When will Greater Manchester have a Smartcard?

[Joe Paxton]

However TfL have definitely said they will also maintain a conventional PAYG card for those who do not wish to use contactless.

For now. I definitely don't see it lasting. Once travelcards and other products can be associated with contactless I really can't see the system lasting much longer.

I think what will happen is Oyster will become a brand of prepaid (contactless) debit cards with TfL, that potentially you can only use on transport services. Customers won't really notice, but it will save an absolute fortune in maintaining a legacy pretty bespoke system.

If you see rebmcr's post above (#17), that's essentially what the plan is.

It's worth noting that for bank accounts, contactless cards are issued 'subject to status' and not everyone will be able to get one (e.g. those with basic bank accounts from at least some banks). There are some prepaid contactless cards on the market, but these have various usage charges associated with them - and thus far, the prepaid card market - which some in the industry thought would be the next big thing - hasn't really taken off. For many use cases, simply using cash is easier!

Lastly, those on a tight budget may well prefer the option to have a separate pot of money loaded on Oyster for travelling purposes.

In other words, in the future Oyster cards will continue to be available - it's just they are going to switch to a back-office system akin to contactless.

 

[HSTEd]

It would pointless without bus regulation.
And I very much doubt we are going to get that.

 

[radamfi]

It would pointless without bus regulation.
And I very much doubt we are going to get that.

It is on the cards if there is a Labour win in the GM Mayoral election, which is almost guaranteed.

 

[WatcherZero]

This is also incorrect. The hardware encryption key never leaves the chip inside the card -- the payment terminal instead gives the card some numeric token(s) to encrypt/decrypt, and only the result is passed back as proof that the card is legitimate.

This defeats both 'playback attacks' since the payload will be different every transaction, and also prevents any attempts to clone the card without specialist, bulky semiconductor x-ray equipment.

Your thinking of chip cards. The NFC touch ones the reader only has to read the cards number and expiry date then it can charge them sub £30 transactions without bank verification as they are pre authorised, there is no communication required between the bank and the card to match keys as its a mode designed for offline transactions.

Proof on concept done as far back as 2012 and much refined since then.

https://www.theregister.co.uk/2015/07/23/contactless_card_fraud_risk_which/

Pick pockets in London are now going around with card readers surreptiously holding them near peoples wallets.

 

[mrmartin]

If you see rebmcr's post above (#17), that's essentially what the plan is.

It's worth noting that for bank accounts, contactless cards are issued 'subject to status' and not everyone will be able to get one (e.g. those with basic bank accounts from at least some banks). There are some prepaid contactless cards on the market, but these have various usage charges associated with them - and thus far, the prepaid card market - which some in the industry thought would be the next big thing - hasn't really taken off. For many use cases, simply using cash is easier!

Lastly, those on a tight budget may well prefer the option to have a separate pot of money loaded on Oyster for travelling purposes.

In other words, in the future Oyster cards will continue to be available - it's just they are going to switch to a back-office system akin to contactless.

Monzo and Revolut offer contactless cards and don't have any usage charges.

 

[rebmcr]

Your thinking of chip cards. The NFC touch ones the reader only has to read the cards number and expiry date then it can charge them sub £30 transactions without bank verification as they are pre authorised, there is no communication required between the bank and the card to match keys as its a mode designed for offline transactions.

Proof on concept done as far back as 2012 and much refined since then.

https://www.theregister.co.uk/2015/07/23/contactless_card_fraud_risk_which/

Pick pockets in London are now going around with card readers surreptiously holding them near peoples wallets.

No, I'm thinking of contactless. It's still an embedded processor that performs cryptographic work, and it still communicates with the payment terminal, even though it doesn't dial the bank and ask for authorisation.

The only flaw present in the El Reg article is the existence of shoddy merchants accepting incomplete card details -- which in the event of a breach would never fall to the consumer anyway.

There is literally zero difference between the technique described in the article, and someone with a hidden camera near a till where someone pays with a non-contactless card.

No new risks are introduced with contactless over Chip+PIN, since some Tesco self-service tills already skip the bank authorisation check in order to speed up the process.

 

[miami]

Is contactless immunie from man-in-the-middle -- i.e. you set up a reader/transmitter near an unsuspecting wallet, and a paired one near a charging machine. The charging machine says "here, encrypt this: 12345", you send that payload to the wallet machine, transmit into the card, get the response, then send it back.

Clearly you couldn't change the response, but could you remotely charge a card in that way?

