Your Credit Cards Will Never Be the Same Again: Meet Card 2.0

http://mashable.com/2010/09/17/card-2-0-dynamics

by Garbage • 16 years ago

62 73 16 years ago

mashable.com

v4us• 16 years ago

+1 I voite for thesi card + chip on the card. I really love it.

ulf• 16 years ago

Looks cool, anybody knows how the handle the energy issue?

acgourley• 16 years ago

Can someone explain the benefits to me? Thinner wallet, I guess? I don't know if consumers have much to gain from the security, so is this targeted at banks trying to reduce fraud?

It's funny I remember the square guys telling me you can get in a lot of trouble for re-programming credit cards, surprised this technology isn't violating some obscure laws.

dangrossman• 16 years ago

Visa/MasterCard, which create those regulations, are basically owned by their member banks. It's banks that issue credit cards. So if banks want to issue a new kind of credit card with technology like this, they'll rewrite their own regulations to allow it.

poutine2• 16 years ago

Visa and Mastercard are no longer owned by the banks, they both went public in the past couple of years and are increasingly acting as independent organizations.

jasonkester• 16 years ago

Actually, I just wish that US banks would get up to speed with the Chip & PIN thing Europe has been doing since the '90s.

Every time I buy groceries here in England, I get grief about my ancient relic of a Visa card that doesn't even have a chip on it, and thus requires swiping through a reader like the cavemen used to do and then signing a piece of paper.

About every 3rd visit, I get to have a manager called over and explain that I come from a primitive country where the banks still do things the old way.

It's embarrassing.

carbocation• 16 years ago

Banks in the US do issue such cards, and in NYC at least I see them used. Are you certain that your bank does not?

acqq• 16 years ago

I think UK was also the last in Europe to use chips on the cards, which, as far as I know, are the French invention. I remember using their specialized cards with chips there twenty years ago only to make some phone calls.

By the way a lot of elementary security issues with cards are there because all the mechanisms still have to allow Americans to use their magnetic stripes, allowing simple tricks with them that would otherwise not be possible. On another side, chips are no silver bullet when it comes to the security. There are a lot of possible attacks, just some specific set of them would be excluded by only having chips. So no matter how it's popular among the geeks, the real-life solutions to real life problems are not purely technological and probably will never be.

Still, as I live in Europe, I'd personally like to have the cards without the magnetic strip.

gte910h2• 16 years ago

Amex Blue has the Euro chip.

mdaniel• 16 years ago

I will need you to cite your source on that claim. I have the original Blue, with the chip to which you refer, and can assure you that it is not the same chip as in "chip and pin".

It was marketed by Amex with a special RFID-esque reader that was designed to unlock your Amex "password vault" or some such silliness.

It was such a flop that the new Amex cards have switched to actual RFID (or similar technology) for use in "Speed Pay" or whatever, in that you need not take your card out of your wallet to buy things at CVS or Whole Foods (for example).

poutine2• 16 years ago

Chip and PIN have one major drawback for you though: they shift the liability from the merchant to the consumer. With conventional cards you can contest a purchase and the merchant is out of pocket. With Chip and PIN it's like a debit card and typically you the consumer is out.

rue• 16 years ago

Hm? I have combined and separate Visa- and MasterCard-branded chipped cards. Insofar as I know, they work as credit/debit normally does.

henrikschroder4• 16 years ago

Yes, but the card never leaves my hand, and since it's a challenge-response system, you can't skim the data off of it with a fake reader. This means that for someone to buy stuff in my name, they would need to steal my card and peek at my pin-code, and unless I'm a bumbling moron, I will notice if you steal my credit card.

yason• 16 years ago

Swiping and signing is heck of a lot faster than figuring out which to insert the card in this particular terminal, waiting for the damn machine wade through its various phases and navigating through a couple of menus, and eventually entering the PIN code followed by the green enter key.

But that's not the real problem, in my opinion.

With hand-written signatures I was pretty sure that if someone stole my card then with great certainty he couldn't replicate my signature in a way a professional hard-writing analyst could be fooled. Thus, I would have some buffer of justice against the period between stealing my card and informing the bank about it. They could just run the signatures and I would have a pretty strong proof that someone else counterfeited my signature.

With PIN code it's different. As soon as someone types in the correct PIN code, everything is kosher and validated. I can't prove it wasn't me. It doesn't really matter that you're supposedly the only one who knows the PIN code because it's dead easy to eavesdrop and then you're out of luck.

mseebach3• 16 years ago

> Swiping and signing is heck of a lot faster than figuring out which to insert the card in this particular terminal

Well, there's always the issue of unfamiliar terminals, but that's a question of habit. I, for one, can complete a chip+pin transaction faster than most terminals can print a slip for signing.

Cushman7• 16 years ago

Bleh. I hate to see all this new tech trying to drag the credit card infrastructure into the 21st century.

