[LINK] refusing contactless cards

[Craig Sanders]

On Thu, Aug 01, 2013 at 10:10:04AM +1000, Jeremy Visser wrote:
> On 31/07/13 11:40, Craig Sanders wrote:
> > my bank, Bendingo Bank, just sent me a MasterCard PayPass debit card
> > - I didn't ask for it, and I don't want it.
>
> Care to share your thoughts on why you don?t want one? I?m curious.

because i don't want to carry something in my wallet that can be scanned
remotely to give an attacker my name, credit card number, CCV code (and
possibly other details including my address - i'm not sure about the
address but the other three pieces of data are certain) without any
action on my part and without even my knowledge that it has happened.

this is easily done with very little technical knowledge required (just
google it) and off-the-shelf parts - RFID card readers are available for
about $100 and supply ALL of those details in unencrypted plain text via
a serial connection to computer.

a raspberry pi or similar would make an ideal small, easily concealed
low-power computer for such a task.


unless i log in to my online banking site after going *anywhere*, I may
not even know that my CC details have been stolen until I receive the
next statement - which means that a thief could have a month or more
spending my money. 

theoretically, the bank's liable and will pay me back. in practice, i've
read horror stories about how they make it extremely difficult to prove
it wasn't you, and then drag their heels reimbursing you.

and even if you get it all sorted out, you're still out of pocket for a
few months until you get the money back and your credit rating is likely
to be ruined.

so, no, surprisingly i'm not at all eager for it to be far easier for
that to happen to me.



similarly, I don't want businesses to be able to identify me by name
just because I enter (or walk past) their shop. ditto spooks, cops,
marketing agencies, and other unsavory characters. the fact that
scanning RFID credit cards may be illegal won't stop it happening -
it just means that if i find out about it and figure out who to blame
and make a complaint then it might result in them going to court and
possibly getting a slap on the wrist over it.


craig

-- 
craig sanders <cas at taz.net.au>