Collaborate Disseminate
I want to protect my NFC tag against unauthorized copying.
I understand that EMV is using asymetric cryptography. My focus is on understanding of other standards (NTAG413, MIFARE DESFire) or anything else you could suggest t… Continue reading Which NFC standard prevents NFC tags from unauthorized copying?
In Mag stripe transactions, I’ve worked on solutions by which you get an initial small value Authorization and then can capture a full amount later using the transaction_id. E.g. The payment gateways in restaurants.
With the… Continue reading EMV Transactions vs Magnetic Stripe
Is it possible to change the authentication from SDA to CDA in the pre-personalized chip card? if so, how?
Continue reading moving from Static to Combined Data Authentication [on hold]
We use EMV card readers to automate the payments at the entry and exit to our services. These card readers and the unattended payment terminals are fully PTS complaint and use P2PE encryption. Also, implemented by PCI-DSS com… Continue reading PCI-DSS scope: Using P2PE Compliant devices
The Open Authentication HOTP algorithm is considered very reliable when using a 160 bits long secret key. Suppose I have this idea to generate such a 160 bits long key without requiring any further secret key distribution eff… Continue reading EMV card secret key + PIN to generate HOTP key
Issuers of EMV card (or their specialised service providers) always securely store on their server (Hardware Security Modules) a copy of the secret keys which are hidden inside each individual EMV smart chip.
However, do they… Continue reading EMV cards, is the PIN always stored also at the issuer secure server side?
I am interested in opinions about effective tools of the trade for developers needing to familiarize themselves, through hardware hands-on experience, with the internal details of a EMV smart card security features.
In my vie… Continue reading EMV card tools of the trade
It is my understanding that in the US 100% of EMV transactions (contact and contactless) are expected to be performed online. If so, why would a payment gateway be requiring a US terminal to support offline PIN (if online is… Continue reading Are EMV terminals required to support offline PIN as well as online PIN in US market?
Lets consider that someone skimmed the magnetic stripe of a credit/debit card which also has an emv chip.
Can this info be translated and stored into an emv chip?
And if this is possible, it is supposed that the information… Continue reading Can someone clone emv chip card by knowing the magnetic stripe info?
This is your Shared Security Weekly Blaze for November 19th 2018 with your host, Tom Eston. In this week’s episode: USPS Informed delivery vulnerabilities, protecting yourself from credit card fraud and a huge SMS database leak. Silent Pocket is … Continue reading USPS Informed Delivery Vulnerabilities, Holiday Credit Card Fraud, Huge SMS Database Leak – WB43