4 ms·

It utterly infuriates me that banks won't let you use their mobile apps -- which are inevitably their websites packaged in a bundle, with added tracking -- on a

It utterly infuriates me that banks won't let you use their mobile apps -- which are inevitably their websites packaged in a bundle, with added tracking -- on a rooted (or jailbroken) phone, even though I am sure that the overwhelming majority of users on android who have a rooted device are likely to be the most technically sophisticated, with (in my case) the presence of mind to install updates to their four-year-old but perfectly usable device that would otherwise be considered EOL by its manufacturer. Meanwhile, the banks are expanding the contactless limit to £300 -- despite academics showing that covert antennas can do "wallet sniping" easily -- and have a horrendous attitude to security. 2FA is entirely based around random numbers and "Private Number" caller-ID barred phone numbers -- meaning that if someone was spoofing your account details, you'd never know. Their fraud detection algorithms tend to be quite good, but only if "your" criminal has stereotypical tastes -- I've been called up after I bought a computer at the apple store, for example, which is in-keeping with me, but not when my card was cloned and someone bought lots of drinks at a Weatherspoons.

mdp2021 5y ago
> expanding the contactless limit ... wallet sniping I am quite interested in the security details of NFC. Where is the best information you found? Unfortunately my searches found too little. BTW: apparently someone managed to use a fault in the protocol to steal well more than the limit. And by the way, if any product proposer mentions a "limit", in order not to be brainless they must also mention a "rate" (e.g. 10€ per hour), and I have never seen anyone do it.
- azalemeth 5y ago
  Here are a few articles -- admittedly several are quite old, but I am sure I have seen more than this elsewhere. They either discuss attacks, or attack mitigations. -- "Contactless payment data can be picked up at a distance" (2013) https://www.bbc.com/news/technology-24743920 https://www.bbc.com/news/technology-24743920 -- "Mobile device prevention of contactless card attacks", US patent, 2014; https://patents.google.com/patent/US9379841B2/en https://patents.google.com/patent/US9379841B2/en -- "Proximity verification for contactless card control and authentication systems", Proc. Annual Computer Security Applications Conference, 2015; https://dl.acm.org/doi/abs/10.1145/2818000.2818004 https://dl.acm.org/doi/abs/10.1145/2818000.2818004 -- Finally, a fairly good review article: "internet of Smart Cards: a pocket attacks scenario"; Intl. J. Critical Infrastructure Protection; 2019; https://www.sciencedirect.com/science/article/pii/S1874548219300642 https://www.sciencedirect.com/science/article/pii/S187454821...
novok 5y ago
Fraudsters, for better or worse, will also be in that technical category of people who would use rooted phones too. It's easier to just click the configuration option and materially reduce fraud cost for little work than to do the banking equivalent of porting your game to linux. Similarly with NFC wallet sniping. In practice it doesn't happen, and because it's a merchant credit card transaction, significantly easier to roll back in time once customers start filing charge backs for them, which is a major reason probably why it doesn't happen much in the first place. Physical wallet snipping is also too much work compared to other schemes available.

mdp2021 5y ago

> expanding the contactless limit ... wallet sniping I am quite interested in the security details of NFC. Where is the best information you found? Unfortunately my searches found too little. BTW: apparently someone managed to use a fault in the protocol to steal well more than the limit. And by the way, if any product proposer mentions a "limit", in order not to be brainless they must also mention a "rate" (e.g. 10€ per hour), and I have never seen anyone do it.

azalemeth 5y ago
Here are a few articles -- admittedly several are quite old, but I am sure I have seen more than this elsewhere. They either discuss attacks, or attack mitigations. -- "Contactless payment data can be picked up at a distance" (2013) https://www.bbc.com/news/technology-24743920 https://www.bbc.com/news/technology-24743920 -- "Mobile device prevention of contactless card attacks", US patent, 2014; https://patents.google.com/patent/US9379841B2/en https://patents.google.com/patent/US9379841B2/en -- "Proximity verification for contactless card control and authentication systems", Proc. Annual Computer Security Applications Conference, 2015; https://dl.acm.org/doi/abs/10.1145/2818000.2818004 https://dl.acm.org/doi/abs/10.1145/2818000.2818004 -- Finally, a fairly good review article: "internet of Smart Cards: a pocket attacks scenario"; Intl. J. Critical Infrastructure Protection; 2019; https://www.sciencedirect.com/science/article/pii/S1874548219300642 https://www.sciencedirect.com/science/article/pii/S187454821...

novok 5y ago

Fraudsters, for better or worse, will also be in that technical category of people who would use rooted phones too. It's easier to just click the configuration option and materially reduce fraud cost for little work than to do the banking equivalent of porting your game to linux. Similarly with NFC wallet sniping. In practice it doesn't happen, and because it's a merchant credit card transaction, significantly easier to roll back in time once customers start filing charge backs for them, which is a major reason probably why it doesn't happen much in the first place. Physical wallet snipping is also too much work compared to other schemes available.