Contactless Payment

[Arrowfoot]

Someone I know was delighted to get his over-sixties bus pass. He made great use of it but was very disappointed to discover that the bus readers were debiting funds from other contactless cards in his wallet when he waved it at the gizmo.

Thats another urban myth. Only one transaction can occur no matter how long you hold a card. The reading is limited by NFC (near field communication) which is around 4 to 5 cm. If more than one card is tapped on the reader at the same time, there is a conflict and nothing will go thru. You can try it by placing your wallet full of cards against a Tube reader or a supermarket proximity reader.

People tend to get confused when they read their statement and find out that their debit card has a contactless charge when they usually use their credit card or another bank's card. They then wrongly assume that it pinged them twice. It just that they have inadvertently pulled out the wrong card instead of the usual card.

Here is something folks can do to see if these claims have any merit. Go to one of the supermarkets late at night on a slow day and try every possibility for a bar of chocolate i.e. press multiple cards on the reader at the same time, place the wallet full of cards , leave the card against the reader for long as you like, against the reader, tap the card multiple times etc.

NFC was created just for this and bluetooth technology which has much longer range was not allowed.

 

[Mark1978]

This guy is a plonker

http://www.huffingtonpost.co.uk/201...ally-inserts-oyster-card-chip-_n_7620036.html

 

[Dan B]

Urban Myth. Those who got fooled into providing their card and PIN to supposed "Bank reps" make those claims to avoid getting hit with the bill. The scams are frequent and the elderly are usually targeted.

http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf

Are you going to explain why these researchers are wrong, or you're going to parrot the line of some card industry PR/damage control rep?

 

[Mark1978]

Why is he a plonker?

He's not the first person to do this sort of thing. There's a couple of academics (e.g. Kevin Warwick and Mark Gasson) who have done the same thing, where they have RFID chips implanted to allow them to control their environment and offices.

Because it didn't actually work properly. (and he performed a surgical operation on himself)

 

[Arrowfoot]

http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf

Are you going to explain why these researchers are wrong, or you're going to parrot the line of some card industry PR/damage control rep?

Ross Anderson is well known for breaking everything that the card companies have put over the years as he does not understand the concept of tamper resistant. None of the attacks in real life have occurred and over the years. I am sure if he will also find a way into Fort Knox.

I would suggest that you do not use the any of the cards if you are really uncomfortable. If I took your approach I would not dare ride my bike on the road.

 

[Dan B]

Ross Anderson is well known for breaking everything that the card companies have put over the years as he does not understand the concept of tamper resistant.

First you said it was an urban myth that C&P had been broken. Now you say it's "well known" that Ross Anderson has broken it. Your conception of "tamper resistant" seems to be no more than two steps removed from anyone else's concept of "security through obscurity".

 

[Tin Pot]

I love security arguments.

Non-repudiation!

<rolls in hand grenade>

<scarpers>

 

[Arrowfoot]

First you said it was an urban myth that C&P had been broken. Now you say it's "well known" that Ross Anderson has broken it. Your conception of "tamper resistant" seems to be no more than two steps removed from anyone else's concept of "security through obscurity".

C&P has not been broken to my knowledge. Do you know of any case?

 

[slowmotion]

Thats another urban myth. Only one transaction can occur no matter how long you hold a card. The reading is limited by NFC (near field communication) which is around 4 to 5 cm. If more than one card is tapped on the reader at the same time, there is a conflict and nothing will go thru. You can try it by placing your wallet full of cards against a Tube reader or a supermarket proximity reader.

People tend to get confused when they read their statement and find out that their debit card has a contactless charge when they usually use their credit card or another bank's card. They then wrongly assume that it pinged them twice. It just that they have inadvertently pulled out the wrong card instead of the usual card.

Here is something folks can do to see if these claims have any merit. Go to one of the supermarkets late at night on a slow day and try every possibility for a bar of chocolate i.e. press multiple cards on the reader at the same time, place the wallet full of cards , leave the card against the reader for long as you like, against the reader, tap the card multiple times etc.

NFC was created just for this and bluetooth technology which has much longer range was not allowed.

It wasn't a case of multiple debits from a single swipe, just that the bus pass had a lower priority to the reader than ones which cost him money, rather than being free.

 

[vernon]

How deep?

Is your love?

 

[nickyboy]

I shall be in that there Laaaandaan tomorrow for a few days. Having previously been an avid fan of contactless on the tube I am now worrying I will go home, having had my bank account cleared out by those street-smart cockney types

I'm going to make a pair of lead trousers tonight, that should do the trick

 

[vernon]

Well, the Financial Fraud Action group is very careful not to say that Chip and Pin is 100% secure and they say it is only one layer in reducing fraud - not preventing it altogether. Ross Anderson's original research has been replicated and expanded by the team at the University of Cambridge...


...but what would they know, eh?

Perhaps you could enlighten us as to your credentials to comment authoritatively on the subject?

Friend of a friend's financial advisor who is married to someone who read something in the Metro newspaper written by a bank employee whose job it was to promote the security and convenience of chip and pin?

 

[Dan B]

And pavements aren't real gold.

But having said that, the veneer is pretty thick. Tricky in the rain, though

 

[benb]

No system is 100% secure, but C&P is obviously more secure than signature, and the capacity for fraud on contactless is quite low.
IMO the convenience of contactless is worth it, and if you don't want it, you don't have to activate your card for it.

 

[Markymark]

And pavements aren't real gold.

They are in the proper bits that are off limits to tourists.