Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
The Almighty Buck Technology

Radio Credit Cards Move Closer 295

Posted by timothy from the walk-by-mugging dept.
pvt_medic writes "CNN.com has an article about research that some major credit card companies (MasterCard and American Express) are putting into creating 'contactless' credit cards. These are similar to the Speedpass that ExxonMobil has been using for six years. What to people think about the prospect of this more widespread use of RFID? Is this something that will only lead to more credit card fraud, or will it provide more secure means of payment?" (The article comes from the Associated Press.)
This discussion has been archived. No new comments can be posted.

Radio Credit Cards Move Closer More

Radio Credit Cards Move Closer

Comments Filter:

  • Well lets see... (Score:5, Insightful)

    by AuMatar ( 183847 ) on Saturday December 13, 2003 @07:40PM (#7713042)
    We have a method of payment that can subtract electronic mone from your account, with no input from you, and without your card ever leaving your wallet? Yeah, thats a great idea....

    • Re:Well lets see... (Score:4, Insightful)

      by whovian ( 107062 ) on Saturday December 13, 2003 @07:52PM (#7713112)
      Not only that, but this part is the key:

      Jeff Chasney, chief technical officer of CKE Restaurants Inc., which runs the Carl's Jr. and Hardee's fast-food chains, says the new cards are likely to increase sales because they are so easy to use and ensure that
      a consumer won't be limited by the cash in his wallet .


      Nothing like tapping into the cowstomer's (sic) impulse buying, especially in the US.

      • Well lets see...Moo...ving money. (Score:2, Funny)

        by Anonymous Coward
        "Nothing like tapping into the cowstomer's (sic) impulse buying, especially in the US."

        I believe that Gateway has a patent on that.

      • Re:Well lets see... (Score:3, Insightful)

        by Sneftel ( 15416 )
        How is that any different than current credit cards?

        • Re:Well lets see... (Score:3, Insightful)

          by SuperMo0 ( 730560 )
          With current credit cards, you actually have to pull out the card and THINK. "Hmm... do I REALLY need this enough to charge it?" This doesn't apply to everyone, but to enough people that it makes a dent in sales.

          However, with this radio card, you wouldn't even have to remove the card from your wallet/purse/whatever, so a lot of the effort is removed and therefore you don't have as much time to think about whether you "really need" what you're buying.

          • Re:Well lets see... (Score:5, Insightful)

            by SpaceRook ( 630389 ) on Saturday December 13, 2003 @09:38PM (#7713634)
            I think this will help push sales if customer's spend less time in line. There have \been times where I've been waiting in line and thought, "Y'know, I don't REALLY need this 25 pack of CD-R's right now. I'm going to put it back on the shelf."

          • Re:Well lets see... (Score:4, Interesting)

            by TopShelf ( 92521 ) on Saturday December 13, 2003 @10:00PM (#7713719) Homepage Journal
            Are people really grabbing a product off the shelf, walking up to the register, and ONLY AS THEY'RE PULLING THEIR CREDIT CARD OUT start thinking, "gee, can I afford this?" If so, then I say fleece the morons for all they are worth. RFID in this instance provides a quicker transaction, and is thus a very very good thing.

            As for the concerns about fraud, the credit card banks addressed this a couple years back by exposing most cardholders to only $50 liability in the event of false chargers, and many cards have taken that down to zero on many accounts.
    • Hey, guess who doesn't understand how a credit card works?

      Credit card fraud costs the creditors more money than it costs the consumers. Remember, when you buy something on credit, it's not your money you're spending. It only costs you money when the monthly bill comes. If they are going to make a system for exchanging credit for goods, you better damn well believe it's gonna be as secure as possible.

      • Re:Well lets see... (Score:5, Insightful)

        by cpu_fusion ( 705735 ) on Saturday December 13, 2003 @08:19PM (#7713263)
        > you better damn well believe
        > it's gonna be as secure as possible

        Oh yes, like the wonderfully secure state of credit card use on the Net right now.

        It won't be *secure as possible* ... it will in fact, be as *secure as deemed needed* by beancounters. Those beancounters offset the minor inconvenience of a few hundred thousand people who have to deal with the shock & scare of being ripped off by holes in the new technology with the economic boost of a few more million people using their particular flavor of credit card.

        Sure, the credit card companies might cover the losses (*might, after you fight*), but there's nothing like seeing a huge charge on your credit card, that you didn't make, and having to go through the hassle of getting it resolved.

        Don't blindly think they make things "as secure as possible." That's not the economics of it.
        • Worst case is, as you have mentioned but I will highlight: you will have access to less credit that they have given you. I will repeat: wose case, you will have less access to a service someone is offering to you which they are not obligated to give you.

          Foul! Your offering to lend me money, and now you wont! Oh no! You bastards!

          And unless you complain about fraud either a lot (which makes the CC companies assume its YOU doing the fraud), or its over some amount like $3000, it gets reversed with basicly ze

    • Re:Well lets see... (Score:5, Informative)

      by asr_man ( 620632 ) on Saturday December 13, 2003 @08:23PM (#7713279)
      Wrong. RTFA. Consumer gets to make final "accept/reject" on purchase after card is scanned. Also, card includes challenge/response authentication (AMEX at least, MC we aren't told). As the article clearly states, knowing the RFID card number does not give a thief any practical means to use it.

