5 ms·

That is beyond stupid. Why not have different signing/encryption keys on the individual fobs?

• adrianhoward 14y ago
  Cost/benefit I imagine. It makes the widgets much simpler to manufacture, distribute and use. And the risk, from what I can see, is pretty low. It would have to be a very focused attack to clone my card & get all my auth info for my online banking account since the two sets of data (card + online auth) don't intersect anywhere normally.
• rwmj 14y ago
  Would you even trust the lowest-bidder factory where the card readers are made?
  • adrianhoward 14y ago
    The factory isn't really an additional risk. There's not a networked man-in-the-middle attack via the readers (they're not connected devices). You can't change the algorithm (it needs to be the same one implemented by the online bank). The algorithm is already essentially public (the devices are identical and widespread). Pwning the factory doesn't really give an attacker an advantage.