4 ms·

This may come as a shock to some, but: Magnetic cards (and all existing RFID equivalents) are bad. Instead of encouraging their use, we should be creating the

This may come as a shock to some, but: Magnetic cards (and all existing RFID equivalents) are bad. Instead of encouraging their use, we should be creating the mostly fraud-proof obvious alternative: one in which a single transaction does not give the other party permanent access to your wallet. Picture a card with a key pad on it, for entering a dollar amount. The transaction (through RFID?) would be valid for only that amount. All of the required cryptographic math has existed for decades. All we need now is the hardware and some infrastructure.

yan 17y ago
Entering an amount per transaction might be burdensome to the average consumer, which has a great time with just swiping cards and having all their transactions insured by the credit card company. Having a bulky keypad and a higher barrier of entry to buying that soft drink will have the majority complaining and opting out. If your goal is verification, an alternate system might have a display on the card that simply verifies the amount charged on most recent transaction, signed by the card processor. Crypto on cards is cheap and tested. This will add no new tasks to those that don't care and provide for a peace of mind to those who do.
- asciilifeform 17y ago
  > Entering an amount per transaction might be burdensome to the average consumer Shoppers have dealt with counting out money for millenia. The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it. > a display on the card that simply verifies the amount charged on most recent transaction Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions. Keypad or not, information sent to conduct a physical, face-to-face payment should not be re-usable in any way.
  - yan 17y ago
    > Shoppers have dealt with counting out money for millenia. People have also worked 16 hour days to feed their families for millenia; no one's going to do that now. The amount of effort something takes almost always decreases. > The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it. How does this system provide 'total security' and guard against remote theft? There is no such thing as 'total security,' you're just mitigating risk. From the way it sounded, you punch in the amount at the time of physical swipe. Once you try to buy something online, you're outside the scope of your physical card. I do agree however that you should be able to opt in for services that require more verification for transferring money. If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you. > Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions. No, I guess I personally did not. As far as the information I read about and had limited contact when I was associated with a security lab, carders distribute cc numbers in the thousands and resell them, and eventually do get charged in small amounts. Again, I don't see how a two-factor system would prevent this. But also admittedly, I've never spent any amount of time thinking about it nor did I personally research into this.
    - asciilifeform 17y ago
      > Once you try to buy something online, you're outside the scope of your physical card. A built-in LCD gives you a single-use credit card number. (Such a product already exists, though a Windows-only PC app.) > If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you. And yet the service is offered by no one, and I don't think anyone has yet tried and failed. > Again, I don't see how a two-factor system would prevent this A number is good for one transaction, like a gift card code. In the case of my proposed scheme, it is effectively a PGP message signed with your private key, containing the transaction amount, recipient, and a serial number. The bank shall not process any attempted transaction which is not signed by an account holder's key or contains a duplicate serial number.
mitko 17y ago
To increase the reliablity of a system, improve the weak links in a system, not the strong. In a computer systems class we had a lecture about security and cryptographics. There were many case studies of fraud, and almost none of them were deciphering codes. There were many other way easier approaches to steal money from bank accounts.
- asciilifeform 17y ago
  > improve the weak links in a system, not the strong How is the fact that a credit card number (given online or copied down by a waiter) gives armies of thieves continuous access to my account not a weak link?
rms 17y ago
These guys raised 5.7MM and believe it or not they won $400k from business plan competitions! http://www.cmu.edu/news/archive/2009/October/oct15_dynamics.shtml http://www.cmu.edu/news/archive/2009/October/oct15_dynamics....
keltecp11 17y ago
I like Venmo text technology more...
diN0bot 17y ago
totally. one of my housemates reads and writes magnetic strips for fun. we buy a couple memberships to something and then duplicate the cards to share.
- jarsj 17y ago
  hey, will you care to share some leads. I am interested in learning this (for fun ofcourse).
- pbhjpbhj 17y ago
  we buy a couple memberships to something and then duplicate the cards to share Hey that does sound fun, it also sounds like criminal fraud.
  - trimski 17y ago
    It's really no more criminal than sharing the physical card by passing it around, though the law may disagree.
    - pbhjpbhj 17y ago
      If the card conditions of use say, or imply (eg by bearing a single name) that the membership is non-transferable and single user then it is fraud. Whether you find that reprehensible and whether it is illegal in your jurisdiction are different questions.
    - mquander 17y ago
      You know, words have definitions. If you and the law disagree about what's criminal, the law is correct.
      - trimski 17y ago
        You're right, that was a rather asinine thing I said.