      • Re:Well lets see... (Score:4, Insightful)

        by Midnight Thunder ( 17205 ) on Saturday December 13, 2003 @08:33PM (#7713330) Homepage Journal
        Wrong. RTFA. Consumer gets to make final "accept/reject" on purchase after card is scanned.

        Lets just hope they get the issues sorted out, so we don't have a scenario where that even though one card was scanned that it picks up the signal from another card and hence charges the wrong one.

        I have not played with the technology, but I feel that the onous is always on the technology to prove itself safe. Until then it is hard to assume the customer will be comfortable with it.
      • Haha you're funny. Let's take a look at, say, Yahoo's instant messenger protocol, or practically any other protocol out there that uses challenge-response: It's cracked in under a few months. I'm not saying the CC companies are going to use a challenge-response method as simplistic as an instant messenger program, but RFIDs will not exactly be able to perform a large amount of calculation, they just don't have the power to provide a truely safe challenge/response mechanism, and let's face it if this system

        • Re:Well lets see... (Score:5, Informative)

          by KrispyKringle ( 672903 ) on Saturday December 13, 2003 @09:18PM (#7713563)
          Yes, let's look at protocols that use challenge-response. Kerberos uses a modified challenge-response method. Windows NT prior to 2K and XP used challenge reponse, now they use a modificaiton of the Kerberos method. VNC uses challenge-response, if I remember right. HTTP digest authentication uses challenge-response. Many mailservers, (POP and IMAP, as well as SMTP) use challenge-response (CRAM MD5). The notion of challenge-response is itself secure, if implemented properly.

          Offhand, I can think of two big ways to screw up the implentation:

          Replay attacks - if the challenge is consistent through multiple authentication sessions, an attacker can reuse a hash response from a previous session. The solution is simple; better psuedo-randomness (using the date/time is a pretty poor idea, since an attacker can simply challenge the card with a date in the future and retrieve the needed response).

          Poor hashing - if the hash used on the response is reversible, the password is right there for the taking. Solution, use something known to be strong, like blowfish or MD5.

          Assuming the makers aren't stupid, they have a cryptographically secure system on-hand. You make an assumption based on a few out-of-context or unrelated cases that all security is useless. This is silly; while I don't have a lot of faith in secure systems as a whole, the flaw is rarely in the cryptography backing them, if it is implemented correctly. The reason for this is obvious; cryptography, and computing complexity, are easily-understood enough that developing mathematical models for security is easy. For example, we know--or rather, we believe very fervently, but cannot prove--that factoring large numbers is very, very difficult. Therefore, we trust RSA when implemented properly. Similarly, we know--or at least believe very strongly--that certain algorithms are very, very difficult to reverse. Therefore, we trust that if a bad guy gets our password file, he can only try to find our passwords via brute-force.

          The difficulty of sniffing and cracking the protocol used is probably much greater than that of simply getting a waiter at a restaurant to swipe the cards of customers through a skimmer (traditional cards, that is). And security is really not about absolute security; it's simply about making sure that defeating is is more trouble than it's worth (I believe Bruce Schnieder said this, but I could be mistaken).

    • That's Narrow-Minded (Score:5, Insightful)

      by cjsnell ( 5825 ) on Saturday December 13, 2003 @08:36PM (#7713341) Journal
      Who says that it has to be that insecure? I envision a little device that goes on a keychain (similar in that respect to SpeedPass), which has a little button on the side of it. You squeeze the button as you pass it over the scanner. Only when the button is squeezed does the transmitter in the device emit anything.

      BTW, why are you so paranoid about a contactless credit card? Do you eat at restaurants and pay with a credit card? Chances are, if you do, some potentially sleazy waiter has taken your credit card out of your sight for a few minutes. Not only can he copy your card, chances are that he knows what city you live in and can then get your home (think billing) address out of the phone book. On top of that, he can look at what kind of clothes you wear and car you drive and make a guesstimate about your credit line.

      • Re:That's Narrow-Minded (Score:3, Interesting)

        by toast0 ( 63707 )
        I think the reason to get paranoid is that the new technology may make the card issuer more reluctant to refund fradulent charges.

        For instance, on verified by visa/mastercard authenticode transactions, the merchant is not liable for chargebacks if the card holder says they didn't make the purchase.

    • Re:Well lets see... (Score:5, Insightful)

      by SurgeonGeneral ( 212572 ) on Saturday December 13, 2003 @08:42PM (#7713369) Journal
      We have a method of payment that can subtract electronic mone from your account, with no input from you, and without your card ever leaving your wallet? Yeah, thats a great idea....

      I see a great number of redundant posts all throughout stating this same idea.

      I think you guys are being more than just a little shortsighted. You read something about a RFID credit card and jump to a horrendous number of conclusions about how this technology will be used. Give it a little thought:

      The most likely candidate for a technology to be paired with this is Biometrics. We're all quite familiar with this technology, and its easy to see how it would be coupled with RFID CCs.

