MasterCard To Distribute RFID Credit Cards 382
wellington writes "Reuters is reporting that MasterCard expects to have 4 million "pay pass" cards in circulation by year's end. These new cards will be equipped with a radio-frequency chip that allows customers to pay for purchases by simply waving their cards at readers posted near cash registers or gas pumps." The cards, previously covered on Slashdot, were announced earlier this year.
More fraud? (Score:5, Interesting)
Hope you don't have your ID, they might get that info, too.
Re:More fraud? (Score:5, Interesting)
MC's gamble is that contactless payment will thus thwart more fraud than it facilitates, while simultaneously encouraging consumers to buy more goods and services, because the PayPass transaction is perceived to be "easier" than exchanging cash or presenting plastic.
Re:More fraud? (Score:5, Insightful)
transaction is where the cashier checks your signature against the one
on the back of the card. If you just touch the card, there's no way
for anyone in authority to verify that you are you. This makes me
slightly uneasy. Handing the cashier the card and signing wasn't
really that hard.
The only place where RFID cars are convenient is for rapid transit
fare control. You want to get through quickly, and swiping a card is
actually cumbersome. When I first experienced this was when I was in
Japan, and the normal card readers there were pretty good so it wasn't
much of a difference. (More of a novelty really, but I bought in and
used JR instead of the subway for my monthly pass... google SUICA if
you're interested.)
Here in Chicago, though, it's great. The normal farecard readers take
*forever* to read the card (you'll know this if you're from Chicago),
but the new RFID-based "Chicago Card" is really really fast and speeds
boarding onto busses which means you get a seat quicker and get to
where you're going quicker.
But for credit cards, this is a security risk.
Re:More fraud? (Score:5, Interesting)
The cool thing about it is you just add money to it as needed, it's not tied to any personal bank account or linked to you in any way. If you lose it, you are out of luck but even if someone could hijack your signal, the most you'd ever lose is what was on the card.
Thinking of it just now, Hong Kong is pretty damn high-tech. You'd think if it was so easy to capture RFID, there'd be signs say "Be sure to protect your card" or something. There were plenty of signs everywhere warning you of various laws and dangers. Everyone, and I mean everyone, has one of these Octopus cards in Hong Kong (well, I read 95% of them do because noone has cars.)
Re:More fraud? (Score:5, Interesting)
I would appreciate that when I buy a laptop or something that they would pretend to watch me sign the receipt, though
Re:More fraud? (Score:5, Insightful)
People don't expect to have their signature checked, especially for small purchases. I've worked as a clerk, even people who write "SEE ID FOR SIGNATURE" on their card's signature line will be confused when you ask to see their ID, most forget they have it written on their card or are not used to actually being asked for it.
Maybe in the US (Score:3, Insightful)
Re:More fraud? (Score:4, Interesting)
Personally, I do the see ID route. I get angry when most stores don't check. A gas station we have in western PA, Sheetz, doesn't actually require a signature for amounts under 20$. So they don't bother checking. I don't know whether I'm okay with that or not, but I guess that, since it's under 20$, it's no big deal, to either party.
But that's enough rambling anecdotes for the day.
Re:More fraud? (Score:4, Interesting)
Re:More fraud? (Score:5, Interesting)
- waiting for the customer to get search through their wallet for the right card,
- swiping it a few times,
- forgetting to press ok to confirm transaction,
- waiting for the system to connect and authenticate,
- waiting for the slip to print out.
Handing the slip to the customer, them squiggling on it and me having a quick look to see if the two squiggles was not the hold up in the process.Re:More fraud? (Score:3, Informative)
Having done a lot of bar work, it's surprising how much the customer does hold up the whole process of paying. The whole hunting for cash thing is irritating, but so is the downright stupid "I don't know what I want yet". Uh-huh...
What irritated me the most though were the customers who carefully placed their money on the bar in front of you, while you stand there with your hand out to receive said money. All too often
Re:More fraud? (Score:3, Insightful)
Think of it from the customer's point of view: he would have to remember the UI for every POS system he uses. Meanwhile, you use the same one, all day, and onl
WOo double confirmation (Score:4, Informative)
When I'm doing design, I always look for places where security requirements of the system have placed an automatic confirmation step, and eliminate any confirmations before that. If necessary, put a summary of what's about to happen in the same place that the security check takes place.
