Contactless payment jackets

[peterb]

I guess it what works for you then . Personally, trailing 5 miles to my nearest bank twice a month to pay bills and get cash is a waste of my time when I could be doing something more productive/rewarding, so I make as much use as I can of automatic payment systems. My outgoings are regular, so scanning a statement once a month takes a few seconds at most, and on the two occasions in the last 10 years where there has been an error, it has been corrected immediately and without fuss.

I'd agree about London, sadly I have to go there occasionally (bizarrely it is almost as fast to do the 80 odd miles to London by train as it does to get to the centre of Southampton, about 10 miles away so car and car parking is quicker' but not cheaper).

But I rarely have more than !20 in cash on me, and carrying more than £60 makes me feel vulnerable and uncomfortable, to the extent that when I go abroad, I prefer to take a debit card and get currency abroad (or use a credit card) and accept the extra costs as payment for the greater sense of security (real or imagined) and depending on where I am going, I'd rather leave a card in a hotel safe than a wedge of cash.

But to get back on topic, I think I'd agree in principle with top_gun that the contactless jacket is a waste of time, fraught with security issues and a fine example of pointless 'wearable technology'. A bit like android/apple watches, just because you can doesn't mean you should!

[Saracen]

If it's a 5 mile trek just to get to your bank, that's inconvenient. Mine are both within about 100 yards of my regular supermarket, which is a 15 minute walk, or 5 minute car trip. As for automatic payments, I find them very inconvenient because my income is irregular, which means keeping a constant and close eye on bank balance to avoid unintentional overdrafts. So I've whittled down DD and SO payments to, well, zero. Now, money only goes out of my account if I manually do it.

As foe the jacket, given my view on contactless payment, I guess my reaction to the jacket is predictable.

[DanceswithUnix]

Thirdly, leaves you wide open to fraudsters who are able to clone your payment details from a distance and make fraudulent transactions.

That bit really isn't a problem.

If you perform a contactless transaction, then it is possible for someone to evesdrop the conversation from some distance, but all the interesting stuff should be encrypted so you can't learn much.

If you want to participate/start a conversation you need to be much closer or use a massive (if not mahoosive) antenna to get enough energy to fire up the card.


Now, there is another aspect though, these cards can also do traditional chip & pin.

When CnP first came out, the smartcards issued by the banks were pretty cheap. Cheap doesn't buy much in the way of encryption, so the communications between the pinpad and the smartcard are generally negotiated as in the clear. No encryption at all, nada, and your PIN is sent on that link. Now usually that isn't a problem as this communication is happening inside the pinpad where both the pinpad processor and the card are trustworthy secure areas, but the few attacks on pinpads that I have heard of involve inserting some sort of listening device into the pinpad by deception, threat or whatever, and then siphoning off the details that get collected. That gets you enough data to make a magnetic card that can be used in an ATM in many countries and you have the PIN as part of the data capture.

My worry with demanding a non contactless card is that they will give you an old card, and like so many things in computing personally I want the latest bang up to date version with all the latest countermeasures implemented and the longest RSA keys possible. I would expect a card capable of contactless to be capable of better encryption generally, so would hope it no longer talks in the clear.

[peterb]

Yes, my concern is with the physical security of a contact jacket, rather than the electronic security aspects.

Saracens post has just reminded me that there is a cashpoint at my local supermarket (shows how often I use it! ) so getting cash not quite such a faff, but for me, card and automatic payments are a plus, but I can see why for some, cash might be a preferred option.

[jas88]

If it's a 5 mile trek just to get to your bank, that's inconvenient. Mine are both within about 100 yards of my regular supermarket, which is a 15 minute walk, or 5 minute car trip. As for automatic payments, I find them very inconvenient because my income is irregular, which means keeping a constant and close eye on bank balance to avoid unintentional overdrafts. So I've whittled down DD and SO payments to, well, zero. Now, money only goes out of my account if I manually do it.

As foe the jacket, given my view on contactless payment, I guess my reaction to the jacket is predictable.

Of course, you can also use the supermarket itself for obtaining cash from your debit card. They rather like this, because when you withdraw £50 that way, you're effectively depositing the cash the last customer gave them into their bank account immediately, without the need to pay someone to transport and deposit it for them! A neat arrangement all round, really. (Albeit one I never use - I'd rather get the 1% money back by paying on credit card, then use a cash machine.)