      But we can come up with something a little less "futuristic". I belong to a tennis club that uses RFID encoded cards for entry in to the building, but they are also used for purchasing food. What happens? You swipe your wallet (containing the card), and the computer in front of the salesperson (yes we have those nowadays) brings up a picture of me and all my personal information. If anything seems fishy, they ask for a signiture.

      Now considering that this technology is not going to be immediately implemented, and will not be forced upon the general public, I think we can give at the very least a few more years before it becomes ubiquitous. In that case, use your imagination (I know its hard since tech evolves so quickly) to come up with some solutions to the pedantic and generally trivial questions just like this one that everyone is posing.

      • Re:Well lets see... (Score:3, Insightful)

        by Ryosen ( 234440 )
        I don't think that the issue is so much one of someone using your keychain to make purchases. Rather, it's some criminal scanning your tag as you walk past and using the information for fraudulent purchases of their own. I'm more worried about getting scammed this way than finding out that I supposedly bought a shirt the last time that I was walking through Macy's.

        The technology is nothing new, of course. Mobil/Exxon has had this for several years in the form of SpeedPass. I've never used it, however, and

    • Re:Well lets see... (Score:2, Informative)

      by thebes ( 663586 )
      Ummm, Hello? That's called, memorizing a credit card number, expiry, and buying stuff on the internet.

      A 16 digit number is nothing to memorize, and the expiry date can be pretty easy as well. There's lots of people out there (more so in the mathematics/physics field) that can just look at a number, and a few moments later, be able to write it down.

      So really, what's to prevent someone who works at a restaurant who takes your CC and memorizes the number, let alone write it down?

      Af far as security for in

    • I use to have something that could bleed my account dry without any input from me. It was called a wife.

  • How safe are they? (Score:3, Interesting)

    by Pingular ( 670773 ) on Saturday December 13, 2003 @07:40PM (#7713045)
    They better be sure their encryption is up to scratch. I was reading just the other day ( I believe it was on Slashdot) that there are supercomputers now that can break 128bit encryption in a matter of minutes.
    • Yeah, and my office building handles much more sensitive data than a CC and it has much more, shall we say, more "mature" technology in the access cards used. I don't think it is that big of a deal. As it is, anyone with rudimentary "Radio Shack skills" can program a magnetic strip for an ordinary non-smart-card CC.
    • Quote from the article --
      "
      In theory, the transaction could be intercepted without a consumer's knowledge by a technologically savvy thief intent on cloning a card. That's because RFID transmissions themselves are not encrypted.
      "

      But there's also -
      "
      American Express makes the RFID reader verify the card's authenticity with a "challenge-response" exchange that depends on 128-bit encryption encoded on the chip. ...
      MasterCard says it uses a different security system but would not provide specifics.
      "

      I don't know
    • well damn I better stop using my SSL enabled browswer then to check important things.

  • Rejoice! (Score:5, Funny)

    by drewbradford ( 458480 ) <drew@drewbradford.com> on Saturday December 13, 2003 @07:41PM (#7713047) Homepage
    This will make charging people to walk past my house much easier. In the past it's been tough for me to collect the $50 that I charge.

  • Faster than cash? (Score:5, Funny)

    by Isopropyl ( 730365 ) on Saturday December 13, 2003 @07:41PM (#7713049)
    "In some instances it's faster than cash," said Betsy Foran-Owens, a MasterCard vice president. "You're eliminating the fumble factor."

    I agree. Nothing's more annoying than handing someone $10.15 for a $5.15 bill and watching the other person take out a calculator.

  • easier to steal cc number (Score:3, Insightful)

    by jbplou ( 732414 ) on Saturday December 13, 2003 @07:43PM (#7713058)
    Won't this make it easier to steal someones cc number now. Since all some will have to do is hide a sensor of some type in a mall or someplace that can pick up the radio frequency?

  • Scanners (Score:4, Insightful)

    by alset_tech ( 683716 ) on Saturday December 13, 2003 @07:43PM (#7713060) Homepage
    Another reason to sniff the wireless frequencies. You may not be able to get into most cell networks these days, but this will bring all kinds of fun the the quest. Someone will figure out how to hack this inside three months. At least right now I have to match a signature (though nobody checks the card) and my debit card has my picture on it. God knows I won't want to get one of these.

    • Re:Scanners (Score:4, Insightful)

      by KrispyKringle ( 672903 ) on Saturday December 13, 2003 @07:58PM (#7713144)
      It's not very hard to make this secure. This isn't done with current credit cards, but so long as we're building a new system, make 'em smart cards. Put a chip in them that stores a cryptographically random private key. When sent data (say, some random chunk to prevent a playback attack), it spits out the encrypted version. Then the credit card company can verify against the known public key (or give them a copy of the private key as well, so it's more like challenge-response) to make sure you really have the private key. Perfectly secure (at least until someone perfects quantum computing, or unless the NSA--who really doesn't need to waste time cracking my credit card--develops a way to factor large numbers).

      Of course, for traditional use, like online, you could use the traditional CC#.

  • No Problemo (Score:5, Funny)

    by the eric conspiracy ( 20178 ) on Saturday December 13, 2003 @07:43PM (#7713065)
    I predict a booming market in shielded wallets.

