4 ms·

EMVCo tokenization generates a token that can only be used with one-time cryptograms generated with a secret key that never leaves the device You mean exactly

by personZ 12y ago

EMVCo tokenization generates a token that can only be used with one-time cryptograms generated with a secret key that never leaves the device You mean exactly like the EMV that is on every Canadian credit card since about 2007? NFC / Chip hold unique tokens that have on device cryptography, exactly as you've described. You can't "steal" anything of consequence via NFC or the chip, and that's why it was designed. Further while you say that it's for the vendor, the liable party for fraud is actually the credit card companies, which is exactly why they made EMV. You seem to think this is all new because of EMVCo, however it is a standardization for the last mile: Google Wallet originally was doing what the credit cards themselves do, holding the secret key and identifiers on an NXP secure element. There are issues with that (largely carrier related) which is why the industry started moving to software-held tokens, as in the Apple solution. Presenting an iPhone token offers zero additional security over presenting a Canadian chip or NFC credit card, and that notion is rather ridiculous.

natrius 12y ago
Hm. There's a chance that your contactless card sends a different token that isn't your credit card number when you pay that way. I'm not sure. If so, you're right that it's basically the same level of security. However, the new way lets you do the same thing in software without giving all your transactions to Google, which is nice. We'll be able to do online payments that are as secure and private as NFC, which we can't today.
lstamour 12y ago
Sadly, you can read magstripe data via NFC with today's contactless cards. I've seen apps do it on the Google Play store today. See section 5.1 on page 7 here: http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12055-woot13-roland.pdf http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f... Note though, replay attacks require downgrading the card and suggesting it's not actually EMV-secured. And um, it appears all you need is a cell phone to clone one card onto another, if I'm really reading this right? No wonder we need EMV or stronger, Apple Pay protections. Frankly, the way I see it, we can't move fast enough to one-time use card numbers, however we achieve it... then I suppose more fraud will attack the next weakest point, perhaps passwords or IT systems.

by personZ 12y ago

natrius 12y ago

Hm. There's a chance that your contactless card sends a different token that isn't your credit card number when you pay that way. I'm not sure. If so, you're right that it's basically the same level of security. However, the new way lets you do the same thing in software without giving all your transactions to Google, which is nice. We'll be able to do online payments that are as secure and private as NFC, which we can't today.

lstamour 12y ago

Sadly, you can read magstripe data via NFC with today's contactless cards. I've seen apps do it on the Google Play store today. See section 5.1 on page 7 here: http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.rackcdn.com/12055-woot13-roland.pdf http://0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f... Note though, replay attacks require downgrading the card and suggesting it's not actually EMV-secured. And um, it appears all you need is a cell phone to clone one card onto another, if I'm really reading this right? No wonder we need EMV or stronger, Apple Pay protections. Frankly, the way I see it, we can't move fast enough to one-time use card numbers, however we achieve it... then I suppose more fraud will attack the next weakest point, perhaps passwords or IT systems.