Hacker News Reader

Comment by jrockway | Hacker News Reader

It's my understanding that the CVV3 is cryptographically generated for each transaction (like HOTP), and that the cardholder's name is not available over NFC. So you can't steal personal information or use the card undetected.

A bit of reading regarding the CVV3: http://randomoracle.wordpress.com/2012/09/11/cvv3-demystifyi...

I'm not 100% sure about the name not being there, however.

View on HN

When someone at my office spotted this story earlier in the day, a bunch of us quickly ran around playing with an android app (which doesn't have permissions to phone home and censors out some of the data) to see what info we could pull off our cards.

https://play.google.com/store/apps/details?id=com.samj.CardT...

Name, number, and expiry are readily available. We figured you could probably replay that data to get some free gas with stolen credentials... but the scanning range with phones is more akin to "hold the card up against it for several seconds to read" than "walk through a crowded room".

That is probably a moderately-variable function of the power output and sensitivity/gain of the radio in the phone (and card) used. (A crowded subway in Japan would probably be ideal conditions. :p) Other phones may have noticeably better range, or range might be increased by simply going out of spec using lower level RF controls (if lower level access is possible per-controller, since as I don't see anything about power control in the Android docs).

http://android.stackexchange.com/questions/5044/nfc-function... https://developer.android.com/guide/topics/connectivity/nfc/...

A high-gain antenna at the NFC frequency (13.56MHz) would be about 11 meters wide and 6 meters long. This is probably why there isn't much long-distance NFC skimming going on.

(If you're an ARRL member, there's a good article on building a 14MHz directional antenna at http://www.arrl.org/files/file/protected/Group/Members/Techn.... It's big, and one resonant at 13.56MHz would be a little bit bigger. But it is something that's physically possible and would make for an interesting experiment.)

Edit: Here's another idea (and the article is free): http://www.arrl.org/files/file/protected/Group/Members/Techn...

Easily concealable in a floor or wall. :) (I jest.)

https://docs.google.com/viewer?embedded=true&url=http://...

On p 27, there is reference to merchants not needing to support CVV3. (The good stuff starts on p 20.)

He's talking about merchants that don't ask for any CVV, just a card number, zip code, and expiry. I've certainly successfully bought stuff with only that information, but it's not exactly common. (And I'm guessing when you call up to dispute a charge, the lack of a CVV makes it easier.)

Wouldn't a one-time code still allow the attacker to make one transaction later on?

Perhaps the solution is to require a button to be pressed or a switch to be flipped on the card before or during the scan. Although this would make using it slightly more inconvenient since you would need to open your wallet to push the button or flip the switch.

Reply on news.ycombinator.com