  • Bad Idea (Score:3, Interesting)

    by wsloand ( 176072 ) on Saturday December 13, 2003 @07:44PM (#7713066)
    Now someone can pickpocket me by just bumping into me on the subway. It would be relatively simple to just read the card with a device in my pocket from someone else's pocket. How hard could it be to make your own RFID device that gives out the same number?
    • No. It doesn't work this way.

      American Express makes the RFID reader verify the card's authenticity with a "challenge-response" exchange that depends on 128-bit encryption encoded on the chip. That strength of encryption is considered safe against "brute force" attacks, in which a hacker tries every possible combination.

      MasterCard says it uses a different security system but would not provide specifics.

      I don't really think they're that stupid. Presumable there's a secure private key on the card (in

      • If there a challenge-response, then the device is not entirely passive, so it must have an energy source ? Then it is possible to exhaust it with a lot of non-legit requests ?

        • Re:DoS vulnerable ? (Score:4, Informative)

          by KrispyKringle ( 672903 ) on Saturday December 13, 2003 @08:54PM (#7713438)
          I'm not an electrical engineer, but Google turns up this [inttechnology.com] page for security proximity cards, which are essentially the same product.

          The card is usually passive (without an internal battery) and consists of an antenna and an RFID ASIC (Application Specific Integrated Circuit). During operation, the transmitter sends out an electro-magnetic wave to establish a zone of surveillance. When a card enters this zone, the electromagnetic energy from the reader begins to energize the IC in the tag. Once the IC is energized, it goes through an initialization process and begins to broadcast its identity.

          So it seems like the cards use induction to get just enough juice from the radio waves to power their internal circuitry. No battery needed.

    • Now someone can pickpocket me by just bumping into me on the subway.

      As opposed to before, when they just had to bump into you on the subway.

      What an age we live in!

  • PIN (Score:2)

    by Duncan3 ( 10537 )
    You still have to enter your PIN in the little keypad... Hit the little confirm button for the maount...

    It's not really saving that much time.

    But it sure is cool! (for the crooks)
    • This is the thing:

      I use a credit/debit card for everything, I seldom have more than $40 in cash on me. In place of a signature on the back of the card I have always put down "Check ID" To me this is the least that a store can do to reduce the chances that my stollen card might be used to purchase things for the thief. In recent years though I have noticed that many stores now have card swipes that the customer uses as opposed to the clerk. This looks like a time saving thing but really what it does is make
      • " In place of a signature on the back of the card I have always put down "Check ID" To me this is the least that a store can do to reduce the chances that my stollen card might be used to purchase things for the thief."

        Checking anything other than the signature on the back of the credit card is usually in violation of the retailer's agreement with the credit card company.

        A.

        • Re:PIN (Score:3, Insightful)

          by toast0 ( 63707 )
          The card itself (checked a mastercard and a non-credit atm card) says 'Not valid unless signed', which would lead me to believe a merchant should refuse transactions from people with Check ID written on the card, unless they happen to be named 'Check ID'

          The merchants who really care about the id of their purchasers ask to see my fake id when i use a stolen card anyhow.

    • It would save me a lot of time. My wallet is constantly erasing the mag stripes on my cards. I can't wait to ditch them for a contactless card.

  • Bring'em On! (Score:3, Funny)

    by Jah-Wren Ryel ( 80510 ) on Saturday December 13, 2003 @07:45PM (#7713076)
    I have *the* patent on lead-lined wallets (and tin-foiled lined ones too) so I say the sooner these wireless cards come to market the sooner I can become a rich man!
  • Brilliant technology..

    I walk into Wendy's and buy burgers for the next ten customers. great!!

    Oh, and a thief can't steal your "REAL" credit card number, but they can duplicate your RFID, so they never NEED to steal your "REAL" credit card number.

    This needs serious work!

  • There is a (sort of) working example (Score:3, Insightful)

    by jonbryce ( 703250 ) on Saturday December 13, 2003 @07:46PM (#7713081) Homepage
    Transport for London's Oyster Card is a contactless ticketing system for the London Underground and London Buses.

    At the moment, it can only hold season tickets, so it isn't a great problem if you accidently use it. From next year, you can hold other types of ticket in there as well.

    It has some advantages, like being able to recharge it over the phone or online without having to wait for the tickets to arrive through the post.

    You can get through the ticket barriers without taking it out your bag, though you have to hold the bag petty close to the sensor.

    People don't like it because it allows TFL to trace your travel habits much more than they could before.

    In the case of credit cards, I can't see how just holding it close to a sensor could be evidence of your approval of the transaction. You would need some sort of verification process like a signature or a PIN/password.

  • Widely used in Hong Kong (Score:3, Informative)

    by G4from128k ( 686170 ) on Saturday December 13, 2003 @07:47PM (#7713086)
    The Octopus card is widely used in Hong Kong. Its a stored value card, so its anonymous. It started life in the MTR (the local mass transit system) and has since expanded to convenience stores, Macdonalds, Starbucks, etc.
  • A credit card charge station, and a direct deposit account...

    A good vantage point at the local shopping mall and I'm a rich bastard.

  • ...tin foil panties being showcased in VictoRFID's Secret...

  • Combination cell phone, EZ-Pass and RFID jammer.