Re:More fraud? (Score:3, Interesting)
Nah, they're also very convenient for assassins or terrorists who want to create ID-triggered explosive devices. Just imagine how practical when you can leave a device, and a few weeks later when the victim walks by, there goes the boom.
Any remote ID that doesnt require the owners active cooperation is a security risk.
I expect tinfoil wallets to become commonplace.
No need for tinfoil (Score:4, Informative)
try this [magellans.com]
or make your own [rfsafe.com]
When I was a shoplifter I used one of these [magellans.com] works a treat for rf frequency shifting security tags.
Re:More fraud? (Score:5, Informative)
It makes sense that if you have a card which is acting like pocket change to allow this. You deplete the credit and then you top it up. You can only spend as much as you have on the card so it has a natural cutoff. Since you buy the card with cash from a machine, the card is effectively acting like semi-anonymous currency.
It doesn't make much sense to do the same with a credit card, unless the credit card imposes a hard limit on what you can spend in such a manner. And I don't mean per item - I mean total that you deplete and must be topped up either by you or a preset top up. Otherwise what's to stop someone reading your RFID and making their own purchases by spoofing yours?
It doesn't really make sense to even embed the RFID into the credit card anyway. Are Mastercard going to be happy with reissuing cards to hundreds of people for the sake of thieves leeching $10 a day off them? How does a customer or Mastercard even spot suspicious transactions for tiny items anyway until the statement arrives?
It seems smarter for the RFID to be on separate card - to be more like a gift card that can be topped up at the discretion of main card holder. These could be sold anywhere and it would be easy for someone to buy a couple of them and set them up with their main account. Then if someone steals one, you simply don't top it up anymore. This would of course require Mastercard or whoever to stop gouging owners of these cards by charging a monthly "administration fee", but if they wanted to see the scheme work, they'd waive it.
Re:More fraud? (Score:4, Interesting)
The big problem is with vending machines and the like that use Chip and PIN. We have a cashless vending system that can be topped up with either cash or a credit or debit card. Great. The problem is that instead of a small (calculator-sized) PIN pad that's difficult to shoulder-surf, you enter your pin on a 6" square keypad on the big, bright touchscreen on the front of the unit. This kind of defeats the purpose.
Re:More fraud? (Score:5, Interesting)
I *really* hate the way they limited it to 4 digit pins. I'd rather have a 10 digit one - much less chance of a casual thief being able to memorise it on the first shot. Leave it at 4 for the AOL users, but I'd rather have some security thanks.
Signatures were way better in many ways... everywhere round here was really strict about checking them.
The worst of course are the supermarket 'self service' checkouts - they don't ask for a signature *or* a pin - no security at all... you swipe the card and walk away.
Re:More fraud? (Score:2)
Or a corrupt janitor could install a sniffer inside of a garbage can in a high traffic area.
LK
Re:More fraud? (Score:5, Insightful)
It rarely has to anymore. Most stores have installed credit/debit card readers for their customers, thanks to that scare a while back that cashiers were stealing credit card numbers. The only time my card leaves my posession is with the older style BoA/Fleet ATMs that still want to hold on to your card until the transaction is complete. I hope they will still require a PIN/passcode along with the card or maybe a thumb held on a scanner while the PIN is entered with the other hand.
Or they could try making the cards smaller. Who says a credit/debit card has to be 3.5"x2"? Yes, it fits perfectly in a wallet, but so does a 3.5" floppy in a shirt breast pocket. I remember seeing commercials of credit cards designed to fit on a keychain, it even had a protective case. A credit card can easily be reduced to 1" high, if you examine one you'll see that the top half contains the magnetic strip and the signature box and the bottom has the number, exp date and name. And they're on opposite sides of the card.
Remeber, RFID that claims to be read at only up to 6" can really be read at up to 70'
The tinfoil wallet is too passive an approach and can only protect the card while it's in the wallet, not in use. It's time to modify a PDA RFID scanner to be an RFID jammer.
RFID passports, RealID cards and credit cards. What's next RFID birth certificates and social security cards? That will add a new level to wardriving and even war/RFID walking in malls.
