|
Monday October 23, 2006
|
I'm sure a lot of you have heard of (or even own) a "Blink" card from Chase. Citibank has something similar with their PayPass cards. Suffice to say, Visa, Mastercard and American Express all offer some sort of built-in RFID chip that lets you pay for stuff by waving it across a special card reader. Pretty neat--if you don't mind the security risks. The New York Times just published an article that reveals the security holes in these "no-swipe" cards. In a study performed by RSA labs on 20 credit cards, it found that the cardholder's name and other info was being transmitted without encryption. It wasn't transmitting the card numbers or expiration dates, thankfully, and card companies are in the process of deleting names from the transmission. These problems will be addressed over time, and I'm not about to put my Blink card in a metal container until I see Dan Costa get hacked. Via NY Times
|
|
|
October 23, 2006 7:15 PM
It did not transmit the CVV code, but the card number and expiration date were in fact transmitted. You can read more at the researchers' site here: http://www.rfid-cusp.org/blog/blog-23-10-2006.html