  • "American Express makes the RFID reader verify the card's authenticity with a "challenge-response" exchange that depends on 128-bit encryption encoded on the chip. That strength of encryption is considered safe against "brute force" attacks, in which a hacker tries every possible combination."

    This seems like a big mess waiting to happen. All it takes is one leak or crack of the secret key and the entire RFID credit card system will come crashing down.

    Once the secret key gets out, we'll see thieves with mo

    • Re:Credit Card Theft? (Score:5, Informative)

      by KrispyKringle ( 672903 ) on Saturday December 13, 2003 @08:11PM (#7713206)
      That's now how challenge/response works. See here [techtarget.com].

      Basically, the idea is that if both you and the authenticator know the secret password, but you don't want to transmit it, the authenticator sends you some random chunk of data, say message M. You encrypt it using some (presumably one-way) algorithm, using your password as the encryption key to create W. The authenticator also encrypts the same chunk, and, when you send back your W, compares it do his own known-good W. Assuming they match, it means you have the password. The password itself is never sent plaintext.

      You seem to be assuming that there is one secret key for the whole system. This would be completely useless, and is obviously not the case. You would need one secret key per person, as I'm sure American Express knows.

  • The merchant never touches it? (Score:5, Interesting)

    by rMortyH ( 40227 ) on Saturday December 13, 2003 @07:52PM (#7713114)
    The idea that the merchant doesn't have to touch the card makes it pretty unlikely that they'll check the id and the signature of the buyer, so this encourages fraud. It should at least require a PIN.

    Also, there is no way for the customer to control access to the card. My sister recently picked me up at Kennedy airport, and as she was holding the parking fee money out the window, the attendant charged the fee to her EZpass because he was too lazy to look up. There wasn't enough room on the pass so she got hit with a penalty. He wouldn't even look up from his paper when she complained.

    So you'll have to keep your card in a metalic wallet, because the lack of physical contact means you can't really control when it's accessed.

    It's interesting that I can build a wand and get someone's information off the license in their pocket. Now you could potentially get their credit card number too.

    It may be slightly faster, but beyond that I don't see how it's better for the consumer or the business.

    • The merchants don't touch the card in most of the stores I go into already. In most stores, I swipe the card myself. They use one of the electronic pen pads for me to record my signature. The cashier never even looks at the card. So in that respect it is no real change.

      Since fraud is a major expenditure for credit card companies, I would guess that they would worry about the fraud implications of this new type of credit card. If they are seriously considering it, they must not believe it will increas

    • Re:The merchant never touches it? (Score:4, Interesting)

      by sonamchauhan ( 587356 ) <sonamc@PARISgmail.com minus city> on Saturday December 13, 2003 @08:41PM (#7713363) Journal
      Also, there is no way for the customer to control access to the card.

      Seriously though, excellent point.
      I made a similar point here [slashdot.org] in the article on fake ATMs -- even smartcards (contactless or otherwise) with PK crypto are susceptible to attack by fake-front ATMs unless they present an on-board interface so that the buyer can control the transaction.

      Otherwise, the buyer will just see the seller make a "big sucking sound".
    • Few merchants checks credit card signatures.

      Here's a funny link posted to slashdot some time ago: the credit card prank. [zug.com].
  • What to people think about the prospect of this more widespread use of RFID? Is this something that will only lead to more credit card fraud, or will it provide more secure means of payment?

    Fraud. All you have to do is take a small mobile credit card scanner and keep it in your pocket... walk around in a crouded shopping mall where everyones credit "cards" are in their pockets and see how many you can scan.

  • Coming soon... (Score:2, Interesting)

    by adept256 ( 732470 )
    How long before they decide to make one of these into an implant? I bet they have scientists working around the clock inventing new ways to spend money. So imagine when your credit runs out; They don't just cut up your card, they give you surgery. Obligatory aphorism: A fool and his money are soon parted.
  • It looks like the card has to be held within about an inch or two of the reader. Kinda hard to steal other peoples' card info without their knowledge.
    • Yep:

      However, the thief would have to get quite close to his target or have a very sensitive reader.

    • It looks like the card has to be held within about an inch or two of the reader. Kinda hard to steal other peoples' card info without their knowledge.

      For a thief that's a piece of cake in crowded public areas such as malls, markets, airports, public transportation, etc. except now he doesn't have to gain possession of the physical property, like a wallet, but simply stand in line or pass by closely next to another person. Encryption... that's a different topic.

      Speaking of airports, they could install the

  • prove it (Score:5, Interesting)

    by mabu ( 178417 ) * on Saturday December 13, 2003 @08:09PM (#7713195)
    I am always suspicious of any new technology whose benefit isn't readily obvious to its potential market. So the value of RFID cards are that you don't "fumble" as much? That's ridiculous. Most outlets allow the customer to swipe their own credit cards, so what is the difference between holding it in front of a reader and swiping it? I know some idiots can't line up the mag stripe on their card sometimes, but do we really need a whole new technology because of that?

    It's obvious where the benefit of this is: surreptitious extraction of information and account data. Sit down on a bench with a reader in it, and all your credit card data was just captured. Walk in the door of an establishment and your RFID cards are scanned and the next day you get junk mail.

