Forgot your password?

typodupeerror

Comment: Re:Why (Score 2) 184

by kav2k (#43764051) Attached to: UK Consumers Reporting Contactless Payment Errors

Well, my point wasn't that the original card is impossible to clone given physical access to the card. My point is that using only radio communication with the chip, it is not possible to clone it. I imagine that NFC stuff and the crypto module are isolated, and the hardware crypto module quite literally has only one command exposed, to generate a response to a challenge. So neither passive (when you hear the challenge and the response) nor active (when you can submit challenges yourself) attacks can give you the required key, even if you can find a bug in NFC that you can exploit.

As for complex protocols. I'm a logician working with proof theory. There have been precedents of full formal verifications of such protocols that, given a set of assumptions about the hardware, can exclude any possibility of a flaw in the protocol itself. Example 1, example 2. It's usually very hard, but can be done, and gives the same rigor as normal mathematical proofs.

Smart card security isn't new. So it's a reasonably mature concept, but it has usability problems in this application.

Comment: Re:Why (Score 3, Interesting) 184

by kav2k (#43763155) Attached to: UK Consumers Reporting Contactless Payment Errors

And I will just repeat what I said when they first came out- why do we need this? Swiping a card is not difficult nor time consuming. Yet contactless is more expensive, more complex, and has remote "skimming" possible issues. It is far enough distance to be potentially dangerous, but not enough to be REALLY convenient (like leaving it in your pocket or purse). Meanwhile, the only problem with the old [card] tech has been reliance on magnetic strips that can and do wear out or get erased. So replace them with invisible IR barcodes or something. Or maybe *contact-full* chips that require touching something.

Contactless payments differ a lot from magnetic stripe swiping, invisible barcodes etc.

They are not static information but an active challenge-response authentication system. You cannot clone the chip; it has an internal cryptographic secret it does not allow you to access, only challenge responses. You can trick it into authorizing a purchase you don't want if you're in physical proximity, which is happening here, but you cannot save that authorization for later use, since the bank is issuing the challenge here, just like with a chip-and-pin purchase. The whole point is to ensure that this is really the actual card.

So the main problem is the lack of user interaction to go ahead with the purchase. A touch button on the card itself would help, but would destroy part of the convenience.

Comment: Re:Hold your horses (Score 1) 117

by kav2k (#43718303) Attached to: Microsoft Patents "Cartoon Face Generation"

The burden should really be on the patent submitter to point out exactly what is so innovative as do deserve a government enforced monopoly over the approach. If the patent is 90% mundane details, it should not be the job of the patent office to pick out what is worthwhile. If the submitter cannot make a concise and convincing argument, then they don't deserve a patent.

Then it falls back to the patent office to pick out which arguments are convincing, which is a pretty much similar task.

If you are going to walk on thin ice, you may as well dance.

Working...