10 ms·

Your Credit Cards Will Never Be the Same Again: Meet Card 2.0

62 points by Garbage 16y ago

v4us 16y ago
+1 I voite for thesi card + chip on the card. I really love it.
ulf 16y ago
Looks cool, anybody knows how the handle the energy issue?
acgourley 16y ago
Can someone explain the benefits to me? Thinner wallet, I guess? I don't know if consumers have much to gain from the security, so is this targeted at banks trying to reduce fraud? It's funny I remember the square guys telling me you can get in a lot of trouble for re-programming credit cards, surprised this technology isn't violating some obscure laws.
- dangrossman 16y ago
  Visa/MasterCard, which create those regulations, are basically owned by their member banks. It's banks that issue credit cards. So if banks want to issue a new kind of credit card with technology like this, they'll rewrite their own regulations to allow it.
  - poutine 16y ago
    Visa and Mastercard are no longer owned by the banks, they both went public in the past couple of years and are increasingly acting as independent organizations.
jasonkester 16y ago
Actually, I just wish that US banks would get up to speed with the Chip & PIN thing Europe has been doing since the '90s. Every time I buy groceries here in England, I get grief about my ancient relic of a Visa card that doesn't even have a chip on it, and thus requires swiping through a reader like the cavemen used to do and then signing a piece of paper. About every 3rd visit, I get to have a manager called over and explain that I come from a primitive country where the banks still do things the old way. It's embarrassing.
- carbocation 16y ago
  Banks in the US do issue such cards, and in NYC at least I see them used. Are you certain that your bank does not?
- acqq 16y ago
  I think UK was also the last in Europe to use chips on the cards, which, as far as I know, are the French invention. I remember using their specialized cards with chips there twenty years ago only to make some phone calls. By the way a lot of elementary security issues with cards are there because all the mechanisms still have to allow Americans to use their magnetic stripes, allowing simple tricks with them that would otherwise not be possible. On another side, chips are no silver bullet when it comes to the security. There are a lot of possible attacks, just some specific set of them would be excluded by only having chips. So no matter how it's popular among the geeks, the real-life solutions to real life problems are not purely technological and probably will never be. Still, as I live in Europe, I'd personally like to have the cards without the magnetic strip.
- gte910h 16y ago
  Amex Blue has the Euro chip.
  - mdaniel 16y ago
    I will need you to cite your source on that claim. I have the original Blue, with the chip to which you refer, and can assure you that it is not the same chip as in "chip and pin". It was marketed by Amex with a special RFID-esque reader that was designed to unlock your Amex "password vault" or some such silliness. It was such a flop that the new Amex cards have switched to actual RFID (or similar technology) for use in "Speed Pay" or whatever, in that you need not take your card out of your wallet to buy things at CVS or Whole Foods (for example).
    - gte910h 16y ago
      You are correct, they are not compatible.
Cushman 16y ago
Bleh. I hate to see all this new tech trying to drag the credit card infrastructure into the 21st century. The way credit cards work is exactly wrong— to make a purchase, I have to hand over every single piece of information the merchant needs to convince my bank to give them money. Then they ask the bank for as much money as they want. My bank will /maybe/, in extreme cases, double check with me if I actually want to give it to them. Now that smartphones are everywhere, we finally have the tech to implement electronic payments the way they should be— where the merchant provides me with /their/ id, and then /I/ tell my bank to make a payment. But no, not today. "Card 2.0" makes my financial information more secure right up until the moment I swipe it, at which point it's just as stupid and broken as classic credit cards. Not intending any offense towards the founders, but I hope the era of your tech is short-lived.
- thinkcomp 16y ago
  I agree. I'm biased, but I think phone-based technology is clearly better. (I run http://www.facecash.com http://www.facecash.com)
  - Cushman 16y ago
    It's a step in the right direction, but (please correct me if I'm wrong) your system still seems to be merchant-initiated. I'm using my phone as a glorified piece of paper; the merchant scans my barcode and processes the transaction on their hardware, the same way they would with plastic. That still seems ridiculous when my phone itself is a device capable of handling the transaction, yes? I should be scanning the register's barcode. I should be able to see what I'm paying for on my phone as it rings up. I should be able to authorize the payment using whatever securities I want on hardware that I own. I should be able to complete the entire transaction and walk out of the store without ever giving the merchant any information besides what bank I use. All of that is completely possible with today's tech. Who decided that the future of electronic payment is a debit card in a different form factor?
    - hugh3 16y ago
