Hacker News Reader

Comment by tjko | Hacker News Reader

I'm actually worried about security here...

I don't know much about magnetic strip card technology, so I'm curious to know whether a malicious user could capture the signal and replay it.

View on HN

Yes, it can

It's still not clear to me how the card data goes to the POS equipment, is it NFC or something else?

Take something like the free the Square magstripe-to-audio converter, record a swipe. Clean it up and/or amplify it, connect the Square reader as headphone output, and blast the recording as loud as necessary to induce the read in a nearby swipe reader. Security-wise, "the magnetic field will generally fall off as the cube of the distance from the magnet".

http://www.instructables.com/id/Read-any-magnetic-strip-card...

http://van.physics.illinois.edu/qa/listing.php?id=419

In the video they mention that they 'broadcast' it, I suspect that means they are actually pushing out a straight magnetic signal which seems to the reader that a card has been swiped.

I don't think it could be NFC, as most merchant readers wouldn't have NFC built in.

It also explains why they need the special case or dongle, it doesn't appear that it can work with just your phone alone.

It's a pretty innovative hack, but on the security issue, if you card is broadcasting it's data, then I assume anybody can pick it up, but they would need to be REALLY close.

They mention in their video or kickstarter site that you have to be within 4" of the mag reader.

That seems to be their secret sauce. It's not NFC as that would not be compatible with existing mag-stripe readers. It has to be some method of emitting magnetic fluctuation.

I'd assume NFC, but I really don't know.

I'm surprised they mention so many people tried and failed... this approach seems fairly intuitive.

This can already be done by anyone with a magstripe or RFID reader

Reply on news.ycombinator.com