Is doing credit card transaction via 3G secure?

Question

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is Android Market/Google Checkout transaction. How do I know if it protect my data?

Answer 1

The security of a the air interface on a 3G connection is significantly different to that on a 2G connection. The main advances in 3G over 2G is the higher data rate and the security features. But much of the security depends on the Mobile Operator issuing the customer with a USIM rather than a 2G SIM.

If you have a USIM in a 3G phone connected to a 3G network, then the phone will perform the Authentication and Key Agreement (AKA) protocol that verifies the network as well as the SIM.

When using a 2G network or using a 3G network with a 2G SIM then the authentication falls back to the old 2G process, this verifies the SIM but does not verify the network. This means that these connections are vulnerable to a False Basestation Attack, where an attacker can pretend to be the network to the phone and thus intercept all the data traffic.

When using a 2G network, then the data will most often be encrypted using the GEA1 or GEA2 algorithms, this is similar to the A5/1 and A5/2 algorithms that has been compromised. But at the moment tools to compromise GEA1 have not been made public, whereas tools to compromise A5/1 are available. There is the newer A5/3 and GEA3 algorithms using KASUMI for encryption instead, but note that these still uses KASUMI with 64-bit keys (3G variants uses 128-bit keys which are much stronger).

The GSM air interface was designed to offer equivalent security to a wired connection, and the connection will be carried over wired networks. The security of the data being carried should be treated with the same level of protection as for a wired connection. This means use of https (TLS) should be used for any sensitive data.

There are some extra considerations though.

• The limited screen space available on mobiles devices may be an issue in displaying security icons to the user.
• The portable nature of a mobile device increases the risk of loss of the device and this loss of data locally stored.

Answer 2

If I am correct, normally you use an SSL connection when doing money transfers. SSL encrypts the data before you send it over the network. In this way, even if your connection is being eavesdropped upon, they will not be able to see anything.

It does a lot more than only encrypting, also authentication and message integrity is provided.

To learn more : http://en.wikipedia.org/wiki/Transport_Layer_Security

My point is that with this layer you shouldn't be worrying about your connection.