3 ms·

Any arguments about security they make are pretty weak given how badly they screwed the pooch on NFC. It's comically bad. Stuff like "oh, it's cool, we'll just

• guerrilla 4y ago
  What now, this sounds terrible. I'll have to read up on it.
• Nextgrid 4y ago
  MasterCard and most other card networks are happy to shift fraud liability onto the banks and/or merchants. Why should I care as a user that the system is technically insecure if I’m not actually put at risk? I also don’t see the problem with your own device authenticating you - I trust my device more than a random terminal onto which I’m supposed to type a PIN. When it comes to spend limits, this is primarily down to merchants - they are in control of their terminals and can choose to reject (or ask for additional auth - mobile contactless + PIN is technically possible for example) any method if it doesn’t fit their risk appetite. Most merchants choose to allow even completely insecure methods (card-based contactless with no CVM) because in practice the convenience for the prospective shoppers offsets the cost of fraud.
• maccard 4y ago
  The security on a card is really via policy, not via technical security. It doesn't matter how secure your encryption is if you are susceptible to a wrench attack [0]. As long as the bank accepts liability for NFC payments while vehemently denying any liability if you share your pin, it doesn't really matter how technically good their security is. [0] https://xkcd.com/538/ https://xkcd.com/538/
• r0snd0 4y ago
• lxgr 4y ago
  What specific vulnerabilities are you referring to?