been deployed in other places, and if you look at the standards that have been defined for contactless payment. Contactless smart cards are full-blown microprocessor cards, with secure storage, key management capabilities and support for strong encryption, both symmetric and asymmetric. One of those cards plus secure EMV transactions (I say "secure" because EMV defines several levels of security, and the lowest aren't very good) and a card-verified PIN is very secure indeed. Vastly better than magstripe. And, believe it or not, it is completely possible to perform a strong mutual authentication and a secured transaction in < 200 ms, which is as long as it takes to tap the card on the reader.
With respect to contact vs. contactless, the difference is irrelevant from a security point of view. The key to making either secure is (a) using an adequately "smart" and tamper-resistant chip, and (b) using well-designed transaction protocols that make appropriate use of cryptographic operations.
The current trend in the US financial industry is, unfortunately, focused on low cost of chips and maximum convenience. Note, however, that the low level of security doesn't affect the cardholder that much, because as it is now the cardholder is not liable for fraudulent transactions. It's the banks and merchants that absorb those costs, and if they'd rather save money up front on secure hardware and pay for it later in fraud, that's their business.
What may reverse that trend, even here, is the possible upcoming shift to NFC devices for payment, rather than contactless smart card or RFID. NFC is basically the idea of putting a smart card RF transceiver in your cellphone, plus one or more secure processing units (which look a lot like smart card chips). Given the fact that the difference between using a powerful, high-security secure processor and a cheap, low-security one is a couple of dollars, it makes a lot less sense to go the cheap route when you're embedding it in a $100 phone. When you're looking at a plastic card, a price increase of $2 means tripling the price of the card.
Time will tell if we actually do go that way, but consumers, banks, merchants and mobile phone service operators all like it, so the odds are good.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
The whole point of this shit is moot because many places still want to see the card and ID, and that takes almost as much time ( if not more ) than a regular debit purchase.
Why don't we ask any of the dozens of countries who have been using these systems for billions of transactions the past decade?
No, not really. In fact most financial transactions are pretty insecure.
Our greatest enemy is neither a single man, nor is it a nation, it is, as it has always been, our own greed.
The right one is "Are they secure enough". Personally I think they are. One thing however is who pays, in practice, pays if there is a security breach. The customer or the card company? Legally it is the card company and at least I have never had any issue. Just ignore their statement when you report a fraudulent use and tell them to cancel that. Once they sent me a nice letter stating that if I ever had bought anything over the Internet, I was not eligible to dispute charges. Complete nonsense, of course. I just requested the "original reciept", which the vendor has to provide (or some other hard proof) and they reversed the booking without further comment.
So, customers need to know their rights. On the security angle, if it turns out there is too much fraud, this payment option will just be removed again. The risk is however quite manageable.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Felica terminals that are not directly tied to the register. You ring up the correct value, it pops up on the register display. The cashier enters a higher value debit into the felica terminal. You plop your card down and are distracted by the cashier and miss the deduction which only shows up on the tiny terminal display for about a second.
I caught a cashier in Japan doing this to me.
Instead, you and I do for replying...
NIST Special Pub 800-73-1 outlines the security methods for what's called the Personal Identity Verification or PIV spec. In a contactless smart card application (not really RFID other than that it works with the same near-field principles to power it), you can use 283-bit binary field elliptic curve for PK and DS and AES-128 CBC for the symmetric cryptography (if needed). That's equivalent cryptographic security to US government secret information and is more than overkill given the potential payoff of cracking a credit card. Fast near-field smart card design is not only possible, it's being done today without the need for exotic hardware. NXP's smart card designs also happen to use asynchronous logic design for additional power savings as opposed to synchronous logic design, but both are more than capable even if you revert to good old RSA1024. Whether a scheme like this has been implemented is a different issue, but you can easily do it.
There was only one young black male in the airport terminal bearing enough of a resemblance to Cassik, but that was enough. The man was waiting in the ticket line just a few paces away, purchasing a ticket on Freedarian Airways. Just close enough... for a swipe.
...
Cassik slipped his hand into his pockets as he stepped up to the counter. He fondled the tiny homemade device in search of the activation switch. Finding it, he flipped it, and it began to vibrate in the tale-tale pattern he designed. It was searching, scanning for accessible DynaCred account cards, the universal standard currency that the World Union Bank had recently implemented. The machine seemed to take forever to normalize it's vibrations onto the signal. Cassik was trying to smooth-talk the airline agent while she looked over his forged identity card.
"Yeah, those things never look anything like you," he remarked as she suspiciously scanned the embedded chip on the I.D. card. He followed the slyly-spoken words with an equally flattering grin.
Flattery, however, took the backstage in Cassik's carnival of trickery. After-all, he had been up for two days perfecting his burn, the stolen identity embedded on his counterfeit I.D. card, and the device in his pocket. He also hadn't bathed, shaved, slept, or even rested, in any of those 48 hours,. The agent wasn't very beautiful, but she could clearly fetch someone better looking than a wrung-out Cassick, so his attempts at flattery served only as embellishment to the vastly more intricate plan he was executing.
The device was finally done searching and it made it's noisy succession of beeps. Cassik had designed the device from a cell phone; to look sound and operate like a cell phone. He raised a finger to the agent, pretending that the fraudulent call was an urgent one. It was actually a text message.
"Just a text message," He said with another hopelessly charming smile. As he said so, however, he handed over his DynaCred account card, making sure to pass it over the infra-red transmitter on his fake cell phone. The DynaCred card was also a forgery, of course. A good one. Cassik had been making similar forgeries since he was in high school and had only been caught once in the eight subsequent years. Now, his burn passed and the lifted DynaCreds successfully ghost-linked into his account, everything was now in place and Cassik smiled even more graciously than before. She smiled back this time, taking the card into her hand.