The way credit cards work is exactly wrong— to make a purchase, I have to hand over every single piece of information the merchant needs to convince my bank to give them money. Then they ask the bank for as much money as they want. My bank will /maybe/, in extreme cases, double check with me if I actually want to give it to them.

Now that smartphones are everywhere, we finally have the tech to implement electronic payments the way they should be— where the merchant provides me with /their/ id, and then /I/ tell my bank to make a payment.

But no, not today. "Card 2.0" makes my financial information more secure right up until the moment I swipe it, at which point it's just as stupid and broken as classic credit cards. Not intending any offense towards the founders, but I hope the era of your tech is short-lived.

thinkcomp8• 16 years ago

I agree. I'm biased, but I think phone-based technology is clearly better.

(I run http://www.facecash.com)

Cushman7• 16 years ago

It's a step in the right direction, but (please correct me if I'm wrong) your system still seems to be merchant-initiated. I'm using my phone as a glorified piece of paper; the merchant scans my barcode and processes the transaction on their hardware, the same way they would with plastic.

That still seems ridiculous when my phone itself is a device capable of handling the transaction, yes? I should be scanning the register's barcode. I should be able to see what I'm paying for on my phone as it rings up. I should be able to authorize the payment using whatever securities I want on hardware that I own. I should be able to complete the entire transaction and walk out of the store without ever giving the merchant any information besides what bank I use.

All of that is completely possible with today's tech. Who decided that the future of electronic payment is a debit card in a different form factor?

proexploit2• 16 years ago

That's true, there's still a security concern once you've swiped a payment, but in terms of this secure card, the fact that you need the correct PIN to even see what the credit card number is would make me feel a lot better about losing my wallet.

I've got no data on this, but I'm personally more concerned about a lost/stolen card being intentionally used by someone else rather than a merchant screwing me over.

Is it world changing? No, probably not. Is it a significant improvement? In my opinion, yes.

mikeknoop• 16 years ago

Most (if not all?) credit card companies will not hold you liable in the event your card is stolen. They also require you to get a new credit card number and report the old as stolen in order for this protection to exist.

Now the question is, are you going to trust that just because you have this security card you don't need to report the card as stolen / get a new card?

psranga• 16 years ago

The way I see it is that it's helping with "wallet bloat". It's a gizmo the end consumer buys to convert a stack of cards into a single card. Everything else is icing on the cake that I don't really care about.

I would pay $15 for this device.

sokoloff• 16 years ago

There's little need for your bank to double-check with you for credit cards, IMO. In fact, in the few instances where my bank has checked with me, it's been a pain in the ass. (Travelling or otherwise making unusual purchases.)

If you don't agree to pay a merchant, you dispute the charge after the fact and the onus is on the merchant to prove that you agreed to that amount and that they delivered the product/service satisfactorily, etc.

In 2 decades, I've probably disputed 5 or 6 charges. In every case, it took less than 15 total minutes of time, and averaged under 10. So, in 2 decades, I've spent an hour dealing with credit card issues that smartphones might solve. And believe me, I'm not shy about using the plastic, averaging $30K+ per year in purchases on the card to get the 1% cash back.

I'm just not sure I care about better security for my CC information, and I'm sure I'm not alone...

zhyder2• 16 years ago

Looks like they've integrated a processor and keypad on the cards. Sounds like the problem you describe could be solved with an upgraded POS terminal, where the PIN is typed on the card, and transmitted thru the terminal[1] to the bank (with end-to-end encryption from the card to the bank).

[1] - Probably still need to rely on the terminal for the data transfer; smartphones aren't ubiquitous/convenient/permanently-data-connected enough. The card could either communicate with the POS terminal wirelessly through Bluetooth/NFC, or be attached face-up while entering the PIN code.

bananaandapple3• 16 years ago

Why not type in the pin code at the POS terminal?

All Credit cards (smartcards) in Europe (Visa, etc..) already have a chip integrated . So whenever you do a purchase in the store, you have to enter your pin into the terminal, to complete the transaction. No pin, no transaction.

I don't think that this credit card 2.0 is solving any problem at all.

Maybe the founder have never been to Europ and don't know that this exists here... imagine. hehe.

sendos• 16 years ago

What you are proposing, while great for the consumer, will not happen any time soon, due to the inertia of millions of merchants and their existing POS terminals, and also due to the fact that very few people have smartphones.

Also, how widespread is the problem of people handing over their credit cards to pay for something, and the merchant types in a bigger amount than you want to pay? It doesn't happen, or happens negligibly often. The bigger problem is not that merchants get to ask for as much money as they want when you are there at the store paying for something, but that they now have your credit card number and can, if they are malicious, use it later, or sell it on the black market.

In comparison to your proposal, the new card being proposed can work today without any merchant making any change to their equipment.