      Downsides of your idea: 1. Not everyone has, or wants, a smartphone. My phone doesn't even have a camera. People who work in certain high-security environments aren't even allowed to own phones with cameras. 2. Supposing hypothetically that I'm gonna have to "upgrade" to a smartphone at some stage, do I want to carry it around all the time? I always take my wallet, but I don't always take my phone. A phone is a much larger, heavier thing to carry around than a credit card. 3. When I do have my phone with me, it always seems to run out of batteries at an inconvenient time. I'd hate for the "completely uncontactable" problem to be compounded by the "you don't have any money" problem. 4. What happens when my phone (which I am now forced to carry around all the time and religiously keep charged) gets stolen? What authentication system proves that the person holding the phone and scanning the register is actually me? There's always "Enter your pin..." but that brings me to the next problem: 5. People paying with credit cards is slow enough already... I think your system would probably slow transactions down even more. Anyway, to me it seems you're trading in a small, light system that works adequately for a heavy, bulky one that may be less secure.
sukuriant 16y ago
I notice that the cards consume electricity. I wonder how long the battery lasts, and how they're replaced. Furthermore, there's the whole pressing against your card, and looking at the actual pressing action, it looks like you have to press them pretty hard (or maybe he just was). How durable is the card, really?
lockesh 16y ago
The biggest source of credit card fraud is that there's no standard way of proving that someone is in physical possession of the card. Online transactions only require CC#/Exp/CV2 name/address etc which are stored on merchant machines and then compromised and released to the while. A much more secure option would be to have CCs with built-in RSA key gen. Stealing the CC#s would no longer be enough to make a fraudulent transaction.
- brazzy 16y ago
  The CVV2 is not supposed to be stored in any merchant system, that's it's entire point! A merchant who does store it is actually violating their contract with the card issuer.
  - jedbrown 16y ago
    They are also violating the terms of their contract if they make fraudulent transactions on your behalf (to put it mildly). Which is why we're not worried about above-board merchants committing outright fraud, but we are worried possibly internal security holes through which your credentials may leak. The CVV2 is on their hardware while the transaction runs, which makes it vulnerable to unauthorized internal snooping. I don't know how merchants like Amazon handle fraud, but they don't use CVV2 because they don't bill you until items ship.
adn37 16y ago
'Consequences' will never be the same. (bring the down votes, or just enjoy)
andreyf 16y ago
Meh. Looks like more trouble that it's worth. With the new(ish) RFID chips, I can "swipe" a credit card without taking it out of my wallet. If I wanted a "secure PIN" feature, I could use my ATM card. Maybe I'll change my mind if my credit card were ever stolen, but until this, this seems like an sounds-good-but-is-actually-useless kind of feature.
- melling 16y ago
  Banks seem to be backing away from the RFID cards. My new card came without one. I called and asked them why and they said they were less secure. Personally, I love the new cards. Unfortunately, NYC cabs and CVS are the only place where you can find the readers.
noelsusman 16y ago
> the cards are as versatile as they are secure I highly doubt that. History has proven to me that there's no such thing as secure when it comes to technology.
- hugh3 16y ago
  They never said that they're perfectly secure, they said that they're as versatile as they are secure. As in "You're as smart as you are handsome".
evilhackerdude 16y ago
I like the idea, but I’m putting my money on NFC integration into mobile phones. Yes, manufacturers and services providers alike have been trying for years. Last time I checked there are huge issues with the security. This site seems to have good information on the topic: http://weblog.cenriqueortiz.com/touch-nfc/ http://weblog.cenriqueortiz.com/touch-nfc/ Anyhow, I see much more potential when the ability to transfer money quickly is paired with an all-powerful computer in your pocket. So we need someone to both figure out a secure process and provide apps/APIs to leverage that. Apple, anyone?
sbierwagen 16y ago
This is cool, but it solves the wrong problem. The two biggest sources of credit card fraud are: 1.) Credit card numbers stolen from merchants with insecure systems. 2.) Credit card stripe information stolen by skimmers installed on legitimate terminals. To combat these, you either need an entirely new system, (which would require every bank, everywhere, to buy into a new system, and thus will never happen) or something that generates new credit card numbers on the fly. Hey, that would actually make this workable. Have your bank generate ten one time use credit card numbers. Upload them to your smart credit card. Each time you swipe it, it uses up a CC#. After ten swipes, it's an inert piece of plastic until you reauthorize it.
- henrikschroder 16y ago
  I know there are banks here in Sweden where you can get one-time VISA numbers for online purchases. You enter a maximum amount where you guess your purchase will end up, you get a VISA number and expiry date and all that, and it's valid for one purchase. If someone stores that number or tries to use it again, they're shit out of luck because the thing isn't connected to your account, you are not liable in any way. However, those are only practical for occasional purchases, I'd assume you would run through the numberspace pretty quickly if everyone had that by default on their cards. But it's a neat idea. :-)
  - qeorge 16y ago
    Chase offers this, as well as PayPal. In addition, you can generate MasterCard numbers that only work with a specific merchant, but can be used many times.

