The Universal Card 358
retro128 writes "Wired News is carrying a story about a new product from Chameleon Network that's supposed to replace all of your credit/debit/customer cards. It can read the information off of the magnetic strips of credit/debit cards, scan the barcode off of customer loyalty cards, and even memorize the RFID signals of devices like the Mobil SpeedPass. All of this information is stored in a device called the Pocket Vault, and is unlocked with the user's fingerprint. If you wish to use a magnetic strip card, you select the card from the touch screen and put a Chameleon card, which looks like and can be run in standard readers like a credit card, in the Pocket Vault. The Chameleon card will then assume the identity of the card you selected, but only for 10 minutes. In this way, if the card is lost or stolen, nobody can use it. In the case of RFID, you just hold the Pocket Vault up to the RFID scanner for a reading. For barcode-based cards, the barcode will appear on the screen and can be scanned by a standard barcode reader. Chameleon Network says this technology will be available in early 2005 and is expected to cost under $200."
You want me to pay for that? (Score:5, Insightful)
How about YOU pay ME.
My vote: the current system (Score:5, Insightful)
Warning: Vaporware Company Detected (Score:5, Insightful)
I fear that Slashdot's logo is now going to get added to their brag-about-press-coverage page [chameleonnetwork.com]. For the record, the "Boston's WB in the Morning" program they brag about was canceled in 2002.
I'm not suggesting that this company's technology doesn't exist, but their product is pure vaporware [chameleonnetwork.com] and they have lists of good reasons why a merchant, bank, or large company should partner with them, but they can't name any merchant, bank, or large companies who have agreed to partner with them. At least they have a patent appilcation pending [chameleonnetwork.com].
Great idea....for thieves! (Score:5, Insightful)
potentially inconvenient (Score:3, Insightful)
A card is more than just a magnetic strip... (Score:5, Insightful)
Accepting non-original cards opens up the risk of accepting any card with a magnetic stripe as being a stand-in for the real credit card. It would effectively turn all in-person credit card transaction to being as insecure as a web transaction. There's a reason why web merchants have to pay more for their credit card services, and it's that insecurity.
So, it's near certian that Visa and Mastercard accepting stores will be ordered by the card networks not to accept Chameleon Cards from customers. Game over for this technology... it works in the lab but won't work in the real world.
completely compatible? (Score:3, Insightful)
or verify a signature?
not too good..
give up one digit or four? (Score:5, Insightful)
I don't know about you, but I'd much rather have it use a password. I think most people would happily give a sufficiently threatening criminal their 4 digit PIN number (or any style of password) without too much of a fuss, but I'd rather avoid giving anyone any incentive whatsoever to leave me short one digit. It would be a very small consolation to cancel my credit cards after such an incident.
Been done (errr, thought of) (Score:4, Insightful)
This just in, new tool for ID Theft just released! (Score:5, Insightful)
Tm
Credit cards are free, why pay $200? (Score:5, Insightful)
1) Cumbersome
2) Breakable
3) All eggs in one basket
4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?
5) What do you do when the batteries run out
6) What happens when the OS crashes and the information is wiped out?
So many reasons...
OMG you are a genious. (Score:5, Insightful)
The only thing that could be done to prevent this is to make it hold only a small number of each type of card. Like only 10 Credit Cards. Still, its pretty much simplyfies the "printing" of stolen cards.
OTOH, i wonder if this will ever work. CC companies must back this up to work, i mean try taking the mag strip off your AmEx (or visa, or
If it goes by fingerprint... (Score:2, Insightful)
Re:Did you read the parent post? (Score:5, Insightful)
Making him decode the cards would be akin to making him testify against himself, hence making it unadmissible in court.
Plus he could always claim (farfetched, yes, but possible) that it was all some kind of equipment glitch or Chamaleon card mixup in a bar or something along these lines
Re:A card is more than just a magnetic strip... (Score:2, Insightful)
If nothing else, credit cards are remarkably resiliant to damage.