Re:More fraud? (Score:3, Funny)
To prevent physical stealing of personal RFID cards, you'll get an RFID chip implanted in your forehead. Which means that you can pay by banging your head against the cash desk.
Fraud Prevention. (Score:5, Funny)
Re:More fraud? (Score:5, Informative)
These cards are based on SMARTCARDS and the EMV standards (3DES, PKI, challenge-auth techniques) against which millions of credit and debit cards have been issued. The only difference is that they use an RF interface to provide comms and power the chip.
See http://en.wikipedia.org/wiki/ISO_14443/ [wikipedia.org]
They ARE NOT RFID tags, they do not emit your card number, banks (as other have correctly posted) are smart enough to NOT provide OTHER avenues of fraud.
Re:More fraud? (Score:2, Interesting)
Theft (Score:5, Interesting)
They're gonna need to put in some confirmation thing in this, but I thought the whole idea was effortless payments.
Range? (Score:4, Informative)
I only ask because my train pass (in Japan, the Suica card) is RFID, and you pretty much have to touch the sensor for it to work at the ticket gates. Anything more than about 5mm and it won't be read. You pretty much have to touch it to the sensor.
So, unless someone with a scanner embedded into his/her pants bumps into you, I imagine you will be OK. If you are paranoid about it, you could always wrap your cards in tinfoil or something. ;)
Or am I missing something, and these things are more remotely scannable than I thought?
Re:Range? (Score:5, Funny)
Actual range is 8190850 miles (Score:3, Funny)
The true range for that power is *much* more than 3000 yards. Using "some surplus telephone house wire" this amateur [madisoncounty.net] received signals from 1531 miles away at 12 milliwatts. Can you imagine what a true professional could to to your 64.2W RFID?
Re:Range? (Score:5, Funny)
It's not the scanners I'm worried about. It's the guys who *call* it a scanner, and are just really happy to see me -- THEM I worry about.
Re:Range? (Score:3, Interesting)
imagine the power of such a scanner in a wall street elevator, you struggle through some people and "pay" a few minutes later while they are struggling for stocks.
seems awfully insecure and i would advise against using this stuff.
Re:Range? (Score:4, Interesting)
I never really needed to bring my card out for swiping. I just brought my wallet in front of the scanner (at least 2 cms distance), and it worked.
I wonder if in a subway, a guy could bring a scanner close enough to my pocket and sniff our my CC info.
Worse, if the info is static, all he needs to do is replicate the same signals using any damn device. He doesn't even need to build another card, or decode the info.
Re:Range? (Score:3, Funny)
Tinfoil, or... (Score:2)
Re:Range? (Score:5, Informative)
Re:Range? (Score:5, Informative)
Of course, Suica cards are not that prone to theft because the most that person could do is take a spin around the Yamanote Line at your expense. When there's serious money involved, you will see someone place a high powered field generator in a trash can by the entrance to a mall, and then sit in a car nearby and gather access numbers from everyone going in or out and massively cash out. Non-contact based transactions are a bad idea. Faraday-cage wallet, here I come.
Re:Range? (Score:4, Informative)
This is true.
Anecdote: During the early trials of the Oyster [tfl.gov.uk] RFID transport card in London, there was a problem with passing buses dinging the accounts of people waiting at the stop who didn't get on that bus. The Solution was to reduce the power of the reader on the bus.
Re:Range? (Score:2, Informative)
The power it will be able to get and partly send back will be function of the field it is in. That field will be generated by the reader and, of course, different readers have different capabilities.
I have installed several types and while most of them are 5 to 12 cms range, there are some that work at meter range.
Re:Range? (Score:3, Insightful)
Increasing the sensitivity of the reciever is much easier and much less expensive than increasing the power of the transmitt
Re:Theft (Score:2)
Re:Theft (Score:2)
Also another great scam is going to be those stupid turnstiles on subways and the like. Everybody se
Re:Theft (Score:3, Interesting)
Of course someone with a reader who also see's you entering in your pin co
Re:Theft (Score:3, Informative)
Dunno how's it in states, but in Russia, France and more countries you have to type in your PIN in order to approve a payment.