A jacket with a special-purpose bank card pocket seems a bit over-specialised to me, though: does it have a special pocket for your house key, another for your mobile, one for your wallet ...?

I must admit, though, my inner geek is actually rather looking forward to paying for something with Apple Pay for the first time. Just the "new and shiny" factor I suppose, but fishing cards out of my wallet then putting them away again is always a bit of a hassle at the counter, compared to just tapping my phone on a sensor then pocketing it again. Half the time, I end up sticking the card in my pocket loose, then having to get it out and file it properly in my wallet later; no need for that here.

[Saracen]

....

Saracens post has just reminded me that there is a cashpoint at my local supermarket ....

Don't get me started on ATMs. ....sorry, too late.

Put it this way. I haven't put a card in an ATM for .... erm .... many, many years. It may or may not have anything to do with having written some of the software for them, and some other forms of cash dispenser hardware, earlier in my career. It could just be a complete coincidence that my reluctance stems from, well, about that time. I think I shall, in the immortal words of a certain Python, "nudge, nudge, wink, wink, say no more".

Of course, you can also use the supermarket itself for obtaining cash from your debit card. They rather like this, because when you withdraw £50 that way, you're effectively depositing the cash the last customer gave them into their bank account immediately, without the need to pay someone to transport and deposit it for them! A neat arrangement all round, really. (Albeit one I never use - I'd rather get the 1% money back by paying on credit card, then use a cash machine).

...

I could, yes. I don't, though.

This is for privacy reasons. First, doing so tells the bank where I shop. Using cash doesn't. Secondly, and more much importantly, using my debit card in the supermarket gives the supermarket a unique ID key with which, should they wish, they can start building a data profile that includes my shopping habits.

I can't keep all data about my life out of corporate hands, but I can keep a lot out, and that's a VERY important part of it. I never, ever use cards in supermarkets, not even debit cards. Cash, 100% of the time.

[ik9000]

wink wink say no more?

I don't think it's quite wink wink anymore. Did you not see this? http://www.theguardian.com/technolog...e-atm-montreal Tip of the iceberg my friend. Wink wink nudge nudge

Or to be blunt. The manual that let them do it was available unencrypted online. http://o.canada.com/news/bmo-atm-winnipeg-460526

[peterb]

Don't get me started on ATMs. ....sorry, too late.

Put it this way. I haven't put a card in an ATM for .... erm .... many, many years. It may or may not have anything to do with having written some of the software for them, and some other forms of cash dispenser hardware, earlier in my career. It could just be a complete coincidence that my reluctance stems from, well, about that time. I think I shall, in the immortal words of a certain Python, "nudge, nudge, wink, wink, say no more"

The only bad (good experience I had with an ATM is when I withdrew £20 and received £30. I did go into the branch to tell them, the reply was "just keep it". I guess more trouble than it was worth to reconcile it.

Maintain privacy is all very well, but I wonder when the fact that going to so much attention to maintain privacy in itself starts attracting attention on the lines of "what has he got to hide?"

[ik9000]

Maintain privacy is all very well, but I wonder when the fact that going to so much attention to maintain privacy in itself starts attracting attention on the lines of "what has he got to hide?"

You don't think, it couldn't be could it? Is Saracen really Lord Lucan?

[Top_gun]

That bit really isn't a problem.

Not a huge problem but encryption has been cracked before.

https://www.schneier.com/blog/archiv...rfid_tran.html

http://www.theguardian.com/technolog...me.oystercards

I must admit, I've not looked into the size of equipment which can scanned cards from a distance and nor do I have any interest to do so.

Still, all my cards are kept in an aluminium case for convenience as well as security. It helps to prevent 'card clash' at Oyster card reader terminals. I have yet to experience a fraud problem with contactless cards since using them in the last 10/12 years.

[Saracen]

....

Maintain privacy is all very well, but I wonder when the fact that going to so much attention to maintain privacy in itself starts attracting attention on the lines of "what has he got to hide?"

Well .... true.

But who is wondering?

If it's the authorities ..... I'll come back to that. If it's corporate interests, none of their bleeping business what, if anything, I have to hide.

