3 ms·
I will say this is a cool project. However, the implementation of the idea in reality is even worse than NFC. While NFC is useful in many contexts, it then requ
by noobermin 4y ago
I will say this is a cool project. However, the implementation of the idea in reality is even worse than NFC. While NFC is useful in many contexts, it then requires you to put a faraday cage around your card and manually turn on or off the NFC to not get your money stolen, and even then can be circumvented. Even further relaxing the distance constraints even makes it even easier to steal money. I'd imagine a lot of the engineering would go into making it safe (having some set up such that the US sounds vary to some degree...then may be even an authentication protocol..then...then...then...
The moment I saw the headline, I was incredulous. The actual project implementation in the article is a rather cool hack, so props to the author. I dread the day someone actually picks this up, assuming someone does actually choose to.
- andi999 4y agoCool technology, bad problem. I fully agree getting more distance is problematic. Not even in the sense of getting your data stolen, but also to allow pro active payment. I mean you want the customer to do an action (holding the card close to a device which shows the amount deducted) to conclusively agree to that payment. Not the cashier presses a button, and anybody too close pays for it.
- jiveturkey 4y agomodem/phone couplers, anyone?
- andi999 4y agoPhone carriers cut off the frequency spectrum.
- jiveturkey 4y agoi'm just referring to the acoustic isolation from the mechanical coupler. obviously (?) the passband for telephone comms is far short of ultrasonic
- andi999 4y agoWhat do you mean by acoustic isolation?
- jiveturkey 4y agohttps://en.wikipedia.org/wiki/Acoustic_coupler https://en.wikipedia.org/wiki/Acoustic_coupler
- andi999 4y agoYes, but what can ultrasonic do here?
- jiveturkey 4y agoThe complaint was that the wrong payment can be made, because audio leaks.
- andi999 4y agoyes. Now I understand, but then the stated advantage of longer distance is also gone...
- m-s 4y agoHow would you “steal” money from a contactless card or a phone?
- RektBoy 4y agoFor example: NFC Proxy?
- __alexs 4y ago1) Gain access to something like a Stripe Terminal (https://stripe.com/gb/terminal https://stripe.com/gb/terminal) You should probably avoid using your real identity here. 2) Type in a charge like $50 3) Discretely wave the device at your targets wallet 4) Repeat steps 2-3 as much as possible in a short amount of time. 5) Hope you can withdraw the funds before anyone notices. I don't think this is a wildly plausible attack and also at least here in the UK your targets card issuer takes 100% liability for fraudulent charges.
- kybernetikos 4y agoThis attack (and some variants of it, e.g. fooling the proximity detection or man in the middle) work because the acknowledgement action that the user does is simply having the device nearby. This seems like a poor choice of acknowledgement action for something that transfers money. Payment devices should probably have a physical or soft button that you have to press to acknowledge payment.
- underdeserver 4y agoStrong disagree. The usability hit is not worth the added security. Having a cutoff for PIN entry requirement and the card issuer taking responsibility for fraud means customers are quite safe (as long as they look at their charges).
- samhw 4y agoYou could do something like "you need to be physically holding the card with your hand", which would complete some circuit. I can't think of many cases where that wouldn't work, except perhaps people who don't take their cards out of their wallets(?).