3 ms·

>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as c

>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13-roland.pdf https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29bf665576c0b921.pdf https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)

reaperducer 7y ago
I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.
- xenocratus 7y ago
  It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
  - reaperducer 7y ago
    The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.
_bxg1 7y ago
I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.
- xenocratus 7y ago
  That's Static Data Authentication. Dynamic Data Authentication is also a thing - the recommended thing nowadays, actually. Check it out https://www.openscdp.org/scripts/tutorial/emv/DDA.html https://www.openscdp.org/scripts/tutorial/emv/DDA.html These schemes are independent of physical transfer mechanism (well, mostly) Edit: https://en.m.wikipedia.org/wiki/Contactless_smart_card https://en.m.wikipedia.org/wiki/Contactless_smart_card you might be talking about MSD while I'm talking about EMV. C'mon, America, you're better than that

reaperducer 7y ago

I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.

xenocratus 7y ago
It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
- reaperducer 7y ago
  The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.

_bxg1 7y ago

I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

xenocratus 7y ago
That's Static Data Authentication. Dynamic Data Authentication is also a thing - the recommended thing nowadays, actually. Check it out https://www.openscdp.org/scripts/tutorial/emv/DDA.html https://www.openscdp.org/scripts/tutorial/emv/DDA.html These schemes are independent of physical transfer mechanism (well, mostly) Edit: https://en.m.wikipedia.org/wiki/Contactless_smart_card https://en.m.wikipedia.org/wiki/Contactless_smart_card you might be talking about MSD while I'm talking about EMV. C'mon, America, you're better than that