7 ms·

It wasn't going to be so much that, as a card that you could put multiple credit cards on, but that still functioned entirely like a credit card - meaning it co

It wasn't going to be so much that, as a card that you could put multiple credit cards on, but that still functioned entirely like a credit card - meaning it could be swiped in vending machines, by waitresses, and everywhere that accepts cards, without the need for an apple pay or google pay or whatever NFC payment hardware. It's for people that keep multiple cards in their wallet.

abalone 9y ago
> everywhere that accepts cards Given the shift to chip-and-PIN, which can't be emulated like this -- Plastc claimed they could but never demonstrated it (because it's impossible) -- they were way too late to market with this idea even 3 years ago. And if merchants are going to roll out new POS hardware they might as well jump to NFC as it leapfrogs cards on convenience. And security, if your device implements tokenization and fingerprints-instead-of-PINs (like Apple Pay and others). Also it's built in to lots of phones and watches now.
- reubensutton 9y ago
  What makes it impossible to emulate?
  - thecosas 9y ago
    https://squareup.com/townsquare/why-are-chip-cards-more-secure-than-magnetic-stripe-cards https://squareup.com/townsquare/why-are-chip-cards-more-secu... "To rip it off, someone would have to get into the physical chip circuit and manipulate things to get your bank information. Not only is this level of data surgery really difficult, but it also requires a set of high-tech equipment that can cost north of $1 million."
    - bigiain 9y ago
      That's presumably " … cost north of $1million in 2016, rumoured to have been done in 2017 by Bunny with $10 worth of decapping acid and a borrowed STEM revealing implementation details and flaws, then with a demonstrated contactless remote exploit working on a RaspberryPi with a $12 USB TV tuner and a hand-wound antenna at CCC or DefCon in 2018"...
      - bitexploder 9y ago
        So, not $10 if you needed a borrowed, expensive piece of equipment. It is not possible for most of us to jaunt out and borrow a fancy microscope. That only underscores the "expensive equipment required argument". The contactless payment hack is much more practical, though. (Oh you also need far beyond average hardware hacking knowledge and skill, which itself is generally more difficult to acquire and learn ).
        bigiain 9y ago
        Sure - but people _are_ doing this at home with stuff they buy off eBay right now: http://zacsblog.aperturelabs.com/2013/02/decapping-integrated-circuits-using.html http://zacsblog.aperturelabs.com/2013/02/decapping-integrate... And as for "far beyond average hardware hacking skill", I suspect if you got Bunny Huang, Michael Ossmann, and Travis Goodspeed together and curious - this might well be broken in a single weekend! ;-)
        blackguardx 9y ago
        Your link just describes decapping and reading the state of mask programmable PROM. Reverse engineering a secure IC and coming up with an exploit is several orders (like 10) of magnitude more involved.
        kolinko 9y ago
        So if the first takes a day, the latter - 10 million days?
        blackguardx 9y ago
        But seriously, difficulty also implies required skill and equipment.
        slededit 9y ago
        They go for about $10k-$30k on EBay. But people have also DIY'd their own: http://makezine.com/2011/03/24/diy-scanning-electron-microscope-2/ http://makezine.com/2011/03/24/diy-scanning-electron-microsc...
  - nocha 9y ago
    IIRC Chip and Pin uses a challenge-response type set up with public key crypto to authenticate your card with your bank. You cannot clone that, as processing is done on the card - not the reader, and the card never reveals it's secrets.
- hocuspocus 9y ago
  I don't know what was promised by Plastc exactly but I assume you need to register your card numbers somewhere (like with Apple Pay) and then when you use your Plastc card to pay (with chip and PIN or not), their back-end issues a payment transaction using the selected card. Am I wrong? Over here in Europe we have Curve that does exactly that, without the fancy hardware: https://www.imaginecurve.com https://www.imaginecurve.com
  - X-Istence 9y ago
    Yes, that is not what Plastc was. Plastc was like copying the data from the front of your card and displaying it on a different one (mag-strip included).
    - hocuspocus 9y ago
      Got it. EMV is clearly an issue then, I see the problem.
  - abalone 9y ago
    Curve has its own card number. The closest thing to Curve here was a card called Wallaby. It somehow redirected charges from one card to another... I think they were getting creative with the processing rules and got shot down. Not sure how Curve does it exactly but I'm skeptical of their long term viability. Either they're similarly creative or they are acting like a merchant and recharging every transaction and eating some interchange. Maybe they get away with that more in Europe where interchange is low but it's still a net loss. Anyway Plastc was about trying to actually emulate a card. All this has been leapfrogged by Apple and Samsung Pay.
    - hocuspocus 9y ago
      As far as I understand, Curve is viable due to the fact they issue corporate cards (you can see "for commercial use only" on their cards). Europe has capped interchange fees to 0.2% and 0.3% for debit and credit cards respectively. However, three-party schemes (like Amex) and corporate cards are exempt and charge more. But you're right, I'm not sure how MasterCard is happy with that (since the product is clearly targeted at consumers).
- schoen 9y ago
  > Given the shift to chip-and-PIN, which can't be emulated like this -- Plastc claimed they could but never demonstrated it (because it's impossible) If they'd had a whole lot of market share already, maybe they could have persuaded issuers to provide private keys in some way that could be imported into the Plastc device (which might itself then have a tamper-resistant smartcard processor like the one in the individual chip cards).