Long range RFID would be much easier because you won't need to get your card out of your wallet that's stuck somewhere in your pouch full of other stuff. Just type the PIN.
Supermarkets should greatly welcome this initiative because their lines will go much faster that way.
Re:Theft (Score:5, Interesting)
Not a big change (Score:5, Insightful)
Re:Not a big change (Score:3, Interesting)
It won't completely fix credit card security (think online purchases and manual imprints), but it will help.
Plus it gives MC some marketing bullet points for providing advanced "RFID super-technology" to its members first.
Shoplifting (Score:3, Funny)
Re:Shoplifting (Score:2, Flamebait)
Security? (Score:5, Insightful)
How long will it take the collectives minds of the criminal fraternity
Re:Security? (Score:2)
I read a HOWTO, written by a student in a college which used RFID chips in cards for authenticating students, about building a nice device for artificially duplicating any given chip's signal. I can't find it offhand, but I know it's there...someone on Slashdot has to have read it.
Re:Security? (Score:2)
Just wait, I'm sure the NYT will have an article about it in the future.
Re:Security? (Score:3, Informative)
Credit fraud is trivially easy.
I have a bad feeling about this... (Score:5, Funny)
Checking out at the grocery store without signing your name or entering a pesky PIN number: effortless
Having your account drained by a 12 year old who bought a high-gain RF antenna off eBay: priceless
Re:I have a bad feeling about this... (Score:5, Interesting)
The RF component of these cards is considerably more secure than even the magstripe component.
Re:I have a bad feeling about this... (Score:4, Insightful)
If only I could dig up someone saying that about WEP a few years ago...
Theft! (Score:5, Funny)
Re:Theft! (Score:5, Interesting)
In the USA, at least, credit card issuers (the banks that back the cards) are ultimately responsible for fraud. Their agreements with merchants stipulate that the merchant has to eat any charges found to be fraudulent, and if the merchant can't/won't, the bank has to do it. By law, the customer is limited to being responsble for only the first $50 of charges. And most card issuers have policies that waive even that fee.
So if it's really going to be that easy to steal CC numbers, why in the hell would banks do this??
I had one idea that might float: The expected losses due to increased fraud are outweighed by their predictions of increased consumer credit spending, once it becomes easier to use the cards. Since the merchants eat fraudulent charges, anyway, the banks aren't out that much more money if fraud goes up.
Of course, this disincentivizes merchants to let people easily pay for things with a swipe (yif ou have to show your photo ID before you wave your card--defeats the point, doesn't it?). Which would make the whole thing moot.
Re:Theft! (Score:2)
I agree that there has to be some motive, and you can be pretty sure the goal is to increase the income for the company, which boils down to getting it from the card users/customers.
Still, the fact that the merchant/bank has to cover any fraud except for the first $50 isn't good enough. If I have my card scanned and stolen ten times, that ads up
Re:Theft! (Score:3, Interesting)
Re:Theft! (Score:2)
I dunno. Wendy's shrugging off checking ID or making you sign documents for credit purchases under a certain a
Re:Theft! (Score:2)
Re:Theft! (Score:2)
Re:Theft! (Score:4, Interesting)
I wasn't that big of a deal, either time. In the restaurant case, I called the CC company, got a CS rep in about 30 seconds, and explained the situation. I got a call back about an hour later and they instantly reversed the second charge--could have just been a mistake by the server, right?
The other time, I called and they told me to fill out a police report. They froze the fraudulent charge, essentially meaning that it was off for the time being, and cancelled that card. I got a call back the next week telling me that they'd looked into it and agreed with me. The only real hassle was the police report, but being as I was living in NYC, the local precinct was two blocks away. It took about 30 minutes, including travel time.
Re:Theft! (Score:2, Offtopic)
Re:Theft! (Score:2)
If a signed (original) receipt cannot be produced, the consumer is automatically awarded the chargeback. And the merchant is screwed. If a valid receipt can be found with your signature, and you've just claimed fraud, you're the one who is [potentially] screwed.
Having seen the inner wor
Wow... (Score:3, Interesting)
OOOH...4 million unsecure credit lines (Score:2, Interesting)
Anyone else concerned (Score:2, Funny)
Re:Anyone else concerned (Score:3, Insightful)
The sad part is, I'm completely serious.