62 points by Garbage 16y ago

v4us 16y ago

+1 I voite for thesi card + chip on the card. I really love it.

ulf 16y ago

Looks cool, anybody knows how the handle the energy issue?

acgourley 16y ago

Can someone explain the benefits to me? Thinner wallet, I guess? I don't know if consumers have much to gain from the security, so is this targeted at banks trying to reduce fraud? It's funny I remember the square guys telling me you can get in a lot of trouble for re-programming credit cards, surprised this technology isn't violating some obscure laws.

dangrossman 16y ago
Visa/MasterCard, which create those regulations, are basically owned by their member banks. It's banks that issue credit cards. So if banks want to issue a new kind of credit card with technology like this, they'll rewrite their own regulations to allow it.
- poutine 16y ago
  Visa and Mastercard are no longer owned by the banks, they both went public in the past couple of years and are increasingly acting as independent organizations.

jasonkester 16y ago

Actually, I just wish that US banks would get up to speed with the Chip & PIN thing Europe has been doing since the '90s. Every time I buy groceries here in England, I get grief about my ancient relic of a Visa card that doesn't even have a chip on it, and thus requires swiping through a reader like the cavemen used to do and then signing a piece of paper. About every 3rd visit, I get to have a manager called over and explain that I come from a primitive country where the banks still do things the old way. It's embarrassing.

carbocation 16y ago
Banks in the US do issue such cards, and in NYC at least I see them used. Are you certain that your bank does not?
acqq 16y ago
I think UK was also the last in Europe to use chips on the cards, which, as far as I know, are the French invention. I remember using their specialized cards with chips there twenty years ago only to make some phone calls. By the way a lot of elementary security issues with cards are there because all the mechanisms still have to allow Americans to use their magnetic stripes, allowing simple tricks with them that would otherwise not be possible. On another side, chips are no silver bullet when it comes to the security. There are a lot of possible attacks, just some specific set of them would be excluded by only having chips. So no matter how it's popular among the geeks, the real-life solutions to real life problems are not purely technological and probably will never be. Still, as I live in Europe, I'd personally like to have the cards without the magnetic strip.
gte910h 16y ago
Amex Blue has the Euro chip.
- mdaniel 16y ago
  I will need you to cite your source on that claim. I have the original Blue, with the chip to which you refer, and can assure you that it is not the same chip as in "chip and pin". It was marketed by Amex with a special RFID-esque reader that was designed to unlock your Amex "password vault" or some such silliness. It was such a flop that the new Amex cards have switched to actual RFID (or similar technology) for use in "Speed Pay" or whatever, in that you need not take your card out of your wallet to buy things at CVS or Whole Foods (for example).
  - gte910h 16y ago
    You are correct, they are not compatible.

Cushman 16y ago

Bleh. I hate to see all this new tech trying to drag the credit card infrastructure into the 21st century. The way credit cards work is exactly wrong— to make a purchase, I have to hand over every single piece of information the merchant needs to convince my bank to give them money. Then they ask the bank for as much money as they want. My bank will /maybe/, in extreme cases, double check with me if I actually want to give it to them. Now that smartphones are everywhere, we finally have the tech to implement electronic payments the way they should be— where the merchant provides me with /their/ id, and then /I/ tell my bank to make a payment. But no, not today. "Card 2.0" makes my financial information more secure right up until the moment I swipe it, at which point it's just as stupid and broken as classic credit cards. Not intending any offense towards the founders, but I hope the era of your tech is short-lived.

thinkcomp 16y ago
I agree. I'm biased, but I think phone-based technology is clearly better. (I run http://www.facecash.com http://www.facecash.com)
- Cushman 16y ago
  It's a step in the right direction, but (please correct me if I'm wrong) your system still seems to be merchant-initiated. I'm using my phone as a glorified piece of paper; the merchant scans my barcode and processes the transaction on their hardware, the same way they would with plastic. That still seems ridiculous when my phone itself is a device capable of handling the transaction, yes? I should be scanning the register's barcode. I should be able to see what I'm paying for on my phone as it rings up. I should be able to authorize the payment using whatever securities I want on hardware that I own. I should be able to complete the entire transaction and walk out of the store without ever giving the merchant any information besides what bank I use. All of that is completely possible with today's tech. Who decided that the future of electronic payment is a debit card in a different form factor?
  - hugh3 16y ago
    Downsides of your idea: 1. Not everyone has, or wants, a smartphone. My phone doesn't even have a camera. People who work in certain high-security environments aren't even allowed to own phones with cameras. 2. Supposing hypothetically that I'm gonna have to "upgrade" to a smartphone at some stage, do I want to carry it around all the time? I always take my wallet, but I don't always take my phone. A phone is a much larger, heavier thing to carry around than a credit card. 3. When I do have my phone with me, it always seems to run out of batteries at an inconvenient time. I'd hate for the "completely uncontactable" problem to be compounded by the "you don't have any money" problem. 4. What happens when my phone (which I am now forced to carry around all the time and religiously keep charged) gets stolen? What authentication system proves that the person holding the phone and scanning the register is actually me? There's always "Enter your pin..." but that brings me to the next problem: 5. People paying with credit cards is slow enough already... I think your system would probably slow transactions down even more. Anyway, to me it seems you're trading in a small, light system that works adequately for a heavy, bulky one that may be less secure.