  - abalone 9y ago
    Horrible security and wouldn't work for the most secure chip and PIN cards which never share their private key. Apple Pay's approach is better: issuer assigns a unique number to the device along with its own authentication scheme, rather than trying to emulate another.
- sjtgraham 9y ago
  I think emulation could be possible with SDA cards. SDA is part of the EMV spec but I'm not sure how many cards these days support SDA applications.
- NamTaf 9y ago
  Yeh, this always seemed doomed outside the US, which in general appears to be ahead of the US for card security. Especially in AU, I don't even really go to bars with cash any more, I just use contactless payment with my card literally everywhere. Coffee, lunch, bars, etc. - pretty much everywhere has paypass/paywave now and has for years. Even three years ago, the writing was surely on the wall that they were exploiting weaknesses in old tech to pull off their product, so there was an obvious sunset on their ability to operate their core product. Why would they invest in something that already has an end date on it?
  - flashman 9y ago
    Even though I have a contactless card, I still prefer cash because it reminds me how much I'm spending. It's all too easy to tap away $40 several times a month and wonder where it all went.
    - sbarre 9y ago
      I found the opposite was true.. Having cash in my wallet meant I didn't know where it got spent (not specifically in bars though, just in general so maybe we're talking about different things). With tap + debit, I can track all my individual transactions via services like Mint, plus my bank sends me an email on every transaction that happens to my accounts, so I have redundant logging of where all my money goes.
      - djanatan 9y ago
        I find that both of you are right and this is why I'm always broke.
- ricardobeat 9y ago
  > Given the shift to chip-and-PIN, which can't be emulated like this I don't know the tech behind it but this Dutch startup is doing exactly that: https://www.bunq.com/en/ https://www.bunq.com/en/
  - GuB-42 9y ago
    From the looks of it, Bunq is a bank. I didn't see the product you are talking about but I suppose it may be like a payment processor forwarding orders to third parties. Plastc is a purely technical solution, it has a rewritable magnetic strip so you can copy any card to it, not just payment cards. You can't do it with chips because chips are designed to be impossible to copy. They have secret keys inside and I don't think card providers are willing to reveal them and weaken their security.
tacostakohashi 9y ago
I was always bemused about this idea that putting multiple credit cards on a single physical card is some great feature that a lot of people want and would pay money for. In my experience, having many credit cards is a complete pain to manage, because for each card you need to monitor the statement, set up the automatic payment (or do it manually), change the address when you move, etc, etc, and no sane person is going to want to do that for lots of cards. The fact that it also fills you your wallet is really the least of the problems you'll have. It's nice to have one card as a backup, and some hardcore churners / points collectors are going to want 5 or 6 cards and use different cards for different categories... but they're real niches, it's not something that a mainstream, mass market consumer is going to want to manage.
- xKingfisher 9y ago
  My dream for something like this is having everything on one card would let you manage the complexity a lot better. Having one single interface to pay all bills and see spending breakdowns aggregated across all your cards, recommending the optimal order to pay down cards (if you are going to carry a balance). Then on top of this, automatic fallback in case one card is declined, new numbers for every online transaction (not tied to a single provider). You could even layer on top a simple scripting language to choose the card to be used for a given transaction. E.g. Use my rewards card when buying gas, but if I've maxed out the points then use the lowest interest card. Or round robin the cards to spread out the balance. Or imagine a group outing where everyone can all combine into a single virtual card, with the ability to distribute charges however you want on the back end. There are a ton of cool possibilities available (albeit very challenging to get right). And in theory, many people have at least 2 cards for redundancy purposes. Add in no fee rewards cards (Target, etc) and it will add up even for non hardcore points collectors.
  - huebnerob 9y ago
    This sounds like a genuinely useful technology that will sadly never make it past the Big Credit gods. Card providers seem to make their profits when you're not managing your card usage so intelligently.
Chaebixi 9y ago
Wasn't that exactly what Coin was? http://blog.onlycoin.com/ http://blog.onlycoin.com/
- cxr344 9y ago
  Pretty much. And 3-4 other, very similar startups- most have ended the same way in failing to get anything to market. Dynamics has been around for a while with a similar product, but B2B sales strategy, though they don't seem to be getting much traction. Cool idea on the surface, but clearly has some fatal flaws. Just funny to me how VCs are willing to fund essentially the same company that has failed multiple times before... though in this case, maybe their VCs actually did the diligence and that's what led them to back out (total speculation).
deleted 9y ago
[deleted]
Mister_Snuggles 9y ago
In Canada most payment terminals have the NFC hardware built in, it's just a question of whether it's actually enabled or not. It's very rare these days for me to see it disabled. I've used Apple Pay a lot and have never used it at a merchant that advertises it - if the machine allows tap, Apple Pay just works. I assume that Google Pay is similar.

