0

I was recently reading about automotive fare collection systems and came across loyalty card systems. In these systems, if I understood correctly, each passenger has a card in which a value, not money, is stored. Whenever the passenger uses his card a reader decreases the stored value in the card, and the system administrator rewards the passenger according to his policy.
I was wondering if each of those devices that participate in the AFC, readers/cards etc, must conform to specific security standards and I do not mean the crypto algorithms.
To be more specific, I would like to know if, for example, I develop a Mifare NFC reader in order to sell it, does it need to have a security certification or something like that? Does anything have to do that if the transaction values are used instead of money?
Any info will help.

closed as too broad by RoraΖ, TildalWave, Xander, schroeder, Jens Erat Feb 4 '15 at 19:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think this is too broad. If the card represents a value, there are almost certainly requirements on the readers, but which ones they are will depend on the company that makes the card and the local law. – S.L. Barth Feb 4 '15 at 12:06
  • If you try to sell software (they won't care for hardware as its standard across all contactless cards) that interacts with such cards, expect to get a lawsuit against you pretty fast since their "security" only relies on security by obscurity and you essentially broke that "security" by making your third party software. If you want to release such software, you better do so anonymously. – user42178 Feb 4 '15 at 12:07
  • @Daniel. No, I dont intend to release sw. I am simply wondering about the certifications/standards that the devices must fulfil. If I buy such a device, how could i know if it is secure? – Herc11 Feb 4 '15 at 12:10
  • @Herc11 all a card reader does is relay data packets from the computer to the card and the other way around; there is no encryption nor security involved (if there is, then the encryption happens between the card and computer and the reader just relays whatever data there is without taking part in that encryption), so you should only be concerned about the security of the software, the computer connected to the reader. – user42178 Feb 4 '15 at 12:16
  • Basically, unlike POS "card readers" which are complete computers capable of storing, processing and making transactions using credit card data, USB or serial card readers that you connect to a computer only relay whatever the card transmits to the computer and the other way around, but it isn't capable of storing nor making transactions by itself, that's why there is no particular security requirements for such a card reader, as no sensitive data is ever stored on it. – user42178 Feb 4 '15 at 12:20
1

If you want to build and sell a product similar to this loyalty card item, there is strictly no legal need for a certification of any kind.

However, if you want to sell it, you need a buyer, and a good buyer will compare different sellers before actually buying. And if:

  • On one hand, the buyer encounters a seller telling him that his product has been officially certified by some well known independent organism guarantying that his own "loyal" customers will have no easy way to fraudulently add some credit to their card,
  • On the other hand you come and say that your card has not been certified, but it is cheaper or any other advantage you may think about.

Then you should understand that certification quickly becomes merely a marketing issue than an actual security or legal one. Certification requirement will therefore depend on the market and usage you target for your card.

Not the answer you're looking for? Browse other questions tagged or ask your own question.