4 ms·

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectivel

by _bxg1 7y ago

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.

simonebrunozzi 7y ago
Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.
- _bxg1 7y ago
  And isn't your actual credit card number
- AceJohnny2 7y ago
  > it's via bluetooth NFC (same as contactless CCs), not Bluetooth.
  - simonebrunozzi 7y ago
    Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.
riffraff 7y ago
my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?
- _bxg1 7y ago
  I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN
  - nvarsj 7y ago
    At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.
    - tokamak-teapot 7y ago
      £30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).
      - Spare_account 7y ago
        > £30 currently. Though mobile payments don’t fall foul of this in theory I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.
        robjan 7y ago
        Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.
        jk563 7y ago
        Not sure where you are or why you experience this - I've made £300+ payments on my phone for sure (car service) and I think I might have done one close to £1000 at one point.
        gpderetta 7y ago
        I regularly do payments >£30 with Android Pay. I'm not even sure where the limit is. It is probably an issuer limit.
      - 7y ago
- Marsymars 7y ago
  Depends on card issuer, jurisdiction, retailer, security heuristics, etc. Most of my cards have a $100 contactless limit for most retailers. Costco gets $200.
TazeTSchnitzel 7y ago
> It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless. Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.
- _bxg1 7y ago
  From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem
  - TazeTSchnitzel 7y ago
    Yes, exactly.
thesimon 7y ago
>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13-roland.pdf https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29bf665576c0b921.pdf https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)
- reaperducer 7y ago
  I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.
  - xenocratus 7y ago
    It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
    - reaperducer 7y ago
      The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.
- _bxg1 7y ago
  I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

by _bxg1 7y ago

simonebrunozzi 7y ago

Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.

_bxg1 7y ago
And isn't your actual credit card number
AceJohnny2 7y ago
> it's via bluetooth NFC (same as contactless CCs), not Bluetooth.
- simonebrunozzi 7y ago
  Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.

riffraff 7y ago

my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?

_bxg1 7y ago
I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN
- nvarsj 7y ago
  At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.
  - tokamak-teapot 7y ago
    £30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).
    - Spare_account 7y ago
      > £30 currently. Though mobile payments don’t fall foul of this in theory I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.
      - robjan 7y ago
        Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.
      - jk563 7y ago
        Not sure where you are or why you experience this - I've made £300+ payments on my phone for sure (car service) and I think I might have done one close to £1000 at one point.
      - gpderetta 7y ago
        I regularly do payments >£30 with Android Pay. I'm not even sure where the limit is. It is probably an issuer limit.
    - 7y ago
Marsymars 7y ago
Depends on card issuer, jurisdiction, retailer, security heuristics, etc. Most of my cards have a $100 contactless limit for most retailers. Costco gets $200.

TazeTSchnitzel 7y ago

> It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless. Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.

_bxg1 7y ago
From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem
- TazeTSchnitzel 7y ago
  Yes, exactly.

thesimon 7y ago

>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13-roland.pdf https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29bf665576c0b921.pdf https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)

reaperducer 7y ago
I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.
- xenocratus 7y ago
  It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
  - reaperducer 7y ago
    The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.
_bxg1 7y ago
I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.