abalone 9y ago

> everywhere that accepts cards Given the shift to chip-and-PIN, which can't be emulated like this -- Plastc claimed they could but never demonstrated it (because it's impossible) -- they were way too late to market with this idea even 3 years ago. And if merchants are going to roll out new POS hardware they might as well jump to NFC as it leapfrogs cards on convenience. And security, if your device implements tokenization and fingerprints-instead-of-PINs (like Apple Pay and others). Also it's built in to lots of phones and watches now.

reubensutton 9y ago
What makes it impossible to emulate?
- thecosas 9y ago
  https://squareup.com/townsquare/why-are-chip-cards-more-secure-than-magnetic-stripe-cards https://squareup.com/townsquare/why-are-chip-cards-more-secu... "To rip it off, someone would have to get into the physical chip circuit and manipulate things to get your bank information. Not only is this level of data surgery really difficult, but it also requires a set of high-tech equipment that can cost north of $1 million."
  - bigiain 9y ago
    That's presumably " … cost north of $1million in 2016, rumoured to have been done in 2017 by Bunny with $10 worth of decapping acid and a borrowed STEM revealing implementation details and flaws, then with a demonstrated contactless remote exploit working on a RaspberryPi with a $12 USB TV tuner and a hand-wound antenna at CCC or DefCon in 2018"...
    - bitexploder 9y ago
      So, not $10 if you needed a borrowed, expensive piece of equipment. It is not possible for most of us to jaunt out and borrow a fancy microscope. That only underscores the "expensive equipment required argument". The contactless payment hack is much more practical, though. (Oh you also need far beyond average hardware hacking knowledge and skill, which itself is generally more difficult to acquire and learn ).
      - bigiain 9y ago
        Sure - but people _are_ doing this at home with stuff they buy off eBay right now: http://zacsblog.aperturelabs.com/2013/02/decapping-integrated-circuits-using.html http://zacsblog.aperturelabs.com/2013/02/decapping-integrate... And as for "far beyond average hardware hacking skill", I suspect if you got Bunny Huang, Michael Ossmann, and Travis Goodspeed together and curious - this might well be broken in a single weekend! ;-)
        blackguardx 9y ago
        Your link just describes decapping and reading the state of mask programmable PROM. Reverse engineering a secure IC and coming up with an exploit is several orders (like 10) of magnitude more involved.
        kolinko 9y ago
        So if the first takes a day, the latter - 10 million days?
        blackguardx 9y ago
        But seriously, difficulty also implies required skill and equipment.
      - slededit 9y ago
        They go for about $10k-$30k on EBay. But people have also DIY'd their own: http://makezine.com/2011/03/24/diy-scanning-electron-microscope-2/ http://makezine.com/2011/03/24/diy-scanning-electron-microsc...
- nocha 9y ago
  IIRC Chip and Pin uses a challenge-response type set up with public key crypto to authenticate your card with your bank. You cannot clone that, as processing is done on the card - not the reader, and the card never reveals it's secrets.
hocuspocus 9y ago
I don't know what was promised by Plastc exactly but I assume you need to register your card numbers somewhere (like with Apple Pay) and then when you use your Plastc card to pay (with chip and PIN or not), their back-end issues a payment transaction using the selected card. Am I wrong? Over here in Europe we have Curve that does exactly that, without the fancy hardware: https://www.imaginecurve.com https://www.imaginecurve.com
- X-Istence 9y ago
  Yes, that is not what Plastc was. Plastc was like copying the data from the front of your card and displaying it on a different one (mag-strip included).
  - hocuspocus 9y ago
    Got it. EMV is clearly an issue then, I see the problem.
- abalone 9y ago