    I feel the same way about "debit cards". These afford the consumer less protection and security than credit cards (which are protected under the Fair Credit Billing Act of 1976) yet this new gimmick was foisted upon consumers offering more convenience. BS.

    No thanks. This is not any technology that benefits consumers from any angle I can see.
  • A lot of people carry around at least one major credit card, at least one debit card issued by their bank that's VISA or MasterCard branded and can be used anywhere a credit card can, and at least one store credit card -- some of which (Macy's for example) are also now VISA or MasterCard branded and can be used anywhere.

    Exactly how this system is going to magically know which card to use is... beyond me. Of course, MasterCard and Amex don't need to worry about that, because of course you're just going t

  • Screw Credit (Score:2, Funny)

    by gmhowell ( 26755 )
    Screw credit cards, I always carry plenty of cash [maxrules.com].
  • Before someone figures out how to spoof EZ-Pass. Any challenge/response that goes out over the air can be sniffed. How long before some clever person figures out that to make X return signal you need a card coding of Y?

    Anything that I have to carry around in a foil lined wallet to keep it from squealing on me or being charged without my knowledge just isn't worth the few seconds of convenience in my book. When we have to employ some wild weasel jammers on our person to keep the RFID tags in our clothes

    • I believe there's some sort of sequence number sent as part of the response from the EZ-Pass toll transponder, and that it's incremented each time the transponder sends an interrogation response. When the toll reconcilation is done, an already-used sequence number or one that's lower than one previously used will flag the account for attention; this makes transponder cloning a relatively unrewarding activity. (Since toll reconciliation isn't a real-time process, the "lower than previously-used" test is actu

  • security concept (Score:4, Interesting)

    by LuxFX ( 220822 ) on Saturday December 13, 2003 @08:19PM (#7713260) Homepage Journal
    The biggest security issue that I can think of off the top of my head (other than theft or loosing your wallet) is if there are scanners set up that might intercept your credit card information.

    So here's a concept. When you make a purchase using the RFID credit card, these steps happen:
    1. the cash register sends a HELO type signal
    2. the credit card responds and requests an encryption key
    3. the cash register randomly generates an asymmetric encryption key valid for that transaction only, and send the 'public' portion of the key to the credit card
    4. the credit card encrypts the transaction information using the 'public' key it received and send it to the cash register
    5. the cash register uses the 'private' key to decrypt the information and process the transaction.

    This way, the only information being transmitted is either encrypted, or a public key which isn't useful in decrypting the information.

    The other concern I can think of off the top of my head would be people carrying devices that could fake a transaction -- so a thief would just be walking behind somebody, making a transaction through a device in their pocket, and walk away without a trace. Not sure about this one, though the first step would be high security on the transaction protocol.
    • Ok, I admit I had no idea that what I was describing was SSL. It just seemed safer than the standard encryption mentioned in the article (which I finally got around to reading).

      The article mentions that range is the primary protection against my second concern, but I find it conceivable that a significant power boost could bridge that....

      <humerous anecdote>
      I used to work in a building that required those proximity RFID security cards for entrace. They must have had the power cranked up plenty thou

  • Pick Pockets (Score:4, Interesting)

    by cybercuzco ( 100904 ) on Saturday December 13, 2003 @08:19PM (#7713262) Homepage Journal
    You know, currently theres a problem with waiters and waitresses and other service industry folk (a few) that take your credit card while you are paying your check and read the card with a pocket reader, storing the info for later for credit card fraud. I can see pick pockets now: You are bumped into while walking, you check to make sure your wallet is there, which it is, but your info has been stolen by a contactless RFID system.

  • Probably based on ISO 14443 Secure RFID spec (Score:3, Informative)

    by Anonymous Coward on Saturday December 13, 2003 @08:20PM (#7713269)
    The spec has successfully been used by the German transmit authority to curtail fraud in their system.
    It uses challenge-response encryption so it is very resistant to "man in the middle" attacks and snooping. Operates on a near-field magnetic-load method of communication.
    This means that the main transmitter senses changes in the energy load as a method communication. The RFID tag just gets its power from the magnetic carrier and changes the magnetic load to communicate. This makes it more difficult to snoop than RF because the energy and communication transfer is bound into a closed loop.
    One other point, magnetic load technology has a range that is proportional to the antenna. A 18 centimeter antenna has a range of 18 centimenters if it is built correctly. With a fundamental frequency of 13.56Mhz, the theoretical maximum range is 3 meters (16% of wavelength is the maximum range for the near field). This means that you would need a 3 meter (~10 foot) antenna to reach ten feet. People would tend to notice this.

    Just some info.

  • The Raw Facts... (Score:5, Insightful)

    by AsnFkr ( 545033 ) on Saturday December 13, 2003 @08:21PM (#7713272) Homepage Journal
    ..are that your credit card number is everywhere. If people want numbers, they will get them. If they get yours - then thats bad luck. All you have to do is keep an eye on your credit card statements and make sure all the charges are yours. If they aren't call the credit card company and tell them. It's easy as pie. I kills me when I see people overly paranoid about thier CC#'s. I mean, comeon...you go to a restraunt and GIVE your waitress or waiter your card to carry across the room away from your eyes and run it through the machine. If they wanted, it wouldnt be hard for them to copy the numbers. Then..up on the net in a flash. Point being...security for this type of thing is nice, but don't let yourself get lazy depending on it. Keep checking those statements!

