Hacker News Reader

Comment by jbert | Hacker News Reader

Am I right in thinking that the only thing stopping NFC working at greater distances is signal strength?

If so, presumably someone could make a targetted aerial which would allow functioning over greater distance (like the 'pringle can wifi' approach). If I understand correctly, you will still increase the distance with only one end using a directional antennae.

If so, couldn't someone walk through a crowd and skim passers-by fairly easily?

View on HN

The thing is, that NFC is NOT like RFID. That's how the cards in Korea or Hong-Kong work, and that's how early contactless cards in the US worked. RFID is super easy to abuse, because you can just read what is on the chip and clone the card, even from a large distance. NFC however, is active - if you have an NFC reader, it will NOT be able to read your bank card, because you don't have an authentication key, so your card will literally not send you the details stored on it. I have personally tested this with commercial NFC readers - bank cards cannot be read by them, they only work with approved, authorized,and connected to the internet payment terminals(so they can get the auth key from the bank). That's why it would be very difficult to skim peoples' cards off the street - you most certainly can't do it without an authorized terminal, which means that to get one you would need to register with a bank,and give them all your details and such, which would make you very easily traceable.

Got a pair of Android smartphones running cyanogenmod?

Install this app and start stealing credit cards today! http://sourceforge.net/p/nfcproxy/wiki/Home/

Read how that application works!!!! This is not stealing cards - this is literally capturing signal from the terminal and sending it to a card elsewhere, so the card is still authorized with proper key. And that means that you are NOT getting the card details for yourself, and that you still need access to a registered and authorized payment terminal.

So the issue stopping NFC abuse is the policing of questioned payments?

[i.e. someone with a auth key can basically choose to charge people what they want (by using modified aerials), it's up the the people charged to complain sufficiently to get that auth key revoked]

I'd imagine that there might be a low bar of complaints to get a key revoked, but perhaps a higher bar to start legal proceedings?

The problem is, that if you just wire an aerial to a legit payment terminal and point it at people, it will probably pick up more than a single card, in which case, it won't charge anyone. The use case for that is extremely limited.

Reply on news.ycombinator.com