[Clips] Contactless payments and the security challenges

[Alexander Klimov]

On Sun, 18 Sep 2005, John Gilmore wrote:

> E.g. I can extract money from your RFID payment tag whenever you
> walk past, whether you authorized the transaction or not.

Since the phone has an LCD and a keyboard it is possible to display
``Do you want to pay $2 to ABC, Inc. ?'' and authorize the transaction
only if the user presses OK (larger transactions may require the PIN).
An additional benefit is that it is your own card accepting device and
thus the risk that the PIN is keyloggered is lower (of course, this is
only as far as mobiles are more secure than usual windows pc).

> If you lose your cellphone, you can report it gone (to fifty
> different systems), and somehow show them your new Motorola RFID,
> but how is each of them going to know it's you, rather than a
> fraudster doing denial of service or identity theft on you?

I guess the idea is that each transaction is online, so you can just
notify your bank (who can identify you).

> That is only true once -- til anyone who wants to correlates that
> token ID "blob" with your photo on the security camera, your license
> plate number (and the RFIDs in each of your Michelin tires), the
> other RFIDs you're carrying, your mobile phone number, the driver's
> license they asked you to show, the shipping address of the thing
> you just bought, and the big database on the Internet where Equifax
> will turn a token ID into an SSN (or vice verse) for 3c in bulk.

This problem is also solvable if the bank or a separate privacy
certification authority (as it is proposed in the TCG documents)
provides an alternative ID for your phone---an alias of the
endorsement key---for each new transaction,

But do not get me wrong: saying that all the common problems are
easily solvable does not mean that they are in fact solved in this
particular system...

-- 
Regards,
ASK

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com