<![CDATA[[SecurityRatty] tag: paypass]]> http://securityratty.com/tag/paypass Fri, 21 Sep 2007 01:05:54 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[What's in your wallet?]]> http://securityratty.com/article/21741ca24a950d04fe753c7e7601e1e1 http://securityratty.com/article/21741ca24a950d04fe753c7e7601e1e1 About a year ago, one of my credit card companies "upgraded" two of my credit cards to include a paypass RFID token in the card. In doing so, they automatically canceled my old card account and changed my credit card numbers (so my automatic charges failed). In my research, I have explored the security and privacy risks of RFID, mainly for a business. But these risks are not limited to the business, the same attacks can work on consumers carrying these cards in their wallets, cards could be cloned or be made to accept fraudulent charges. Thankfully, the financial risk to the consumer is fairly minimal, as any financial loss is carried by the card issuer. Alerting and fixing any mistakes is still a responsibility of the consumer. My complaint with the cards, is that I was sent them automatically with no choice and then had tremendous hassle to get my normal cards back. I called customer service and the representative could not understand why I did not want the card. He had not been trained in how to respond to questions about the technological aspects of the card, and instead he tried to follow his (non-relevant) script about the benefits. After he finished subjecting me to that, I spoke to his manager and was able to get my old cards back. But those came with different numbers because they had to cancel the account and create a new one, which possibly impacted my credit rating.

It seems that UK banks are now experimenting with similar technology, but at least two of their citizens were dismayed (the one who got the card and the one who bothered to write the article). UK (as well as EU and Canadian) citizens seem to be more privacy sensitive as a whole. I did not see any similar articles in the US press, beyond Mastercard assuring consumers that their technology is secure.

As a consumer, the subject of the article and I are both frustrated by the lack of choice given to us by companies trying to impose experimental technology on us. Generally, I am an early adopter of technology, but I don't appreciate the long pages of fine print that accompanied this change. As a business, what should you do about this? Explore which of your customers might be interested in trying out new technology, and get their permission to "upgrade" first! Many people won't care, but you risk alienating those customers that do by not notifying them of the change or giving them a chance to opt-out. You should at least send along a new matching wallet to go with the card.

]]> Wed, 30 Jan 2008 07:07:53 +0000 credit cards cards credit credit card card card issuer credit card companies card account technology What's in your wallet? <![CDATA[Kn1ghtl0rd and Lowtek Mystik's RFID 2.0 PhreakNIC Presentation]]> http://securityratty.com/article/8d41a537993f3d8fa4ada8b2d505806a http://securityratty.com/article/8d41a537993f3d8fa4ada8b2d505806a PhreakNIC about RFID. From the presentations page:

Last year's presentation was high level functionality and basic knowledge of what RFID is. The year they will present the low level technical specs on different communication types, the physics behind RFID reading and transmitting, and the actual circuitry of an RFID tag and what it takes to make them operate more consistently. The presentation will also cover actual tag data and coding schemes with standardization including EPC Gen 2 and other ISO standards such as PayPass RFID enabled credit cards. There will be reader/writer demonstrations as well as other proof of concept demonstrations.

Watch last years presentation]]> Fri, 21 Sep 2007 01:05:54 +0000 rfid presentation paypass rfid rfid tag lowtek mystik readerwriter demonstrations buddies kn1ghtl0rd communication types concept demonstrations Kn1ghtl0rd and Lowtek Mystik's RFID 2.0 PhreakNIC Presentation