  • This could be secure if..... (Score:3, Interesting)

    by G4from128k ( 686170 ) on Saturday December 13, 2003 @08:27PM (#7713303)
    The two most common threats to consumers who would use the system would seem to be:

    1. Charge Theft: the thief charges your card by bringing a payment terminal near you. This depends on the security of the payment terminals. If the credit card processing system authenticates the terminal, then it would be hard for the thief to use the terminal to get the money. Even if the thief steals a terminal, the only thing that would happen is that the money would go to the retailer where the thief obtained the payment terminal. The real threat comes from a home-made or modded terminal. But this approach also requires a break in to the credit card processor to hack a record for the hacked terminal to ensure that charges to that terminal goes to a destination of the thief's choosing.

    2. Card Theft: the thief remotely steals a person's card. This seems highly unlikely. The card would need to provide enough data in a reasonable number of monitored transactions to enable the thief to deduce how the card would respond to any future transaction. I would assume that the system would use a highly encrypted challenge-response system that would make it hard to reverse engineer the parameters for the response from a reasonable number of data points. But if someone hacks or steals the algorithm that is used to create the cards, then all bets are off.

    It seems like the system could be secure if the encryption is sufficiently good and the data terminals are well controlled.
  • Ya know, this is one of my big pet peeves. First they put those self swipe things on the customer side with one of the intentions being to keep your card information to yourself. But that is pointless because all the stores have adopted a policy of checking your signature anyways. Appearently they don't see it as a security risk for the customer.

    Now we're talking about radio credit cards? What is the point? The cashier is only going to ask to see it as well, the only thing it might hope to help is we
    • See, they even say it in the article:

      "The card companies say the system is much faster and safer because the card never leaves a customer's hand."

      Dumb.

    • Re:Only more stupidity (Score:3, Insightful)

      by mabu ( 178417 ) *
      Where you really get screwed is not the change in the technology from mag stripe to RFID. It's the banks switching you from a true credit card, to an ATM/debit account. Then you're not protected by law for the consequences of fradulent transactions.

  • ATM Fraud (Score:3, Interesting)

    by sfe_software ( 220870 ) on Saturday December 13, 2003 @08:35PM (#7713340) Homepage
    There's lots of discussion about how someone can just sniff the transaction or plant hidden RFID readers, and they are being debunked by the fact that there's some sort of challenge/response encryption.

    Fine, except given that some thieves have gone as far as to obtain a legitimate ATM machine to steal ATM card/PIN numbers, how much more difficult would it be to obtain an RFID credit card reader? Whatever public keys or key database a scanner needs would be taken care of, as it would all be purchased/leased for a seeminly legal purpose. At this point it would be trivial to plant the reader in a location that people tend to walk by, and unless there's some kind of PIN verification, you've got all you need.

    Thus, the user doesn't even have to knowingly make a transaction as with the ATM scams.

    If there's PIN verification, an on/off switch, or a lead protective storage pouch... then we're in the same place we're at now; but if all it takes is the user to click "OK" on the scanner, then obviously there's no security there (only against accidental scans at a legitimate establishment).

    Any thoughs?

  • 2066 (Score:2, Funny)

    by Dylancable ( 718004 )
    In next issue, How to create a wifi cc reader.

  • Things that consumers should avoid (Score:3, Interesting)

    by mabu ( 178417 ) * on Saturday December 13, 2003 @08:43PM (#7713376)
    This is just IMO FWIW but I believe RFID is one of many types of new services that really are more dangerous and insecure than they are beneficial. Technologies such as this shift the burden of responsibility from the merchant to the consumer. The big corporations have a vested interest in doing this and they engage in PR campaigns to snow-job consumers into thinking that their new products are better, when they are worse.

    Here's a sampling of examples of things I'm talking about that consumers should avoid:

    * RFID

    Tremendous security & exploitation potential; virtually no discernable advantage to using this technology. Corporate interests claim the adoption of RFID will help reduce costs and curtail shoplifting and fraud. There is no real evidence to support this and consumers should be suspicious of this technology.

    * Debit and ATM cards

    Tremendous security and fraud potential. Not covered under many existing laws regarding credit card fraud. Regular credit cards are much more useful as the consumer shifts the burden to the merchant to prove a transaction was valid before paying for anything unauthorized (generally speaking but some banks have similar "consumer protections" they *claim* but credit card fraud protection is covered by Federal law). With debit cards, you lose and the burden is on you to prove the transaction is illegitimate. These are gimmicks designed to make money for the credit companies and give consumers less fraud protection. All the hype about identity and credit card theft is blown out of proportion and further used to scare consumers into, ironically, using technology that actually is less secure.

    * Rebates

    Misleading advertising; basically a tax on laziness. People should avoid purchasing anything that offers a rebate unless it's instant at the POS.