Back to the authorities .... I have no criminal/court records, not so much as a speeding fine. Ever. Being self-employed, and VAT-registered, and formerly a company director, HMRC are well-aware of many details of my life. One member of my immediate family was a policy officer, another was until recently FBI with clearance for NCIC in West Virginia, and yet another was .... senior at an organisation that barely acknowledges it's existence and certainly not that anyone specific does or has worked for it. Yet another, now deceased, was a member of the judiciary, and I've been on the receiving end of invitations to Downing Street meetings and the occasional dinner, albeit not for quite a while. Both sides of the family have been vetted, more than once, and the occasional expectation of a knock on the door from both FBI and special branch has been present for some decades. They'll even get a cuppa and biscuits, along with answers to questions, and are welcome to have a look round.

I can't say I have anything much to hide that the 'authorities' aren't aware of, and if they want more detail, they only have to ask. It's not them I'm being private from.

Corporations, on the other hand, can go bleep themselves. They only want info on us all so they can sell us stuff, and I don't want marketing phone calls, visits, emails, letters, texts, personalised ads, etc, from ANY company, under any conditions, unless I've specifically and explicitly asked for it. And even then, ONLY what I specifically asked for.

I know it sounds paranoid, and we joke about it, but it's not that. Honestly. It's that I got fed up with being pestered, in all ways and at all sorts of hours, by people trying to sell me stuff, quite a few years ago. And the aggressiveness of data collectors, and traders, has grown exponentionally in scope, scale and detail, over the last 20 years or so. So, a long time ago, I adopted an aggressively privacy-aware stance by which, on principle, I give NO corporate a single byte of personal data that I can avoid unless there's a reason that makes it sufficiently in MY interests to do so.

It is, if you like, an uncompromising policy stance on my part. I assume there's a good chance ANY data I give companies will end up getting used in ways I actively object to, so I tell them NOTHING that I can realistically (and legally) avoid telling them. And if I have to give information and it can be misleading without being fraudulent, I will do so. If I can't avoid being forced to attend these corporate data vampires info-gathering soirees, I will at least attempt to take a dump in their soup.

[ik9000]

If I can't avoid being forced to attend these corporate data vampires info-gathering soirees, I will at least attempt to take a dump in their soup.

Now there's an image to leave us with! Ever the wordsmith Saracen. I'm just about to have soup and rolls. Thanks for that...

[Saracen]

I assume you're not a corporate data vampire ....?

Your soup should therefore be safe from .... non-recipe ingredients.

Your mental images, not so much. Sorry about that.

[ik9000]

I assume you're not a corporate data vampire ....?

Your soup should therefore be safe from .... non-recipe ingredients.

Your mental images, not so much. Sorry about that.

One man, one bowl...

[TooNice]

I am not really against contact-less payments. It is something possible with the equivalent of Oyster cards in Japan, Hong Kong and many other places. But I don't see the point of having a street jacket designed for it. Is it really that much less work than reaching for one's wallet?

My snow-sport jacket does have a little pocket in the sleeve, and it is a good place to put your electronic ski pass tag. The key difference being that on a ski slope, it is difficult to open zips etc. with thick gloves on, so accessible contact-less make a lot of sense.

[Gerrard]

I am not really against contact-less payments. It is something possible with the equivalent of Oyster cards in Japan, Hong Kong and many other places. But I don't see the point of having a street jacket designed for it. Is it really that much less work than reaching for one's wallet?

Reminds me of when I was in Japan a few years ago and the first time I realised I didn't need to take the Pasmu(?) card out of the wallet to use at the gates and that you could just swipe the whole wallet over it. Unfortunately I had a tape wallet at the time, and the first time I did it I sprayed the floor with all my loose change! I think using this jacket for an Oyster card would actually work quite well and would be the only situation I would use it in. But as I very rarely go to London (and usually forget to take my Oyster card with me when I do!), I think I'll pass.

When I was in Las Vegas for business a couple of years ago, I tried to pay the cab fare to the airport with my company's credit card that had contactless payment but wasn't cleared to use. Unfortunately, every time I went to swipe the card, the machine would try a contactless payment instead and fail and I had to use cash in the end. That is the closest I have come to using contactless payment for my cards, mainly because I don't use them for small transactions.