Hacker News Reader

Comment by _bxg1 | Hacker News Reader

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.

View on HN

> It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches

This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless.

Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.

From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem

Yes, exactly.

>Very easy to skim even while it's still in your pocket

Do you have any details on that?

From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim.

I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)

I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed.

When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.

It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess

The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.

I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

That's Static Data Authentication. Dynamic Data Authentication is also a thing - the recommended thing nowadays, actually. Check it out https://www.openscdp.org/scripts/tutorial/emv/DDA.html

These schemes are independent of physical transfer mechanism (well, mostly)

Edit: https://en.m.wikipedia.org/wiki/Contactless_smart_card you might be talking about MSD while I'm talking about EMV. C'mon, America, you're better than that

my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?

I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN

At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.

£30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).

> £30 currently. Though mobile payments don’t fall foul of this in theory

I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.

Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.

Not sure where you are or why you experience this - I've made £300+ payments on my phone for sure (car service) and I think I might have done one close to £1000 at one point.

I regularly do payments >£30 with Android Pay. I'm not even sure where the limit is. It is probably an issuer limit.

>in practice some terminals are limited to £30 to match the card limit

Mostly the fault of a cheap implementation from my understanding as they them don't have the data required to verify the CDCVM.

£30 in the UK, and PIN is required 'occasionally'

https://www.barclays.co.uk/current-accounts/debit-cards/cont...

As mentioned by others, the limit was raised to £30 over 4 years ago. Although, there is SCA (Strong Customer Authentication) regulation in the pipeline. I received an alert from at least two providers last year, albeit it does not apply to Apple Pay or Google Pay. However, due to Brexit, it remains to seen, if the banks will continue to implement it, or maybe change it to fit a new framework or renege on this pledge entirely.

Every time you make payments totalling €150 (£127) since you last entered your PIN, the contactless transaction will be declined. And a payment will be declined every time you’ve made five contactless payments in a row.

https://www.telegraph.co.uk/technology/2020/02/06/new-europe...

I wonder what that meansーーwill you get an actual rejection or some sort of ‘downgrade’ workflow where you’ll be prompted to swipe? Or will I just look like a broke dude semi-randomly?

Probably the same thing it does now randomly. The reader says "Please use chip and PIN" then you follow the chip and PIN flow which automatically unlocks your card.

It will tell the terminal to demand a PIN, just as if you had inserted the card. It happening regularly will make the flow non-weird, at least.

For my cards (Italian visa and Hungarian MasterCard) I think it's 25EUR/5000HUF, above that you need a PIN.

Depends on card issuer, jurisdiction, retailer, security heuristics, etc.

Most of my cards have a $100 contactless limit for most retailers. Costco gets $200.

Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.

And isn't your actual credit card number

> it's via bluetooth

NFC (same as contactless CCs), not Bluetooth.

Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.

Reply on news.ycombinator.com