4 ms·

Are you claiming that contactless payment are unencrypted?

tjoff 6y ago
There really isn't a "payment", the card broadcast everything needed to anyone who asks. There is no handshake or anything. And yes, it is unencrypted in a lot of countries. There are even apps in the play store for reading them.
- garaetjjte 6y ago
  This is just wrong. https://en.wikipedia.org/wiki/EMV#Transaction_flow https://en.wikipedia.org/wiki/EMV#Transaction_flow Card processes transactions internally, tracks usage limits for offline, etc. Other way you couldn't read transaction history with these android apps. (but I think history access is now restricted and can't be read from new cards)
  - tjoff 6y ago
    No, there are different solutions, and where I live the common practice is to perform the contactless operation while the cashier is still scanning the goods (and thus the total has not even been established), and just press ok when the final total is presented and be on your way. (if the total exceeds a certain number you will be prompted to enter your PIN, but you do not need to use your card again) It pretty much is the same thing as swiping the magnetic stripe. I've read out the information from the card myself and there are multiple demonstrations of it where they have a more powerful antenna and read it from peoples pockets in their wallets.
    - garaetjjte 6y ago
      >It pretty much is the same thing as swiping the magnetic stripe. It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.
      - tjoff 6y ago
        What would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated. Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
        garaetjjte 6y ago
        Because it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode. Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.
        tjoff 6y ago
        Doesn't matter? I'll just use the details that I got on the internet instead.
        garaetjjte 6y ago
        Card not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.

There really isn't a "payment", the card broadcast everything needed to anyone who asks. There is no handshake or anything. And yes, it is unencrypted in a lot of countries. There are even apps in the play store for reading them.

garaetjjte 6y ago
This is just wrong. https://en.wikipedia.org/wiki/EMV#Transaction_flow https://en.wikipedia.org/wiki/EMV#Transaction_flow Card processes transactions internally, tracks usage limits for offline, etc. Other way you couldn't read transaction history with these android apps. (but I think history access is now restricted and can't be read from new cards)
- tjoff 6y ago
  No, there are different solutions, and where I live the common practice is to perform the contactless operation while the cashier is still scanning the goods (and thus the total has not even been established), and just press ok when the final total is presented and be on your way. (if the total exceeds a certain number you will be prompted to enter your PIN, but you do not need to use your card again) It pretty much is the same thing as swiping the magnetic stripe. I've read out the information from the card myself and there are multiple demonstrations of it where they have a more powerful antenna and read it from peoples pockets in their wallets.
  - garaetjjte 6y ago
    >It pretty much is the same thing as swiping the magnetic stripe. It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.
    - tjoff 6y ago
      What would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated. Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
      - garaetjjte 6y ago
        Because it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode. Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.
        tjoff 6y ago
        Doesn't matter? I'll just use the details that I got on the internet instead.
        garaetjjte 6y ago
        Card not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.