4 ms·

As I Canadian I also read this with a little sadness. It's something I have always wanted ... but now someone made it just as we're close to finishing the trans

As I Canadian I also read this with a little sadness. It's something I have always wanted ... but now someone made it just as we're close to finishing the transition to EMV. It can actually be a bit tricky to use my company card to buy lunch at restaurants sometimes because "there's no chip". Their FAQ says future versions of Coin will support EMV, but I'm not familiar enough with the hardware to know how difficult that is. Would be good for those stupid loyalty/membership cards I guess, if you are good with explaining what the hell this weird card looking thing is and why it will work like the normal cards every single damn time you use it.

Nursie 13y ago
The EMV transaction process has "application selection" as one of its early stages, and some cards do contain multiple applications. However AFAICT this is never across banks or across schemes. So you may get a card that has (say) a Mastercard application on it for domestic use and another for foreign use. In theory, you could slam mastercard, visa, amex, credit, debit, whatever else you want, all on the one chip. Depending on the exact card and terminal implementation a transaction would either use the default application or get an on-screen display asking you which you would like to use. But you'd have to get the banks to load the app on there as there are sensitive keys involved. That's not exactly the same as Coin - you couldn't pre-select which card to use in which situation, and you couldn't load them yourself. I suppose in theory you could have multiple EMV chips on a card like Coin and have a circuit-switching arrangement of some sort. There would need to be a way to embed them there and that would put a limit on things... --edit-- about the stupid loyalty card things - in Australia I noticed most of them had started working on barcodes, and people had smartphone apps that gave them a menu and displayed the right code, pretty cool.
- bdamm 13y ago
  There are three tricks involved with this. One, you may not be able to download the card app from one card and upload it to another. My GlobalCard fu is not well honed enough to tell you what ADPU you'd need to invoke in order to try, but it goes against the goals of the product to allow this anyway. Two, if a credit card company provides you with an EMV card, it's got a private key loaded into the card, and may have even originally been generated on the card. It is outright not allowed under any circumstance to download that private key and upload it to another chip; that would be a major hole in the scheme. Three, not all banks use the same crypto. Even if they all agreed to a single kind of crypto operation, different EMV chips have different performance characteristics when carrying out crypto operations. If the bank can't control the actual EMV chip any more, then they cannot control elements of their payments processing (e.g. session closure within a certain time frame). This problem is the easiest to solve of these three problems. So, unless the banks get on board with allowing their apps and their keys to be provisioned on an already existing card, or provide some kind of proxy mechanism whereby an EMV card can delegate another card to act on its behalf (and imagine the security concerns with that) then this isn't going to happen. I don't see the benefit to the banks for doing this. You're far more likely to see paypal succeeding in turning your phone into your wallet (and they are doing it) then you are to see Visa or MC allowing you to link multiple EMV cards into one.
  - Nursie 13y ago
    1) Agree, you can't get at various bits of data that must be present in order for the card to be able to do what it does. Most likely sits in private 'files' that READ DATA can't access. 2) Yup, and combined with '1' this means that you'd have to get the banks to do it 3) You'd have to get some more cross-scheme standards about the crypto capabilities sorted out. I estimate we could have all the schemes in agreement by... 2025? Or is that optimistic? The benefit would only be to the consumer, in the same way that Coin may benefit people, however any method of doing this with EMV would present some sort of extra attack surface and that's generally Bad(TM).
  - PeterisP 13y ago
    The technical issues are solvable (by any reasonable issuer bank), but Visa/MC simply prohibit you to put competitors together with their cards. Want to add some loyalty cards on the same chip? Sure! Want to combine two different MC products? Sure! Want to have Mastercard together with Visa or some local card network that we dislike? Nope, we don't want that so we'll not allow you to issue such cards.
    - Nursie 13y ago
      Very true. Forgot about that. Share branding? Are you CRAZY???
danudey 13y ago
As another Canadian: 1. Chip cards do make this almost completely irrelevant 2. Supporting EMV is going to be tricky, because cloning those cards is also tricky (skimmers have spent hundreds of thousands on it and haven't figured it out). 3. Most membership cards, even ones that have magnetic stripes on them, actually use the barcodes on the card. Safeway, CostCo, Shoppers, etc. all have mag stripes, but they all use the barcodes. The Coin won't help you with a single one of them. 4. If, as a cashier, someone handed me a Coin and said 'It's okay, it's a Visa', I would say 'no'. No signature, no card number, no anything. There's no difference from my perspective between a person putting their Visa onto the Coin and a person putting someone else's Visa onto the coin, and I'm not going to start accepting obviously cloned cards regardless of who's holding it.

