3 ms·

I guess I'm getting downvoted because people just can't fathom how insecure it actually is. https://www.nytimes.com/2016/10/31/technology/how-to-protect-yourse

by tjoff 8y ago

I guess I'm getting downvoted because people just can't fathom how insecure it actually is. https://www.nytimes.com/2016/10/31/technology/how-to-protect-yourself-when-using-a-contactless-card.html https://www.nytimes.com/2016/10/31/technology/how-to-protect... In Britain, where people have arguably embraced contactless cards to a greater extent than individuals in other countries, researchers have routinely been able to copy the financial details of some cards, including the 16-digit card number and expiration date, by merely passing their own N.F.C. reader close to a person’s wallet. There have been numerous other demonstrations of this as well. Another demonstration (site is in Swedish https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skimma-ditt-nya-bankkort https://www.svt.se/nyheter/lokalt/uppsala/sa-kan-tjuven-skim... ).

close04 8y ago
> researchers have routinely been able to copy the financial details of some cards I think this is the key. The implementation of each card may differ leading to inconsistent results. As a general rule I suggest covering up the CVV or scratching it off if you're sure you have it somewhere safe. An option is to also erase the magnetic strip. It might lead to a less useful card (in cases where only magstrip would work) but definitely a more secure one. And for any NFC card an RFID shield sleeve does wonders.
tialaramex 8y ago
Yes, this gets you the data that's printed on the front of the card. You could also get this data by... seeing the card ?
- tjoff 8y ago
  Yes? And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. NFC though has the advantage to be read from a distance, easily through a pocket and wallet (if the wallet doesn't have an rfid shield). Surely open up that attack vector isn't helping? If you are paying attention you can detect someone trying to photograph your card (they shouldn't even be handling it in the first place). But through your pocket? Practically impossible to detect. edit: The fact that we still print everything needed to make a purchase on the card itself isn't particularly flattering for our species.
  - ryanlol 8y ago
    >And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. Nobody actually does this. Name+card#+cvv+expiry just isn’t worth the hassle, easier to get 1000s at a time via phishing or hacking web shops. Stripe dumps are an entirely different market, with ATM pins increasing the value of a single dump up to 100x.
    - tjoff 8y ago
      Yet people still get caught doing it? I'd say it is very much worth the hassle, hadn't it been for the high risk of getting caught. I bet there is zero overlap between those that does it and those that have the slightest clue how to perform a phishing or web shop attack.
      - ryanlol 8y ago
        Oh, I can totally see why someone with zero understanding of how credit card fraud works would attempt and get caught doing this. They simply wouldn't achieve anything. They wouldn't get enough cards to be able to sell them, nor would they be able to cash out this information. I'm sure there is zero overlap between people doing this and people actually profiting from (or causing losses with) credit card fraud. If they actually knew what to do with such information, they'd just be buying it for a couple of dollars a piece.

by tjoff 8y ago

close04 8y ago

> researchers have routinely been able to copy the financial details of some cards I think this is the key. The implementation of each card may differ leading to inconsistent results. As a general rule I suggest covering up the CVV or scratching it off if you're sure you have it somewhere safe. An option is to also erase the magnetic strip. It might lead to a less useful card (in cases where only magstrip would work) but definitely a more secure one. And for any NFC card an RFID shield sleeve does wonders.

tialaramex 8y ago

Yes, this gets you the data that's printed on the front of the card. You could also get this data by... seeing the card ?

tjoff 8y ago
Yes? And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. NFC though has the advantage to be read from a distance, easily through a pocket and wallet (if the wallet doesn't have an rfid shield). Surely open up that attack vector isn't helping? If you are paying attention you can detect someone trying to photograph your card (they shouldn't even be handling it in the first place). But through your pocket? Practically impossible to detect. edit: The fact that we still print everything needed to make a purchase on the card itself isn't particularly flattering for our species.
- ryanlol 8y ago
  >And that is a common technique to do it. Hide a small camera behind the counter, make sure quickly hold a customers card in view of it and you are done. Nobody actually does this. Name+card#+cvv+expiry just isn’t worth the hassle, easier to get 1000s at a time via phishing or hacking web shops. Stripe dumps are an entirely different market, with ATM pins increasing the value of a single dump up to 100x.
  - tjoff 8y ago
    Yet people still get caught doing it? I'd say it is very much worth the hassle, hadn't it been for the high risk of getting caught. I bet there is zero overlap between those that does it and those that have the slightest clue how to perform a phishing or web shop attack.
    - ryanlol 8y ago
      Oh, I can totally see why someone with zero understanding of how credit card fraud works would attempt and get caught doing this. They simply wouldn't achieve anything. They wouldn't get enough cards to be able to sell them, nor would they be able to cash out this information. I'm sure there is zero overlap between people doing this and people actually profiting from (or causing losses with) credit card fraud. If they actually knew what to do with such information, they'd just be buying it for a couple of dollars a piece.