Re:Anyone else concerned (Score:2)
Conflicting RFIDs (Score:5, Interesting)
Works fine for me (Score:2)
Get some facts (Score:5, Informative)
PayPass FAQ page: http://www.paypass.com/faq.html [paypass.com]
I'm not sure what the benefit of these are since you still have to take your card out of your pocket/wallet/handbag to swipe it over the scanner (only works within an inch). Anyone who has trouble swiping cards with mag stripes (which seems to be becoming a more-common problem as technology progresses) will likely think this a good thing - one swipe and that's it.
The issue of Card ID theft isn't really that much more than it already is.
Re:Get some facts (Score:2)
How so? Instead of picking your pocket and removing your wallet from it, all I would have to do is stand next to you with a small scanner in my hand/pocket in an unsuspecting environment - i.e. any crowded place. The FAQ page you liked to doesn't address this issue.
Limit of liability (Score:2, Interesting)
I have heard that in the US you have a 10% limit, eg if someone steals your car
Re:Limit of liability (Score:4, Informative)
Speaking as someone who's been on the merchant side of things in both online and brick-and-mortar situations, I can say that this policy is a double-edged sword. Proving cardholder fraud (where the customer buys something, then decides they don't want to pay for it) and winning a chargeback is dead easy when you're using a point of sale terminal. Proving cardholder fraud with internet based transactions, especially when you're selling a service instead of a tangible (shipped) product, is next to impossible and the merchant will almost always lose.
OTOH, when someone used my credit card to order $600 worth of Victoria's Secret merchandise online a few years ago, it was nice that all I had to do was fill out a form on my bank's website to dispute the charge and get my money back. I still have that card, with the same number, and it's never been abused since. I always wondered where they got it from, and why they only used it once.
Not the same "RFID" (Score:5, Informative)
ISO 14443, unlike most RFID standards, is a cryptographically strong system that renders easedropping useless.
Re:Not the same "RFID" (Score:5, Interesting)
From TI:
using National Institute of Standards and Technology (NIST) approved crypto algorithms, including Triple DES and SHA-1
Ok, my limited crypto background says that TDES and SHA1 are headed towards the junkyard. Not that it's trivial to brute force these guys - but there are some SERIOUS questions on the long term usage of these algorithms.
To wit: A system built on these algorithms should not expect security beyond a few years. It's not computationally worth it NOW, but perhaps in 5 years it may be trivial to breach.
AES is much more secure and faster than TDES. It is more complicated circuit wise, but certainly doable. Additionally, the SHA1 algorithm is under heavy scrutiny now, and short plain text lengths may have heavy collisions with other viable texts. Remains to be seen.
Reguardless, if I were developing a system for the next 10-20 years I would certainly aim a little higher than TDES - just my 2 cents.
Pan
Re:Not the same "RFID" (Score:4, Insightful)
Re:Not the same "RFID" (Score:2)
Re:Not the same "RFID" (Score:3, Interesting)
Protection available already! (Score:3, Informative)
PayPass vs. Octopus (Score:5, Interesting)
- It's a credit card, which means the limit is theoretically your credit limit of thousands of dollars. (Yes, I know they say it's for transactions under US $25, but do I trust their software?) The Octopus system is anonymous and stored value. You can only lose as much cash is in the card, which is typically less than US $15.
- It doesn't display much information about the transaction. Octopus displays how much has been deducted, and how much is left on the card. For PayPass: "When you present your PayPass card to the terminal, you will see a series of lights on the terminal. When all the lights have lit, you will know that your card has been properly read. If you want a receipt, simply ask the clerk to give you one--it is available, should you request it."
#include coolsig.hRe:PayPass vs. Octopus (Score:4, Funny)
Soooooo lame, make it stop! (Score:3, Insightful)
Is it just me, or is waving your card in front of a reader pretty much the exact same motion as swiping it in a slot?
RFID can be secure. (Score:3, Interesting)
ISO14443 RFID cards have been on the market for years and are often used in public transportation. These have a range of at most 10 cm and implement challenge handshake encryption such as triple DES.
So you can only communicate with such a card if you have the proper encryption key. And if you manage to intercept the communication between such a card and a legitimate reader, it will contain no meaningful information unless you are somehow able to break the encryption.