  Curve has its own card number. The closest thing to Curve here was a card called Wallaby. It somehow redirected charges from one card to another... I think they were getting creative with the processing rules and got shot down. Not sure how Curve does it exactly but I'm skeptical of their long term viability. Either they're similarly creative or they are acting like a merchant and recharging every transaction and eating some interchange. Maybe they get away with that more in Europe where interchange is low but it's still a net loss. Anyway Plastc was about trying to actually emulate a card. All this has been leapfrogged by Apple and Samsung Pay.
  - hocuspocus 9y ago
    As far as I understand, Curve is viable due to the fact they issue corporate cards (you can see "for commercial use only" on their cards). Europe has capped interchange fees to 0.2% and 0.3% for debit and credit cards respectively. However, three-party schemes (like Amex) and corporate cards are exempt and charge more. But you're right, I'm not sure how MasterCard is happy with that (since the product is clearly targeted at consumers).
schoen 9y ago
> Given the shift to chip-and-PIN, which can't be emulated like this -- Plastc claimed they could but never demonstrated it (because it's impossible) If they'd had a whole lot of market share already, maybe they could have persuaded issuers to provide private keys in some way that could be imported into the Plastc device (which might itself then have a tamper-resistant smartcard processor like the one in the individual chip cards).
- abalone 9y ago
  Horrible security and wouldn't work for the most secure chip and PIN cards which never share their private key. Apple Pay's approach is better: issuer assigns a unique number to the device along with its own authentication scheme, rather than trying to emulate another.
sjtgraham 9y ago
I think emulation could be possible with SDA cards. SDA is part of the EMV spec but I'm not sure how many cards these days support SDA applications.
NamTaf 9y ago
Yeh, this always seemed doomed outside the US, which in general appears to be ahead of the US for card security. Especially in AU, I don't even really go to bars with cash any more, I just use contactless payment with my card literally everywhere. Coffee, lunch, bars, etc. - pretty much everywhere has paypass/paywave now and has for years. Even three years ago, the writing was surely on the wall that they were exploiting weaknesses in old tech to pull off their product, so there was an obvious sunset on their ability to operate their core product. Why would they invest in something that already has an end date on it?
- flashman 9y ago
  Even though I have a contactless card, I still prefer cash because it reminds me how much I'm spending. It's all too easy to tap away $40 several times a month and wonder where it all went.
  - sbarre 9y ago
    I found the opposite was true.. Having cash in my wallet meant I didn't know where it got spent (not specifically in bars though, just in general so maybe we're talking about different things). With tap + debit, I can track all my individual transactions via services like Mint, plus my bank sends me an email on every transaction that happens to my accounts, so I have redundant logging of where all my money goes.
    - djanatan 9y ago
      I find that both of you are right and this is why I'm always broke.
ricardobeat 9y ago
> Given the shift to chip-and-PIN, which can't be emulated like this I don't know the tech behind it but this Dutch startup is doing exactly that: https://www.bunq.com/en/ https://www.bunq.com/en/
- GuB-42 9y ago
  From the looks of it, Bunq is a bank. I didn't see the product you are talking about but I suppose it may be like a payment processor forwarding orders to third parties. Plastc is a purely technical solution, it has a rewritable magnetic strip so you can copy any card to it, not just payment cards. You can't do it with chips because chips are designed to be impossible to copy. They have secret keys inside and I don't think card providers are willing to reveal them and weaken their security.