And this new card will become very useful once they add something akin to SecureID: That is, after every swipe of the card, the credit card number automatically changes to a new one. This is done on the card, and on the credit card issuer server, so that when the user makes their next purchase, both the card and the card issuer agree what number is being used.

This would make it useless for people to steal credit card numbers. And having this built-in to your credit card, instead of having to go online every time, like some existing systems, makes it extremely convenient and easily adopted by users.

Basically, this would mean no change on the part of users, no change on the part of the merchants, and only change on the part of the card issuers (they need to upgrade their servers and issue new cards), which is great because it is the card issuers that are most impacted by credit card fraud, so they are the most motivated to make a change.

sukuriant• 16 years ago

I notice that the cards consume electricity. I wonder how long the battery lasts, and how they're replaced. Furthermore, there's the whole pressing against your card, and looking at the actual pressing action, it looks like you have to press them pretty hard (or maybe he just was). How durable is the card, really?

lockesh• 16 years ago

The biggest source of credit card fraud is that there's no standard way of proving that someone is in physical possession of the card.

Online transactions only require CC#/Exp/CV2 name/address etc which are stored on merchant machines and then compromised and released to the while.

A much more secure option would be to have CCs with built-in RSA key gen. Stealing the CC#s would no longer be enough to make a fraudulent transaction.

brazzy• 16 years ago

The CVV2 is not supposed to be stored in any merchant system, that's it's entire point! A merchant who does store it is actually violating their contract with the card issuer.

jedbrown4• 16 years ago

They are also violating the terms of their contract if they make fraudulent transactions on your behalf (to put it mildly). Which is why we're not worried about above-board merchants committing outright fraud, but we are worried possibly internal security holes through which your credentials may leak. The CVV2 is on their hardware while the transaction runs, which makes it vulnerable to unauthorized internal snooping.

I don't know how merchants like Amazon handle fraud, but they don't use CVV2 because they don't bill you until items ship.

adn37• 16 years ago

'Consequences' will never be the same. (bring the down votes, or just enjoy)

andreyf• 16 years ago

Meh. Looks like more trouble that it's worth. With the new(ish) RFID chips, I can "swipe" a credit card without taking it out of my wallet. If I wanted a "secure PIN" feature, I could use my ATM card. Maybe I'll change my mind if my credit card were ever stolen, but until this, this seems like an sounds-good-but-is-actually-useless kind of feature.

melling• 16 years ago

Banks seem to be backing away from the RFID cards. My new card came without one. I called and asked them why and they said they were less secure. Personally, I love the new cards. Unfortunately, NYC cabs and CVS are the only place where you can find the readers.

noelsusman• 16 years ago

> the cards are as versatile as they are secure

I highly doubt that. History has proven to me that there's no such thing as secure when it comes to technology.

hugh33• 16 years ago

They never said that they're perfectly secure, they said that they're as versatile as they are secure. As in "You're as smart as you are handsome".

evilhackerdude• 16 years ago

I like the idea, but I’m putting my money on NFC integration into mobile phones.

Yes, manufacturers and services providers alike have been trying for years. Last time I checked there are huge issues with the security. This site seems to have good information on the topic: http://weblog.cenriqueortiz.com/touch-nfc/

Anyhow, I see much more potential when the ability to transfer money quickly is paired with an all-powerful computer in your pocket.

So we need someone to both figure out a secure process and provide apps/APIs to leverage that. Apple, anyone?

sbierwagen• 16 years ago

This is cool, but it solves the wrong problem.

The two biggest sources of credit card fraud are:

1.) Credit card numbers stolen from merchants with insecure systems.

2.) Credit card stripe information stolen by skimmers installed on legitimate terminals.

To combat these, you either need an entirely new system, (which would require every bank, everywhere, to buy into a new system, and thus will never happen) or something that generates new credit card numbers on the fly.

Hey, that would actually make this workable.

Have your bank generate ten one time use credit card numbers. Upload them to your smart credit card. Each time you swipe it, it uses up a CC#. After ten swipes, it's an inert piece of plastic until you reauthorize it.

henrikschroder4• 16 years ago

I know there are banks here in Sweden where you can get one-time VISA numbers for online purchases. You enter a maximum amount where you guess your purchase will end up, you get a VISA number and expiry date and all that, and it's valid for one purchase. If someone stores that number or tries to use it again, they're shit out of luck because the thing isn't connected to your account, you are not liable in any way.

However, those are only practical for occasional purchases, I'd assume you would run through the numberspace pretty quickly if everyone had that by default on their cards. But it's a neat idea. :-)

qeorge• 16 years ago

Chase offers this, as well as PayPal. In addition, you can generate MasterCard numbers that only work with a specific merchant, but can be used many times.

Your Credit Cards Will Never Be the Same Again: Meet Card 2.0

Related Stories