This is easier how? (Score:5, Insightful)
What I'm not sure about with these RFID is where is the feedback that the transaction was successful? If you still have to wait for the terminal to handshake with the central database and process the transaction, it still takes as long as a conventional credit card - then there is no improvement. If there is no identification process, short of possessing the card how is that better for my security? If its part of the build up of biometric ID, is that really going to be any quicker, more convient or secure than using a human to identify another human.
My girlfriends father has banked with the same branch his entire life. When he walks into the bank the people know him. Now don't get me wrong, he "Hates the bastards", but he won't change branches because, when he sent his new accountant into withdraw some cash, they took the accountant to one side and refused the transaction until they had verified his identify via a phone call. It was quick and painless. The trust was human, the identification was human.
The interesting thing about that story is that it identifies the absolute reason we need human trust mechanisms (because they work and are intuitive) and the absolute reason we need automatic trust - I don't want to have to make friends with every clerk/manager in the world before they'll accept my credit card - and I want the freedom to change banks.
I don't think RFID for credit cards is a good idea. In fact I don't think credit cards are a good idea - they are a hack. They are a machine readable identification tool - what we need is a technology that identifies you by looking at you, talking too you, smelling you. If my moms Lhasa Apso (possibly the stupidest breed of dog on the planet) can identify me from a line up then at some point we need a technology that has a similar capability.
Do you carry just ONE credit card in your wallet? (Score:4, Insightful)
I carry three credit cards in my wallet. I don't really need the third one, but I always try to have at least two, just in case my primary card doesn't swipe correctly, goes over limit, or becomes otherwise useless.
So what will happen when I wave my wallet with three CCs in it in front of the reader? It'll probably ask me which card I'd like to use... Now I have to read the options (how many people carry 6 or 7 CCs in their wallets?!) and find the one I like and select it. Or just take it out of the wallet and swipe it. Which one will you chose?
Plus, this may make lives easier for women who can just wave their purse in front of the reader, so they don't have to take out the wallet and then the CC. But most men I know carry their wallet in their back pocket, and I don't think stores will be happy with men sticking their butts up to the readers on the counters. And if I have to take out the wallet, I may just as well take out the CC...
Just a couple of thoughts..
m
A problem I see... (Score:3, Insightful)
Another problem I see if these are keyring "cards" is that, well, having a bunch of shit hanging all over your keychain is a pain. In the future will we all have big janitor-style keyrings hanging off our beltloops?
This nails the problem... mod parent up! (Score:3, Insightful)
Cause we all know... (Score:2)
Big flaw in their thinking (Score:3, Interesting)
Card swipe... card... swipe the card... hurray.
The same result, no complex expensive worries about security. I can just hear their security chief now:
"The RFID cards will be secure, because we will use a *really* big number in the cards..."
"Bigger than... erm... one kajillion million fafillion bajillion?"
"Yes sir!"
"*evil laugh*"
"*evil laugh*"
I am expert! BTW this isn't a mvoe for technology, they will use RFID as a marketting bait to get more credit card customers, think about it, what other reason than to get people to sign up for the new 'wow' rfid card.. yeah, give us your debt.
To confirm you're not a script,
please type the word in this image: expert
random letters - if you are visually impaired, please email us at pater@slashdot.org
What's the incentive to change for each party? (Score:5, Insightful)
Let's face it: traditional credit cards suck because they are hampered by concern for backward compatibility with 1970s technology. If one were designing a credit card system today, it wouldn't be based on an embossed number and magnetic stripe. The number is there for remote transactions (using the expiration date and possibly the 3-digit CVV as a plaintext "password"!). With today's technology, remote transactions should be handled using a challenge-response system or one-time-use numbers such that the retailer can authenticate the cardmember without gaining enough information to impersonate the cardmember. The number on the card is embossed for use with the carbon-copy rolling machine. When was the last time a retailer carbon-copied your card, asked for photographic ID, and looked through a blacklist of stolen card numbers? And the magnetic stripe would certainly be replaced by a smart chip, which is much harder to clone because it can do challenge-response.