    * Considated utility services

    It's really bad to have multiple cards from the same bank, or use a single company for internet, cable and local phone service. The first time there is a billing snafu, every single one of your credit cards will be declined (if they're from the same bank - Citicorp loves to do that shit) or you lose phone, internet and cable TV if you're foolish enough to use one company for all these things.

    In addition to that, there's the huge security and privacy issue of having one large company handle so many of your essential financial services and utilities. It's much more likely the information will be used against you than to enhance the quality/convenience of your life, so don't buy into the hype these companies spew about the "all on one bill convenience" they offer if you use one company for multiple services.

  • Security.. bah. (Score:3, Insightful)

    by mindstrm ( 20013 ) on Saturday December 13, 2003 @08:54PM (#7713434)
    Look. Here is what I care about with my credit card:

    - If reasonable proof can't be shown that I personally authorized a transaction, I will not be held responsible for it.

    That's it. That's all. The line of credit is between me and the issuer... the card is simply a token that represents that. Historically, you had to be there in PERSON to use one.. but everyone looks the other way for convenience, online work, etc.

    I don't care what method visa or whoever comes up with to represent that token. If it's less convenient for me, I won't use it. If it somehow rips me off, I won't use it. If it makes me more liable for fraud, I won't use it. If they take all the risks, I don't care if it's a smart card or a credit card or a proximity card.

    Now.. that said.. having proximity cards / RFID type cards does bother me.. it seems like a bad move. It doesn't give ME, the customer, anything I really want. So.. it simply won't fly.

    I won't have my credit card dictated to me.. its' not about the card, it's about the agreement... and about credit.

  • Bad deal (Score:4, Interesting)

    by acidrain69 ( 632468 ) on Saturday December 13, 2003 @09:00PM (#7713479) Journal
    It is ONE LESS form of identification for someone to have. Instead of having a credit card with your signature and possibly picture on it, now you have a little piece of plastic with some embedded silicon that the sales person doesn't even have to LOOK at to verify you.

    How is having some bits in a RFID chip any stronger security-wise than having bits on a magnetic stripe?

    There is no consumer benefit to this. The only one who benefits is the company making the sale because it makes things easier to buy. That's just what we need. As if things werent' easy enough to buy already.

    The only POSSIBLE benefit I can see to this for a consumer is it sounds more durable; no stripe to get worn down.

  • this would actually be easy to make secure (Score:5, Interesting)

    by sbma44 ( 694130 ) on Saturday December 13, 2003 @09:17PM (#7713557)
    RFID is inherently a passive technology. But don't confuse passive with always-on.

    Why can't we just put a button on the little RFID dongle you would put on your keychain? Answer: we can. And this is what the CC companies should do. I know, speedpass doesn't implement it. But it would be very, very simple to do and go a long way toward easing my fears about this. I'm envisioning something similar to a Photon light.

    Even better, why not pair it with an always-on RFID in your wallet, and only allow transactions when both are present? This'd prevent simple theft by valets, pursesnatchers, etc.

  • I get with a rfid tag will get cut up and the CC company will lose a gold card member :)

  • In Store Sensors (Score:3, Insightful)

    by nurb432 ( 527695 ) on Saturday December 13, 2003 @10:00PM (#7713716) Homepage Journal
    With those things, the store could identify you as you come in, and target in store ads for you, using previous purchases as a guide.

    Or once we have tagged currency, they can see if you can even afford to be in the store or not..

    And provide records to the government, ' ya he was in our store at such-and-such a time date' ...

  • I wish you people would read the article first... (Score:3, Interesting)

    by Anonymous Coward on Saturday December 13, 2003 @10:15PM (#7713804)
    ...but this is slashdot, after all.

    However, the thief would have to get quite close to his target or have a very sensitive reader.

    Hmmm. Build a powerful RFID reader and walk through a large crowd of people collecting RFID numbers. Warwalking!

    Also, the account number on the contactless cards is useful only in the RFID system -- it's not the same as a user's credit card number. A crook would thus not be able to use the card number to go on a fraudulent Internet shopping spree, for example.

    But you could use it in person - build a RFID transmitter. After, the key fob never has to leave your pocket - how does the clerk know if it's real or the PDA-sized RIFD cloner in your pocket.

    American Express makes the RFID reader verify the card's authenticity with a "challenge-response" exchange that depends on 128-bit encryption encoded on the chip. That strength of encryption is considered safe against "brute force" attacks, in which a hacker tries every possible combination.

    It's good to know that some people have a clue in designing a secure system.

    MasterCard says it uses a different security system but would not provide specifics.

    I'll reserve judgment.

  • RFID = symptom of the real problem (Score:3, Insightful)

    by carcosa30 ( 235579 ) on Saturday December 13, 2003 @11:06PM (#7714012)
    You know, I share the concerns about RFID and pervasive cameras. But these are symptoms of the true problem, which is a spiralling police state in the US (as well as elsewhere) which is arrogating more and more authority to itself and behaving more belligerently.

    It's also starting to intimidate dissidents.

    If we could trust the government and corporations (yeah right) RFID would be no problem at all.

    Since we can't, attacking RFID and other intrusive surveillance technologies is only applying a bandage to a gangrenous wound.

Slashdot Top Deals

An authority is a person who can tell you more about something than you really care to know.

Close