4 ms·

That's exactly what I came here to say - if this can do chip and PIN, then can't we assume chip and PIN is broken? Cloning a mag stripe is trivial, cloning chip

That's exactly what I came here to say - if this can do chip and PIN, then can't we assume chip and PIN is broken? Cloning a mag stripe is trivial, cloning chip and PIN should be as close to impossible as is feasible.

Barfo 12y ago
Smart cards (and NFC) are designed to make it nearly impossible to extract the private key/encryption keys.
- ZoF 12y ago
  Yep, that's his point.
- mholmes680 12y ago
  famous last words....
  - Nursie 12y ago
    EMV has been out in the wild since the late 90s. So far all the attacks I've read about (and some of them are very serious attacks!) are to do with the protocol between card, terminal and acquirer. None that I'm aware of has yet exposed a private key, with the possible exception of one that required an electron microscope. They are famous last words, but in this case they seem justified.
glitch 12y ago
For the record, Chip and PIN is kind of broken... • "Chip and PIN is Broken" (Murdoch/Drimer/Anderson/Bond, 2010) [PDF] http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.p... • "Chip and PIN is Broken" (Murdoch, 27C3, 2010) [Video]: http://www.youtube.com/watch?v=Ks_w352BS-Q http://www.youtube.com/watch?v=Ks_w352BS-Q • "Chip & PIN is definitely broken" (Barisani/Bianco/Laurie/Franken, 2011) [Video]: http://www.youtube.com/watch?v=JABJlvrZWbY http://www.youtube.com/watch?v=JABJlvrZWbY ...and slides [PDF]: http://dev.inversepath.com/download/emv/emv_2011.pdf http://dev.inversepath.com/download/emv/emv_2011.pdf
- danielweber 12y ago
  In the US, the big benefit of Chip and PIN will be that retailers don't have any credit card information to store.
  - deleted 12y ago
    [deleted]
  - wastedhours 12y ago
    Do they hold a unique token though? Here in the UK, I've definitely gotten "loyalty" offers printed with my receipt even though I've only ever used my debit card there and not a store card.
    - Nursie 12y ago
      Depending on the system they can still get an account/card number. They shouldn't be storing it but... They can certainly get cardholder names and that sort of thing though. Maybe they've figured out a way to generate a unique token based only on non-secure data.
- bravo22 12y ago
  Well in defence of Chip and PIN (and I can't believe I'm saying this), the exploits listed above take advantage of "No Signature" provided. This is where the card just gives the basic CC information -- same as what is on the front. The bank can see this and banks only allow small transactions to go through with no signature. In the demo they buy coffee, etc. with it. You couldn't buy something more expensive with it because the bank would deny the charge. NFC is similar. You can use it for small transactions, but not larger ones.
  - abritishguy 12y ago
    That certainly isn't true of the Cambridge one.
    - 12y ago

Barfo 12y ago

Smart cards (and NFC) are designed to make it nearly impossible to extract the private key/encryption keys.

ZoF 12y ago
Yep, that's his point.
mholmes680 12y ago
famous last words....
- Nursie 12y ago
  EMV has been out in the wild since the late 90s. So far all the attacks I've read about (and some of them are very serious attacks!) are to do with the protocol between card, terminal and acquirer. None that I'm aware of has yet exposed a private key, with the possible exception of one that required an electron microscope. They are famous last words, but in this case they seem justified.

glitch 12y ago

For the record, Chip and PIN is kind of broken... • "Chip and PIN is Broken" (Murdoch/Drimer/Anderson/Bond, 2010) [PDF] http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/~sjm217/papers/oakland10chipbroken.p... • "Chip and PIN is Broken" (Murdoch, 27C3, 2010) [Video]: http://www.youtube.com/watch?v=Ks_w352BS-Q http://www.youtube.com/watch?v=Ks_w352BS-Q • "Chip & PIN is definitely broken" (Barisani/Bianco/Laurie/Franken, 2011) [Video]: http://www.youtube.com/watch?v=JABJlvrZWbY http://www.youtube.com/watch?v=JABJlvrZWbY ...and slides [PDF]: http://dev.inversepath.com/download/emv/emv_2011.pdf http://dev.inversepath.com/download/emv/emv_2011.pdf

danielweber 12y ago
In the US, the big benefit of Chip and PIN will be that retailers don't have any credit card information to store.
- deleted 12y ago
  [deleted]
- wastedhours 12y ago
  Do they hold a unique token though? Here in the UK, I've definitely gotten "loyalty" offers printed with my receipt even though I've only ever used my debit card there and not a store card.
  - Nursie 12y ago
    Depending on the system they can still get an account/card number. They shouldn't be storing it but... They can certainly get cardholder names and that sort of thing though. Maybe they've figured out a way to generate a unique token based only on non-secure data.
bravo22 12y ago
Well in defence of Chip and PIN (and I can't believe I'm saying this), the exploits listed above take advantage of "No Signature" provided. This is where the card just gives the basic CC information -- same as what is on the front. The bank can see this and banks only allow small transactions to go through with no signature. In the demo they buy coffee, etc. with it. You couldn't buy something more expensive with it because the bank would deny the charge. NFC is similar. You can use it for small transactions, but not larger ones.
- abritishguy 12y ago
  That certainly isn't true of the Cambridge one.
  - 12y ago