sukuriant 16y ago

I notice that the cards consume electricity. I wonder how long the battery lasts, and how they're replaced. Furthermore, there's the whole pressing against your card, and looking at the actual pressing action, it looks like you have to press them pretty hard (or maybe he just was). How durable is the card, really?

lockesh 16y ago

The biggest source of credit card fraud is that there's no standard way of proving that someone is in physical possession of the card. Online transactions only require CC#/Exp/CV2 name/address etc which are stored on merchant machines and then compromised and released to the while. A much more secure option would be to have CCs with built-in RSA key gen. Stealing the CC#s would no longer be enough to make a fraudulent transaction.

brazzy 16y ago
The CVV2 is not supposed to be stored in any merchant system, that's it's entire point! A merchant who does store it is actually violating their contract with the card issuer.
- jedbrown 16y ago
  They are also violating the terms of their contract if they make fraudulent transactions on your behalf (to put it mildly). Which is why we're not worried about above-board merchants committing outright fraud, but we are worried possibly internal security holes through which your credentials may leak. The CVV2 is on their hardware while the transaction runs, which makes it vulnerable to unauthorized internal snooping. I don't know how merchants like Amazon handle fraud, but they don't use CVV2 because they don't bill you until items ship.

adn37 16y ago

'Consequences' will never be the same. (bring the down votes, or just enjoy)

andreyf 16y ago

Meh. Looks like more trouble that it's worth. With the new(ish) RFID chips, I can "swipe" a credit card without taking it out of my wallet. If I wanted a "secure PIN" feature, I could use my ATM card. Maybe I'll change my mind if my credit card were ever stolen, but until this, this seems like an sounds-good-but-is-actually-useless kind of feature.

melling 16y ago
Banks seem to be backing away from the RFID cards. My new card came without one. I called and asked them why and they said they were less secure. Personally, I love the new cards. Unfortunately, NYC cabs and CVS are the only place where you can find the readers.

noelsusman 16y ago

> the cards are as versatile as they are secure I highly doubt that. History has proven to me that there's no such thing as secure when it comes to technology.

hugh3 16y ago
They never said that they're perfectly secure, they said that they're as versatile as they are secure. As in "You're as smart as you are handsome".

evilhackerdude 16y ago

I like the idea, but I’m putting my money on NFC integration into mobile phones. Yes, manufacturers and services providers alike have been trying for years. Last time I checked there are huge issues with the security. This site seems to have good information on the topic: http://weblog.cenriqueortiz.com/touch-nfc/ http://weblog.cenriqueortiz.com/touch-nfc/ Anyhow, I see much more potential when the ability to transfer money quickly is paired with an all-powerful computer in your pocket. So we need someone to both figure out a secure process and provide apps/APIs to leverage that. Apple, anyone?

sbierwagen 16y ago

This is cool, but it solves the wrong problem. The two biggest sources of credit card fraud are: 1.) Credit card numbers stolen from merchants with insecure systems. 2.) Credit card stripe information stolen by skimmers installed on legitimate terminals. To combat these, you either need an entirely new system, (which would require every bank, everywhere, to buy into a new system, and thus will never happen) or something that generates new credit card numbers on the fly. Hey, that would actually make this workable. Have your bank generate ten one time use credit card numbers. Upload them to your smart credit card. Each time you swipe it, it uses up a CC#. After ten swipes, it's an inert piece of plastic until you reauthorize it.

henrikschroder 16y ago
I know there are banks here in Sweden where you can get one-time VISA numbers for online purchases. You enter a maximum amount where you guess your purchase will end up, you get a VISA number and expiry date and all that, and it's valid for one purchase. If someone stores that number or tries to use it again, they're shit out of luck because the thing isn't connected to your account, you are not liable in any way. However, those are only practical for occasional purchases, I'd assume you would run through the numberspace pretty quickly if everyone had that by default on their cards. But it's a neat idea. :-)
- qeorge 16y ago
  Chase offers this, as well as PayPal. In addition, you can generate MasterCard numbers that only work with a specific merchant, but can be used many times.