raesene4

I really like this concept, it's great for using sites that you want to buy from but aren't too confident on their security, but it's not exactly new.

I had virtual card number generators in the UK 5+ years ago with cahoot (unfortunately they shut that service down) and you can get this kind of thing with Entropay and similar providers at the moment.

That said the app+management features look pretty nifty, so this could be a nice advancement of the concept.

Possibly although the attack surface of this kind of solution is quite a bit bigger than that of a traditional card. Introducing complications like smartphone apps and increased complexity of programming on the card itself, has quite a bit higher potential for exploitable bugs compared to a traditional Chip & PIN card.

Whilst I wouldn't go as far as to say "never going to happen", I am fairly cynical about this and similar products like coin.

Not for any particular technical reason (although I'd be very interested to hear how they plan to make this work with Chip & PIN) but from a risk/liability perspective.

At the moment most banks that I'm aware of provide an online fraud guarantee and a credit card fraud guarantee, so as long as you keep your credentials secure, they'll pay back if you get defrauded (I know it's not quite as simple as that but for the purposes of this comment I think that'll do)

so the problem with this kind of product is that you're adding another company (plastc) to the trusted list, you're going to have to provide them with all the card details. So unless the banks agree to this not affecting your fraud guarantee, you'd be taking a real risk by using this solution.

For the banks to agree that there would need to be something in the deal for them, to compensate for the loss of branding on their cards and the additional fraud risk.

For me, I don't think that applications like this are targeted at "Joe End User" more at technical people who would like more information about what network connections are happening from their machine.

Personally I've been looking for a little snitch equivalent for Windows for a while now and this one seems like a good starting point.

I think that the problem you might have with IDS/IPS for end user machines is similar to the problems that end users would have with this kind of software. Namely when it blocks/alerts it's very hard to translate the reason for the block (a SNORT rule) into something that's meaningful for a non-technical user.

the alternative is just to silently block, but that leaves the user with a problem whenever there is a false positive (which is a fairly large problem with network IDS/IPS in my experience)

I'm all for caution when it comes to installing software, but it seems in your comment that you're suggesting that this software is actually malicious.

Do you have any evidence of malicious intent/execution from this software, or this just your presumption based on their marketing?