And the difference is... (Score:3, Insightful)
Right...
Start simple -- digital cash (Score:5, Insightful)
By being anonymous, my privacy would be protected (at least in theory). It would also be completely unconnected to my credit cards and bank accounts, so it could never be used to steal more than $100 from me.
This is not a trivial problem -- it has some of the same problems as voting (anonymity & non-repudiation).
I think this is already being done in Europe. If only the US would catch up.
Re:Credit cards are free, why pay $200? (Score:3, Insightful)
Picture shows that it fits in a wallet
2) Breakable
You can always use your real credit cards. What if a palm pilot breaks? You write things down on paper. . .
3) All eggs in one basket
Agree with this.. would rather not have everything linked in one breakable / trackable / hackable system.
4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?
You spill pasta sauce on your sweater, you buy a new one and are much more careful if it is expensive.
5) What do you do when the batteries run out
Considering the plethora or small handheld devices out there, why is this one so much harder to track charge for?
6) What happens when the OS crashes and the information is wiped out?
Well, you reload the data from either the credit cards again or the backup that was made
and even memorize RFID signals of SpeedPass (Score:4, Insightful)
Hey, slick, it can memorize a SpeedPass code. Gee, what could posiably go wrong with this?
Now we gotta wrap our speed pass in tin foil too!
Re:Warning: Vaporware Company Detected (Score:5, Insightful)
Database Backup (Score:1, Insightful)
Then there's the security for their online database, which just screams "hack me!"....
Re:Credit cards are free, why pay $200? (Score:5, Insightful)
Picture shows that it fits in a wallet
Picture is clearly photoshopped. The real consumer product has yet to ship.
2) Breakable
You can always use your real credit cards. What if a palm pilot breaks? You write things down on paper. . .
That's nice, but you're still out the $200 device.
3) All eggs in one basket
Agree with this.. would rather not have everything linked in one breakable / trackable / hackable system.
Good, so there's no risk of you wasting $200 on this.
4) A lost/stolen card is replaced by the credit card company. Who replaces that lost/stolen $200 computer?
You spill pasta sauce on your sweater, you buy a new one and are much more careful if it is expensive.
My solution is to not wear $200 shirts very often, and definitely not to eat pasta while doing so. A $200 device had better be durable if it's going to live in my pocket.
5) What do you do when the batteries run out
Considering the plethora or small handheld devices out there, why is this one so much harder to track charge for?
Because having my MP3 player stop playing music isn't as embarassing as not being able to buy what I just took to the checkout.
6) What happens when the OS crashes and the information is wiped out?
Well, you reload the data from either the credit cards again or the backup that was made
You're most likely to discover such a failure while shopping... again, the embarassment situation.
Re:Yes but what about bluetooth? (Score:2, Insightful)
all your cards are belonging to others..
1) Steal/borrow wallet
2) Copy cards
3) ???
4) profit
but im sure theres a way to stop it reading
in someone else credit card details..
Re:A card is more than just a magnetic strip... (Score:3, Insightful)
Re:Warning: Vaporware Company Detected (Score:3, Insightful)
Meanwhile, I've got a bunch of Swatch Access watches with contactless smartcards built-in. Why can't we upgrade to something like this instead?
This will never fly (Score:5, Insightful)
- Lose this trinket, and you just gave *every damn card/id thingy ya had* to a thief. Yeah yeah its fingerprint keyed. So what? The data is inside and everything is ultimately hackable.
- It can obiviously be used to swipe magnetic strip data off other people's cards you may be able to handle. As a bonus if it can 'dupe' smartcards, Visa & co wont be happy - they just spent gazillions in moving every (insecure) magnetic card to ones with chip inside. I think their timetable is something like by end of 2005 every Visa card is a smartcard. I'd expect credit card companies to sue the pants off this company for unauthorized reverse engineering of their security features against duplication in the cards. DMCA will be used to pwn these guys. (And if it does *not* dupe smartcards, it will be useless in couple of years when every card becomes one)
- Big credit card companies will just tell to the retailers not to accept anything except Genunie Visa(r) Card(tm)
- Huge hassles with most clerks refusing the cards 'swiped on' with this trinket even without guidance from credit card companies - "that's not a visa card, are you trying to fool me with some thieves tool with copied card data?". The education required to train every damn minimum wage clerk in the world to identify and accept this thingy in place of a real card would be astronomical - EVEN if the card companies would go along with it.
