4 ms·

tl;dr (or watch the video): The software used looks like: http://sourceforge.net/p/nfcproxy/wiki/Home/ http://sourceforge.net/p/nfcproxy/wiki/Home/ Pretty cool

tl;dr (or watch the video): The software used looks like: http://sourceforge.net/p/nfcproxy/wiki/Home/ http://sourceforge.net/p/nfcproxy/wiki/Home/ Pretty cool to be able to back up and keep your cards on your phone in a usable way.

CountSessine 14y ago
Very cool - no doubt. But I'll take a pass on letting someone else back up my credit card info for me. Is there really no challenge-confirm-response built into this technology?
- __david__ 14y ago
  Yeah, it strikes me as crazy that they'd make a new technology and not use some sort of public key/private key encryption to make non-duplicable transactions.
- vy8vWJlco 14y ago
  Based on my reading, there definitely are challenge/response protocols, but they also seem quite dependent on the specific merchant/POS (and issuer) as to whether or not they are enforced or effective (for example, there could be an offline-purchase system that reconciles latter in the day instead of with every transaction, or the issuer might use a static/clonable challenge). I'm still learning... Interestingly, CBC had an article a few years ago anticipating today's: http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-credit-cards-security-concerns.html http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-cr... It outlines a few interesting hacks (ex, anticipatory challenge/response gathering). Mostly, it just seems very easy to get the card number and expiry - and apparently that's not a secret, or anything to be concerned about, as far as the credit card company is concerned.
sturmeh 14y ago
You can't use it to back up your cards for use with PayPass. The idea is that you can scan a card in one location and simultaneously use it in another location by using two phones as a proxy medium. A successful skim would involve one person attempting to complete a paypass transaction with their phone in McDonalds, and another person attempting to scan someone's card in the restaurant (by the looks of it, it needs to be over WiFi?).
- vy8vWJlco 14y ago
  This is the proxy method, but I think in a worst-case scenario, it is possible to emulate the card from the perspective of an older non-cryptographically-challenge-based reader. Specifically, there seems to be interoperability between PayPass (PayWave) M/Chip cards and MagStripe terminals (insecure), so they may only be as secure as the MagStripe terminal, which they have to maintain backwards compatibility with (even though it's called "MagStripe" I believe it is still a contactless interface). I'm still learning about it myself, so correct me if I'm wrong.

CountSessine 14y ago

Very cool - no doubt. But I'll take a pass on letting someone else back up my credit card info for me. Is there really no challenge-confirm-response built into this technology?

__david__ 14y ago
Yeah, it strikes me as crazy that they'd make a new technology and not use some sort of public key/private key encryption to make non-duplicable transactions.
vy8vWJlco 14y ago
Based on my reading, there definitely are challenge/response protocols, but they also seem quite dependent on the specific merchant/POS (and issuer) as to whether or not they are enforced or effective (for example, there could be an offline-purchase system that reconciles latter in the day instead of with every transaction, or the issuer might use a static/clonable challenge). I'm still learning... Interestingly, CBC had an article a few years ago anticipating today's: http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-credit-cards-security-concerns.html http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-cr... It outlines a few interesting hacks (ex, anticipatory challenge/response gathering). Mostly, it just seems very easy to get the card number and expiry - and apparently that's not a secret, or anything to be concerned about, as far as the credit card company is concerned.

sturmeh 14y ago

You can't use it to back up your cards for use with PayPass. The idea is that you can scan a card in one location and simultaneously use it in another location by using two phones as a proxy medium. A successful skim would involve one person attempting to complete a paypass transaction with their phone in McDonalds, and another person attempting to scan someone's card in the restaurant (by the looks of it, it needs to be over WiFi?).

vy8vWJlco 14y ago
This is the proxy method, but I think in a worst-case scenario, it is possible to emulate the card from the perspective of an older non-cryptographically-challenge-based reader. Specifically, there seems to be interoperability between PayPass (PayWave) M/Chip cards and MagStripe terminals (insecure), so they may only be as secure as the MagStripe terminal, which they have to maintain backwards compatibility with (even though it's called "MagStripe" I believe it is still a contactless interface). I'm still learning about it myself, so correct me if I'm wrong.