tacostakohashi 9y ago

I was always bemused about this idea that putting multiple credit cards on a single physical card is some great feature that a lot of people want and would pay money for. In my experience, having many credit cards is a complete pain to manage, because for each card you need to monitor the statement, set up the automatic payment (or do it manually), change the address when you move, etc, etc, and no sane person is going to want to do that for lots of cards. The fact that it also fills you your wallet is really the least of the problems you'll have. It's nice to have one card as a backup, and some hardcore churners / points collectors are going to want 5 or 6 cards and use different cards for different categories... but they're real niches, it's not something that a mainstream, mass market consumer is going to want to manage.

xKingfisher 9y ago
My dream for something like this is having everything on one card would let you manage the complexity a lot better. Having one single interface to pay all bills and see spending breakdowns aggregated across all your cards, recommending the optimal order to pay down cards (if you are going to carry a balance). Then on top of this, automatic fallback in case one card is declined, new numbers for every online transaction (not tied to a single provider). You could even layer on top a simple scripting language to choose the card to be used for a given transaction. E.g. Use my rewards card when buying gas, but if I've maxed out the points then use the lowest interest card. Or round robin the cards to spread out the balance. Or imagine a group outing where everyone can all combine into a single virtual card, with the ability to distribute charges however you want on the back end. There are a ton of cool possibilities available (albeit very challenging to get right). And in theory, many people have at least 2 cards for redundancy purposes. Add in no fee rewards cards (Target, etc) and it will add up even for non hardcore points collectors.
- huebnerob 9y ago
  This sounds like a genuinely useful technology that will sadly never make it past the Big Credit gods. Card providers seem to make their profits when you're not managing your card usage so intelligently.

Chaebixi 9y ago

Wasn't that exactly what Coin was? http://blog.onlycoin.com/ http://blog.onlycoin.com/

cxr344 9y ago
Pretty much. And 3-4 other, very similar startups- most have ended the same way in failing to get anything to market. Dynamics has been around for a while with a similar product, but B2B sales strategy, though they don't seem to be getting much traction. Cool idea on the surface, but clearly has some fatal flaws. Just funny to me how VCs are willing to fund essentially the same company that has failed multiple times before... though in this case, maybe their VCs actually did the diligence and that's what led them to back out (total speculation).

deleted 9y ago

[deleted]

Mister_Snuggles 9y ago

In Canada most payment terminals have the NFC hardware built in, it's just a question of whether it's actually enabled or not. It's very rare these days for me to see it disabled. I've used Apple Pay a lot and have never used it at a merchant that advertises it - if the machine allows tap, Apple Pay just works. I assume that Google Pay is similar.