Hacker News Reader

Comment by revelation | Hacker News Reader

So that's why this video was so confusing to me. It was essentially this guy sliding someones card (he claims it's his, but neither the device nor the card know, right?) and then happily paying stuff with it through his fake replica (or the high-tech version of it, the 'coin').

It seemed like a completely unusable system for it's complete lack of any security.

(Particularly if you consider there are now live payment systems that use pretty much the same audio jack serial port hack as this one does to clone cards)

View on HN

What really concerns me is that these Coin people are now selling, for a trivial fee, a system for other people to clone my card. If I lived in the US where mag stripes were the norm, I would be seriously concerned about this.

Thankfully, in Canada, everything is done via chips, so even with Visa purchases my card never leaves my hand (or at least, my sight). Restaurants bring the terminal to your table, they process everyone there, and then you're done. Sending your card away feels almost archaic now (and a bit patrician, which has its appeal).

Theoretically, the creators of coin can implement some sort of security in these sorts of situations:

1) They require you to register this "coin" device 2) They require you to add some banking account details

Now, if you were to "clone" someone else's card without their permission, the trail would lead directly to you...

so, you think they'll accept liability for fraud?

I don't think so, there's also no way for anyone to trace the transaction back to them

I don't know if they will accept liability, but they can try to prevent it as much as possible within their ecosystem.

I would assume it would be like any other credit card transaction: up to the merchant to verify the account holder with an ID.

The fraud you're speaking of is not limited to this technology; anyone could find and use a credit card they found on the ground if the merchant did not verify it.

That brings up an off-topic point I've always wondered about. If apple will not make it possible for third party devices to interface with the iPhone through the normal port, why do approve apps that rely on hardware using the audio jack this way?

I've seen credit card readers that act as a hull for an ipod touch and connect to the data port. (Necessary in austria because the audio trick wont work with chips)

But they _do_ allow that. You have to pay a license fee to Apple for the connectors, programming interface etc, but even without that you can do communication using one of the established protocols like MIDI. Also, you could use Bluetooth 4.0 without any licensing at all. So the question to why they allow it is that they're not consistently evil :)

Reply on news.ycombinator.com