Nursie 13y ago

The EMV transaction process has "application selection" as one of its early stages, and some cards do contain multiple applications. However AFAICT this is never across banks or across schemes. So you may get a card that has (say) a Mastercard application on it for domestic use and another for foreign use. In theory, you could slam mastercard, visa, amex, credit, debit, whatever else you want, all on the one chip. Depending on the exact card and terminal implementation a transaction would either use the default application or get an on-screen display asking you which you would like to use. But you'd have to get the banks to load the app on there as there are sensitive keys involved. That's not exactly the same as Coin - you couldn't pre-select which card to use in which situation, and you couldn't load them yourself. I suppose in theory you could have multiple EMV chips on a card like Coin and have a circuit-switching arrangement of some sort. There would need to be a way to embed them there and that would put a limit on things... --edit-- about the stupid loyalty card things - in Australia I noticed most of them had started working on barcodes, and people had smartphone apps that gave them a menu and displayed the right code, pretty cool.

bdamm 13y ago
There are three tricks involved with this. One, you may not be able to download the card app from one card and upload it to another. My GlobalCard fu is not well honed enough to tell you what ADPU you'd need to invoke in order to try, but it goes against the goals of the product to allow this anyway. Two, if a credit card company provides you with an EMV card, it's got a private key loaded into the card, and may have even originally been generated on the card. It is outright not allowed under any circumstance to download that private key and upload it to another chip; that would be a major hole in the scheme. Three, not all banks use the same crypto. Even if they all agreed to a single kind of crypto operation, different EMV chips have different performance characteristics when carrying out crypto operations. If the bank can't control the actual EMV chip any more, then they cannot control elements of their payments processing (e.g. session closure within a certain time frame). This problem is the easiest to solve of these three problems. So, unless the banks get on board with allowing their apps and their keys to be provisioned on an already existing card, or provide some kind of proxy mechanism whereby an EMV card can delegate another card to act on its behalf (and imagine the security concerns with that) then this isn't going to happen. I don't see the benefit to the banks for doing this. You're far more likely to see paypal succeeding in turning your phone into your wallet (and they are doing it) then you are to see Visa or MC allowing you to link multiple EMV cards into one.
- Nursie 13y ago
  1) Agree, you can't get at various bits of data that must be present in order for the card to be able to do what it does. Most likely sits in private 'files' that READ DATA can't access. 2) Yup, and combined with '1' this means that you'd have to get the banks to do it 3) You'd have to get some more cross-scheme standards about the crypto capabilities sorted out. I estimate we could have all the schemes in agreement by... 2025? Or is that optimistic? The benefit would only be to the consumer, in the same way that Coin may benefit people, however any method of doing this with EMV would present some sort of extra attack surface and that's generally Bad(TM).
- PeterisP 13y ago
  The technical issues are solvable (by any reasonable issuer bank), but Visa/MC simply prohibit you to put competitors together with their cards. Want to add some loyalty cards on the same chip? Sure! Want to combine two different MC products? Sure! Want to have Mastercard together with Visa or some local card network that we dislike? Nope, we don't want that so we'll not allow you to issue such cards.
  - Nursie 13y ago
    Very true. Forgot about that. Share branding? Are you CRAZY???

danudey 13y ago

As another Canadian: 1. Chip cards do make this almost completely irrelevant 2. Supporting EMV is going to be tricky, because cloning those cards is also tricky (skimmers have spent hundreds of thousands on it and haven't figured it out). 3. Most membership cards, even ones that have magnetic stripes on them, actually use the barcodes on the card. Safeway, CostCo, Shoppers, etc. all have mag stripes, but they all use the barcodes. The Coin won't help you with a single one of them. 4. If, as a cashier, someone handed me a Coin and said 'It's okay, it's a Visa', I would say 'no'. No signature, no card number, no anything. There's no difference from my perspective between a person putting their Visa onto the Coin and a person putting someone else's Visa onto the coin, and I'm not going to start accepting obviously cloned cards regardless of who's holding it.