[LINK] RFI: PayWave/PayPass Contactless Chip Cards

[Roger Clarke]

>On Wed, Apr 11, 2012 at 3:11 PM, Roger Clarke 
><Roger.Clarke at xamax.com.au> wrote:
>>  Is anyone aware of any forms of consumer resistance to these things?
>>
At 15:16 +1000 11/4/12, Andy Farkas wrote:
>I got a new card last week.
>First thing I did was scratch the chip off.

1.  The visible chip is a contact-based chip.

That technology is of long standing, but the banks have only recently 
started using them to reduce the insecurity of card transactions.

I've not done a deep audit myself of course, but my position on this 
aspect is that it's a good thing generally, including for consumers 
(because it disguises data that would otherwise appear on the mag 
stripe, or in more primitive systems on the embossing).

2.  The contactless chip that supports Visa PayWave and MasterCard 
PayPass is embedded in the card (along with the induction coil), and 
can't be seen.

Presumably it would be possible to scratch away at the card, get down 
to the embedded chip, and damage it.  Although it may be easier to 
bend the card sufficiently to break the induction coil and hence 
disable the communications between the contactless chip and the 
reader.


-- 
Roger Clarke                                 http://www.rogerclarke.com/

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in the Faculty of Law               University of NSW
Visiting Professor in Computer Science    Australian National University