yan 17y ago

Entering an amount per transaction might be burdensome to the average consumer, which has a great time with just swiping cards and having all their transactions insured by the credit card company. Having a bulky keypad and a higher barrier of entry to buying that soft drink will have the majority complaining and opting out. If your goal is verification, an alternate system might have a display on the card that simply verifies the amount charged on most recent transaction, signed by the card processor. Crypto on cards is cheap and tested. This will add no new tasks to those that don't care and provide for a peace of mind to those who do.

asciilifeform 17y ago
> Entering an amount per transaction might be burdensome to the average consumer Shoppers have dealt with counting out money for millenia. The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it. > a display on the card that simply verifies the amount charged on most recent transaction Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions. Keypad or not, information sent to conduct a physical, face-to-face payment should not be re-usable in any way.
- yan 17y ago
  > Shoppers have dealt with counting out money for millenia. People have also worked 16 hour days to feed their families for millenia; no one's going to do that now. The amount of effort something takes almost always decreases. > The time spent is a small price to pay for total security against remote theft. At the very least, those of us who are not terminally lazy ought to have the option of paying it. How does this system provide 'total security' and guard against remote theft? There is no such thing as 'total security,' you're just mitigating risk. From the way it sounded, you punch in the amount at the time of physical swipe. Once you try to buy something online, you're outside the scope of your physical card. I do agree however that you should be able to opt in for services that require more verification for transferring money. If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you. > Ever have your credit or bank card stolen? Thieves typically split their theft into numerous small transactions. No, I guess I personally did not. As far as the information I read about and had limited contact when I was associated with a security lab, carders distribute cc numbers in the thousands and resell them, and eventually do get charged in small amounts. Again, I don't see how a two-factor system would prevent this. But also admittedly, I've never spent any amount of time thinking about it nor did I personally research into this.
  - asciilifeform 17y ago
    > Once you try to buy something online, you're outside the scope of your physical card. A built-in LCD gives you a single-use credit card number. (Such a product already exists, though a Windows-only PC app.) > If you want to spend $25 to get an RSA token to provide a code every time you purchase something, I don't see anything wrong with that service being offered to you. And yet the service is offered by no one, and I don't think anyone has yet tried and failed. > Again, I don't see how a two-factor system would prevent this A number is good for one transaction, like a gift card code. In the case of my proposed scheme, it is effectively a PGP message signed with your private key, containing the transaction amount, recipient, and a serial number. The bank shall not process any attempted transaction which is not signed by an account holder's key or contains a duplicate serial number.

mitko 17y ago

To increase the reliablity of a system, improve the weak links in a system, not the strong. In a computer systems class we had a lecture about security and cryptographics. There were many case studies of fraud, and almost none of them were deciphering codes. There were many other way easier approaches to steal money from bank accounts.

asciilifeform 17y ago
> improve the weak links in a system, not the strong How is the fact that a credit card number (given online or copied down by a waiter) gives armies of thieves continuous access to my account not a weak link?

rms 17y ago

These guys raised 5.7MM and believe it or not they won $400k from business plan competitions! http://www.cmu.edu/news/archive/2009/October/oct15_dynamics.shtml http://www.cmu.edu/news/archive/2009/October/oct15_dynamics....

keltecp11 17y ago

I like Venmo text technology more...

diN0bot 17y ago

totally. one of my housemates reads and writes magnetic strips for fun. we buy a couple memberships to something and then duplicate the cards to share.

jarsj 17y ago
hey, will you care to share some leads. I am interested in learning this (for fun ofcourse).
pbhjpbhj 17y ago
we buy a couple memberships to something and then duplicate the cards to share Hey that does sound fun, it also sounds like criminal fraud.
- trimski 17y ago
  It's really no more criminal than sharing the physical card by passing it around, though the law may disagree.
  - pbhjpbhj 17y ago
    If the card conditions of use say, or imply (eg by bearing a single name) that the membership is non-transferable and single user then it is fraud. Whether you find that reprehensible and whether it is illegal in your jurisdiction are different questions.
  - mquander 17y ago
    You know, words have definitions. If you and the law disagree about what's criminal, the law is correct.
    - trimski 17y ago
      You're right, that was a rather asinine thing I said.