 

[rebmcr]

Is contactless immunie from man-in-the-middle -- i.e. you set up a reader/transmitter near an unsuspecting wallet, and a paired one near a charging machine. The charging machine says "here, encrypt this: 12345", you send that payload to the wallet machine, transmit into the card, get the response, then send it back.

Clearly you couldn't change the response, but could you remotely charge a card in that way?

Yes, and the same devices (known as "shim"s) can attack Chip+PIN as well.

 

[miami]

Yes, and the same devices (known as "shim"s) can attack Chip+PIN as well.

Although those would need contact with the chip. I suppose in theory you could point a parabolic antenna at someone's wallet (with just the one contactless card in), and pick-pocket them upto £30 by buying something else at exactly the right time.

Sounds like a fairly minor issue, certainly not one likely to be repeatable, and one which goes away if you have multiple cards in your wallet?

 

[WatcherZero]

Yep a Shim can read the card though needs to make physical contact with all the chips pins.

https://krebsonsecurity.com/wp-content/uploads/2015/08/shimalone-580x591.png

 

[rebmcr]

Sounds like a fairly minor issue, certainly not one likely to be repeatable, and one which goes away if you have multiple cards in your wallet?

Yep..

 

[johnnychips]

I did hear that every now and then, when you used a contactless payment, you would be asked for a PIN, presumably to avoid someone nicking your card and running up a lot of sub-£30 transactions before it was reported.

This has never happened to me, so perhaps they've not introduced this idea.

Does this actually happen and, if it did, could it be a problem on public transport where the readers don't have facilities to enter PINs?

 

[me123]

I did hear that every now and then, when you used a contactless payment, you would be asked for a PIN, presumably to avoid someone nicking your card and running up a lot of sub-£30 transactions before it was reported.

This has never happened to me, so perhaps they've not introduced this idea.

Does this actually happen and, if it did, could it be a problem on public transport where the readers don't have facilities to enter PINs?

I understand that this is indeed the case. I think it only happens with a sizeable number of contactless transactions in a row - as most of us will enter a PIN relatively frequently (for transactions >£30 and in shops without contactless) and verify our identities, I understand that this reduced the likelihood of getting a PIN request.

For public transport and other instances where there is no PIN pad, I would assume that the technology recognises this and won't stop you (unless your card is declined, of course).

 

[rebmcr]

I did hear that every now and then, when you used a contactless payment, you would be asked for a PIN, presumably to avoid someone nicking your card and running up a lot of sub-£30 transactions before it was reported.

This has never happened to me, so perhaps they've not introduced this idea.

Does this actually happen and, if it did, could it be a problem on public transport where the readers don't have facilities to enter PINs?

Yes, there's an upper limit to the total value of contactless transactions between instances of PIN entry transactions.

 

[Bletchleyite]

For public transport and other instances where there is no PIN pad, I would assume that the technology recognises this and won't stop you (unless your card is declined, of course).

I don't entirely know, but I do know that I haven't hit an issue of that kind because I use my card for a mix of transactions, some PIN and some not.

 

[rebmcr]

I don't entirely know, but I do know that I haven't hit an issue of that kind because I use my card for a mix of transactions, some PIN and some not.

I'm not sure either. I do know that LU barriers will reject a card that has not yet had any PIN transaction.

 

[miami]

Yes, there's an upper limit to the total value of contactless transactions between instances of PIN entry transactions.

How does that apply to payments on mobile phones? Or does it rely on the bound card having a pin entry?

 

[rebmcr]

How does that apply to payments on mobile phones? Or does it rely on the bound card having a pin entry?

Apple Pay (and similar) use a separate Device Identifier, not the card number. It's completely independent other than being attached to the same bank account -- this affects being flexible on touching in/out of gatelines.

Since the mobile devices have their own authentication (e.g. Touch ID fingerprinting), some lesser restrictions apply to them.

 

[Stompehh]

I understand that this is indeed the case. I think it only happens with a sizeable number of contactless transactions in a row - as most of us will enter a PIN relatively frequently (for transactions >£30 and in shops without contactless) and verify our identities, I understand that this reduced the likelihood of getting a PIN request.

For public transport and other instances where there is no PIN pad, I would assume that the technology recognises this and won't stop you (unless your card is declined, of course).

This is not an issue on public transport as part of the contactless transit model

 

[me123]

Yes, there's an upper limit to the total value of contactless transactions between instances of PIN entry transactions.

Do you know if it applies to Apple/Android Pay as well? I've never been in a situation where the Apple Pay was rejected, but given that it is more secure than contactless (I need to verify my identity with a PIN/fingerprint and had to go through a verification process prior to use) it would seem reasonable that I could use it without the need to verify my identity using a PIN.