Dot.com boom coming back? This company is beyond loony to even attempt to develop something this stupid.
Re:Use fake telephone numbers (Score:3, Insightful)
So Linus, RMS, that ESR guy... they're all dumbasses then?
There's a difference between concealing your identiity and making sure that your private data stays that way.
Re:Seriously. (Score:5, Insightful)
But that's the complete opposite of the truth. It needs the fingerprint of whoever owns the vault, not whoever owns the original credit card. This scheme simply means that if I DO get access to your credit card briefly that I may also have a cheap consumer device, that I don't need to be coy about using, that allows me to easily copy your card. Instead of walking round with a pocket full of stolen cards I have a single vault that nobody else can access.
Any "security" features of the original card are rendered irrelevant because of course I do have a completely valid chameleon card.
Signature confirmation goes completely out because either there is no signature on the chameleon card or, again, it's the signature of whoever owns the chameleon card not whoever owns the original.
To try to spin this as giving added security to owners of genuine cards is absurd.
Re:Did you read the parent post? (Score:2, Insightful)
Furthermore, even assuming you had some wierd judge who bought that claim, do you honestly think the company that makes these gadgets wouldn't have some back-door into their own system that would allow them to retrieve information if necessary?
And, odds are, they'd want to help the cops because any continued risk on stolen cards makes their little gizmo look bad.
Kierthos
Free? (Score:5, Insightful)
Free? Free to who? There are no such thing as "free" government services. They cost tax $. My tax $. Maybe I don't want to pay for your personal convenience. Maybe the guy next door doesn't care to pay for it either.
Re:Seriously. (Score:5, Insightful)
This is the real problem. These guys sound like they have done a great job of protecting the consumer. In the process they have completely ignored the fact that they have created a method of forging credit cards that requires no expertise or special tools.
I think it will not be very long before the card associations tell their merchants that they must not accept these cards.
Re:This will never fly (Score:3, Insightful)
Not to mention - here in europe mobile phones/SIM cards are rapidly trying to wrestle themselves into this position. At first they'll be used as coin replacements - you can already buy soda from a vending machine or a bus ticket using a phone in Finland. Next step is to allow you to pay your purchases using a phone in stores. Naturally this bit has much more resistance from the established credit/debit card companies as phone operators are dreaming of taking the cake from Visa and other heavyweights. I'd guess than when the dust settles, there will be something like 'MobileVISA' - basically allowing you to pay using your mobile phone and the purchase showing up in your credit card bill, with the phone operator getting teeny cut out of the action for providing the authentication and linking to the customer's credit card data. Yes, there are naturally security issues - mobile handset theft would become a lot more lucrative if you could pay with one - but give 'em time... sooner or later you have one thingy that you always carry around that functions as a phone and an 'electronic wallet'.
So what's the reason to have this trinket then? There isn't one...
This is bad and misunderstands cc theft (Score:3, Insightful)
A week or two later they make a fake card with your magnetic stripe and usually go on a 5000 dollar (the usual single day limit on most cards) spending spree and then fence the goods. The consumer discovers 5000 dollars on his card, usually from stuff purchased when he was in another state, at work, on the international space station, etc and calls the bank up. They issue a new card and reimburse the money.
This happened to me, and not ONCE did my card leave my wallet.
The only real solution to credit card thievery is to have intelligent software that tracks the spending habits of the legitimate user and requires extra verification before allowing out-of-the-ordinary purchases. Like if someone normally buys nothing but gas and groceriers with a credit card and suddenly buys 3000 dollars worth of stereo equipment 200 miles from where they live.... red flag!
