4 ms·
Very cool - no doubt. But I'll take a pass on letting someone else back up my credit card info for me. Is there really no challenge-confirm-response built into
by CountSessine 14y ago
Very cool - no doubt. But I'll take a pass on letting someone else back up my credit card info for me.
Is there really no challenge-confirm-response built into this technology?
- __david__ 14y agoYeah, it strikes me as crazy that they'd make a new technology and not use some sort of public key/private key encryption to make non-duplicable transactions.
- vy8vWJlco 14y agoBased on my reading, there definitely are challenge/response protocols, but they also seem quite dependent on the specific merchant/POS (and issuer) as to whether or not they are enforced or effective (for example, there could be an offline-purchase system that reconciles latter in the day instead of with every transaction, or the issuer might use a static/clonable challenge). I'm still learning... Interestingly, CBC had an article a few years ago anticipating today's: http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-credit-cards-security-concerns.html http://www.cbc.ca/news/technology/story/2010/05/31/f-rfid-cr... It outlines a few interesting hacks (ex, anticipatory challenge/response gathering). Mostly, it just seems very easy to get the card number and expiry - and apparently that's not a secret, or anything to be concerned about, as far as the credit card company is concerned.