3
$\begingroup$

Let's take a contactless card for example (one for public transport lets say (i.e. MiCard)), the data is encrypted on the card and encrypted on the reader as far as I know.

So how come somebody who could read those cards couldn't just clone the card, copying all the encrypted data onto another card and go around using that? It's all encrypted on the card anyway, isn't it?

If this is the case, why don't people do it and wouldn't contactless credit/debit cards and many other pieces of encrypted data be the same?

** Not sure if this was the right area to ask, apologies if it's not.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ This is a little out of my area. However, it seems to me that if the entire state of the card is easily readable there is obviously nothing to stop you from copying it to an other card. The only thing to do is to protect the card from being read. You can, for example, do that by physically not allowing people you do not trust to read the card. Some smartcards do it by having special sections of memory that are somehow protected from being read. $\endgroup$ – Guut Boy Jan 27 '15 at 15:06
6
$\begingroup$

Long story short, @GuutBoy is correct. Contactless cards are (in theory, at least), difficult to clone.

Cards with a magnetic stripe are effectively "cloned" by the simple act of reading the magnetic stripe. All of the data on the magnetic stripe is read, verbatim, by a reader. And that magnetic data could be replayed to any third party.

Chip-based cards are not the same; when you read from them, you do not get any of the data on the card. To simplify greatly, you ask the card to authorize you for a charge of a certain monetary value. The card generates a token that authorizes you to charge that amount and hands it to you. You pass this to the card processor. The token cannot be used to perform further charges against the card.

In order to clone the card, it's likely you would have to either take the card for a significant period of time or destroy the card in the process. In either of those cases, at that point you might as well simply steal the card.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ So the card has a microprocessor inside and when you insert the chip into the reader it powers the card which performs those actions? How would this work in a contactless environment? Induction? $\endgroup$ – Jacob Wood Jan 27 '15 at 16:23
  • $\begingroup$ Yes I believe they use induction for contactless. $\endgroup$ – Guut Boy Jan 27 '15 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.