Re:Yes but what about bluetooth? (Score:5, Insightful)
Yeah, that's the obvious problem. Who's to say that the information in the card database is for your credit card? Couldn't it be anyone's credit card?
Credit card companies have taken steps to link the physical card to the bearer - putting your photo on the credit card, printing on the card that merchants should request ID confirmation, etc. This completely sidesteps those mechanisms.
In short,this is the perfect tool for credit card theft. Work at a diner for a month, and scan every customer's credit card into your Chameleon. You can then take a great free vacation to another state and pay for every expense on a different credit card.
It took me about 14 seconds to realize this. And yet, some company spent $beeleeons developing it - probably relying on the old "we can paper over the problem with marketing hype" tactic/fallacy. Any chance the Chameleon is made by Diebold?
- David Stein
Re:Yes but what about bluetooth? (Score:5, Insightful)
The average person (i.e. almost everyone) has precisely zero reason to carry someone else's credit card (and if they had them, many stores wouldn't accept one that wasn't yours since they're not supposed to do so). This device may simply make the valid assumption that all of your cards should have the same name (which is stored magnetically in the card, if I'm not mistaken).
This would, at least, prevent stealing more than one person's card.
Small Problem (Score:4, Insightful)
"Jonnie Public"
"Johnathan Public"
"J. Q. Public"
"Johnathan Quincy Public"
Re:Yes but what about bluetooth? (Score:4, Insightful)
But everyone has to trust the device to enforce that restriction. A hack for this device, or a copycat device, would exploit that trust quite easily.
- David Stein
Re:Gimmie your wallet! (Score:3, Insightful)
I see the parent is modded as "funny," but this is actually a realistic threat. If someone steals my current batch of credit cards, all they need to do is forge my signature, or maybe not even that. No real inducement to harm me, and actually an inducement to keep me from even knowing a theft took place. Now there's a bonus for taking my thumb.
My suggestion: use your little finger. Then either you'll be able to convince them that they should take the less valuable digit, or if they're real Dr. Doom types, they'll mistrust you enough to just take both entire hands. D'oh!
Secondary suggestion: use a toe. This will also put a lid on those impulse buys that have been blowing your budget, since it takes more effort to take off your shoe during a purchase....
Re:Size DOES matter! (Score:3, Insightful)
Why? Because I have thought of designing something like this for myself in the past. Even though I no longer carry half my cards anymore (BiMart, et all), I somehow still manage to have WAY too many... Obviously, i could not replace my drivers license (no Mr. Officer, really, this is valid)... looking through my wallet while replying to this, I found 12 cards that I could easily get rid of. Wierd thing is, I thought there would be more, but 1/2 my cards wouldn't work with this (I think), like Social Security Card, OMMP, etc -- because there is no barcode/smartChip/magStripe/RFID on them. IF it was able to simply show me the front and back of any of my cards, like a jpg or something, then I could easily double the number I could get rid of. Of course, at that point, it would probably be really useful for all those damned business cards that manage to get into my wallet too.
Malachi
May not be as insecure as you think (Score:2, Insightful)
I have no proof or way of knowing if this is what Chameleon does, but if they're smart, they've done something along these lines:
If someone stole your chameleon card, they wouldn't be able to use it without your fingerprint.
I assume Chameleon wouldn't let just anyone load any Chameleon card into their pocket vault. I'm sure they assign a single card to each pocket vault/user, and it won't accept cards that do not match the pocket vault's number.
So if someone stole your card (account #001) and tried to put it in their pocket vault (account #002), it would deny it because the card isn't account #002.
If someone stole your credit card and scanned it into their pocket vault, again I assume each pocket vault would have one user assigned and if it didn't match, it wouldn't accept. For those of you who say "What if a wife wants to use husband's card and vice-versa?", Chameleon probably lets you assign both the wife and the husband's name, so she can use his cards and he can use her cards.