Cassik sighed a sigh of relief as this part of his plan went into it's final stages. If the lift was good, then there shouldn't be any problems, but if one digit was miscalculated, then disaster would ensue. The DynaCred authentication system was designed to silently notify first the authorities, then to display an error to the agent's terminal. Then, after the agent swipes the card a second time as instructed by the terminal, the system would re-authenticate the card, this time paying special attention to each code-bank in the passkey and if that fails the terminal is locked, and an audible alarm is sounded to alert any near-by security agents. In a high security place as an airport, the guards that were originally alerted via silent alarm would already have arrived before the second swipe had finished authenticating. That won't happen today, Cassik thought as he smiled back at the pretty airport ticket agent.
Goodness only knows if RFID cards are secure, but for small transactions like a 'bus fare they are really convenient. The whole bus system in Christchurch NZ, my home city runs like clockwork almost all the time. As you can see from the metrocard page you can check the balance in your card over the Web at any time.
Contact-less payments that is. In Hong Kong we have the "Octopus" payment card - particularly for small payments, such as bus fares (typically HK$3-15, or US$0.38-1.92), vending machines, parking fees, small purchases supermarkets and convenience stores, etc. etc. This is a pre-charged card, and mostly anonymous (as in: the card has a serial number, records of payments are being kept, but they are not registered to your name or anything unless you specifically ask for that). Charge-up is done at many points, such as 7-11 stores.
These cards are secure from the vendor point of view: payments are guaranteed made, and no cash needed. Nothing can be stolen from the shop (well the machine can be stolen but no value in that for a thief). From the customer's point of view, they are as secure as cash. Hence the maximum stored value of $500 (abt US$64), can't lose more than that amount.
And if the card breaks down, I've had that once over the last five years that I'm using them, you return the card, get a receipt and a new card, and a week or two later you can come back for a full refund of the remaining value of that card. So even then no money lost!
This system, Japanese developed and introduced some 10, 12 years ago, works really great and fast. Card is in my wallet, just swipe my wallet near the reader (few cm distance), and it's done. In a fraction of a second. At the MTR (metro) you see people swipe complete hand bags, or sometimes just their wrist as there are watches with an Octopus chip built in.
Of course no way secure enough to use as credit card, but that's not the purpose of the system. This is for small payments, anything under say $50. For bigger payments there is the (secure - "somthing you have and something you know") ATM card with PIN authorisation, or the insecure ("something you have" only) credit card. Or plain old cash of course.
Wouter.
"With respect to contact vs. contactless, the difference is irrelevant from a security point of view. "
Not so. Proxies are much easier to implement for wireless. E.g., if you have a credit card in your pocket, and PIN is not needed, I would be able to use your credit card for transactions. How? One antenna around your pocket, and one at the payment terminal. The data can easily be digitized and send to the other side of the world, if necessary. It's just an advanced way to make the antenna work over *very* long distances, it's not even a man-in-the-middle attack.
This has been demonstrated a few times, once even at the (really big) Cards show in France. This is not an idle thread, and implementing wireless credit cards without PIN is a *really* bad idea.
Easier, slightly, but certainly possible for wired or wireless. Even for contact cards, secure application designers always have to assume that man-in-the-middle attacks are possible.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
come into their own!
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
Firstly, security is black and white. There is no gray.
That being said, why would anyone want to copy your card in the first place? There are so many easier ways of beating the system. It would be possible to get a merchant account using fraudulent information, obtain a card reader, spend a day on the subway or walking the streets of Manhattan and charge $25 to every card you could read durring the day. The ideal amount to charge is the maximum that doesn't require a paper trail. The next step would be to withdrawl the money, cancel your merchant account, and lay low. Honestly, it's as simple as walking next to someone and all you need is a card reader, PDA and internet access.
And if you've ever tried to dispute fraudulent charges, it's not a fun time.
Nihilism means nothing to the dancing peasants
as an escaped mental patient.
wow, if I were you I'd be begging for a "Delete Post" function to be "magic'd" into existence. You show a complete lack of understanding about the way the banking system actually works. I mean, it's so bad that one could easily assume you posted these things just for the amusement of your fellow slashdotters, as there's no way a "nerd" could be this retarded about such things.
As somebody else said, NOTHING IS MAGIC.
1. The money that you claim they "created" actually comes from the promissory notes from the loans they give out. Loans are usually secured in some way, either by collateral or real property. Even with credit cards: many of the things you buy can and will be repo'd if the bank needs to. This is why negative equity is such a bad thing in our economy. If you have a $500k mortgage on a home that is now only worth $400k, the bank just has to HOPE that you pay it back (Well, not really, they just have to hope that EVERYONE doesn't stop paying, because they could easily foreclose your home and hold on to it until the market is better. The real problem would be if this happened enough to harm the liquidity of the bank)
2. Your little scenario assumes that there is basically only one bank, where everyone in the world banks, and that every dollar they lend out goes back into the bank as a deposit into someone elses account. Needless to say, this is not exactly how things work.
-- Sorry...no clever sig.
Randy.
They do try to leave the merchants with as much of the fraud as they can, but banks do eat part of it, and depending on the circumstances they sometimes have to eat all of it. They care about preventing fraud when it gets excessive. I'm a consultant in this industry who works with banks, merchants and technology vendors, so I see all sides of it.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.