The infrastructure of the credit card network has improved, slowly. Nearly all point-of-sale equipment now performs real-time authorization. In Europe, the magnetic stripe is being obsoleted by contact smart chips. However, the benefit of the new technology must be significant enough to justify upgrading the huge worldwide network of equipment. So what's in it for each party to adopt RFID for credit cards?
In short, credit card technology advances slowly, with the retailer network being the bottleneck. Can they be convinced to upgrade? In my opinion, I think not.
I also think that RFID offers practically no advantage over contact smart chips, and that it would be pointless to add yet another standard. Wireless will never be quite as secure as contact. The network needs an overhaul, but this is not it! The credit card companies should be pushing to remove the card number and magnetic stripe in favor of the smart chip, instead of adding RFID.
Kneejerking? (Score:5, Insightful)
It's just using the air to transmit encrypted information instead of a wire. As long as the encryption is good, the simple fact that it's broadcast instead of being on a wire shouldn't matter.
Ok, that said, I could see one potential attack vector, in that a bad guy could theoretically initiate a key exchange and swipe some cash from you. If all it takes is being nearby with an inductive field to power the card, then a fraudulent charge would be pretty easy to make. The virtual equivalent of pickpocketing. If you did it in small amounts per card, you could walk through a crowd with your portable gear and make hundreds of dollars an hour.
One idea to work around that would be requiring the user to hold the card in two specific places, on opposite sides. Thumb on one side, finger on the other, touching big gold contact points. If the card can detect the proper grip (very trivial technology), then it is active; otherwise, it refuses transactions. That should prevent 'pickpocketing'.
Basically, there needs to be a way for the user to announce 'yes, this is an authorized charge' other than simple proximity. The Kung-Fu Grip is one possibility... there must be others. Heck, the cards may already DO this. The actual technical data seems exceedingly scarce.
Snooping, at least, doesn't appear to be a potential problem.
Four points from oblivion (Score:4, Interesting)
1. A ten cent charge for entering the mall doors.
--After all, it takes HARD WORK to make and install doors! Somebody had to design and build them! Do you feel you are so special that you shouldn't have to pay for the privilege of using doors? Jeez, it's just a dime. (Though, that price can change once the populace has been acclimated to being dinged for simply walking. I'm sure that, as per usual, there will be a host of worthy Slashdotters eager to argue on behalf of the corporations; who can be counted on to cry 'Thief' whenever somebody wonders why they can't use doors for free anymore; and who will happily parrot terms like, 'entrance-theft' once such terms have been appropriately astro-turfed into place by the corporate PR monkeys.)
2. People think that RFID is a close-range affair and so are lulled into a false sense of security. While it is true that an RFID chip does need to be within a few feet in order to be charged by a magnetic field, the signal it subsequently transmits can be picked up by satellite.
3. If there is no third element involved in the transference of data, (a pin number held in the user's brain), then any sneaky person with a satellite or closer range receiver can 'over-hear' all the info s/he needs to access an account and make a fraudulent purchase.
4. The big corporations and big government know all of this and are eager to have it all in place. The more base-level fear there is humming in the background, the more easily controlled a population becomes and the better fed the overseers are. Fear is food.
-FL
Re:As a MasterCard customer... (Score:3, Insightful)
Re:As a MasterCard customer... (Score:5, Interesting)
Merchants, I'm sure, will not process transactions unless the card passes a challenge/response cycle based on the private key encrypting or signing some data, with the public key available from bank itself for verification purposes. So someone having access to your card number would be a non-issue. They'd have to have physical access to the card itself, which would make it more secure than the current system.
Re:As a MasterCard customer... (Score:2)
Re:I'm an honest person... I'm an honest person... (Score:2)
It's even sadder, however, how many system developers don't care, or don't have the knowledge to implement it.
Re:Brings a whole new meaning to drive throu... (Score:3, Insightful)
A simple solution would be to have an RSA key + engine on the card, so that the 'scanner' issues a challenge to the card and if the card can supply the decrypted string then it passes. A limit of 1 challenge per 30 seconds would stop anyone getting any useful data out of it. Presumably this is do-able using today's technology... or would an RSA engine use more power than cou
Re:Maybe not now, but soon enough... (Score:3, Funny)
No. You'd have to be bats to use sonar.