228

You can't clone the chip. A magnetic strip holds a secret number, and if someone knows that number they can claim to be the owner of the card. But if a bad guy swipes the card, they then know the number, and can make their own card, i.e. "cloning". This has turned out to be a major practical problem with magstripe cards. A chip also holds a secret number. ...


70

The chip carries out a cryptographic operation on data passed to it that requires knowledge of the key that is strongly protected within the chip - so an attacker cannot easily copy the card. That said, there have been some successful research papers on timing or power attacks, but these are from lab conditions, and probably not a real worry in the wild. ...


50

A satellite TV system must face the following challenge: it is one-way. The receivers cannot do anything but receive; they cannot emit anything. The generic problem is known as broadcast encryption. In practice, things go that way: Each subscriber has a smartcard, and that card contains a key Ks specific to that subscriber. The media stream is encrypted ...


34

The magnetic strip contains the exact information used to identify the card. The chip holds a piece of information that it doesn't share, but that it can use to prove it has that information. Thus, a magnetic stripe is dumb and can be copied, but since the chip doesn't give out its secret, a vendor can't simply copy it when you use it. A magnetic stripe ...


30

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


27

Back in the 90s these prepay cards were easily hacked in a number of ways. First, as you said, people could reprogram them with much larger amounts for free calls. A more low-tech method was that they'd simply scratch off or cover the conductive surface on the pin which decreased the amount on the card, allowing for infinite free calls on a one-time topup. ...


23

Does the smart card ever "reveal" the private key to applications like SSH or GPG? If so, it seems anyone who has the PIN and the device itself can still get at the private key, and offers no advantages over regular USB drives. If not, how exactly do applications work without knowing the private key? Ideally, No. The primary advantage of such a token is ...


19

This is just some extra information but it didn't fit as a comment under Thomas' answer. There's an interesting pirating method that have made it possible for the cycle to extend way longer than two weeks. It's called CardSharing. Here's how it works: Somebody buys a legitimate card and inserts it into a modified satellite receiver that will use the card ...


19

Exact cryptography depends on the bank. The communication standard (ISO 7816) is flexible and does not mandate specific cryptographic algorithms. In practice, you would find the two following models: The card does symmetric cryptography only (symmetric encryption, MAC). The card has a static identifier (which contains, roughly speaking, the card number and ...


16

Other answers already given are correct, but I would like to give the following as an answer with no technical background required on part of the person asking: When you use a magnetic strip Credit Card, the device is saying to the card: "My user will input a PIN to verify, let me read your strip so I can check it". ( EDIT: OK, the above paragraph is not ...


16

After the private keys are on the Yubikey, they are not exportable. What you can export are secret key stubs, which practically only say this key is on a smartcard. They were the main method of making the key work on a different computer (with the smartcard), but these days, as there is sufficient information stored about the key, all you need is to use --...


13

I've been looking into this myself. I want to be prompted to enter my PIN every time I request my smart card (Yubikey in my case) to do a sign/encrypt/auth operation. It is possible to enable this behaviour for signing by enabling forcesig through gpg2 --card-edit (see GnuPG documentation): forcesig toggle the signature force PIN flag but not for ...


12

You need to run: gpg --card-status and gpg will do it for you: /tmp$ mkdir gpgtmp /tmp$ chmod go-rwx gpgtmp /tmp$ GNUPGHOME=/tmp/gpgtmp gpg --keyserver pgp.mit.edu --recv F8713BDF gpg: sleutelring ‘/tmp/gpgtmp/secring.gpg’ is aangemaakt gpg: sleutelring ‘/tmp/gpgtmp/pubring.gpg’ is aangemaakt gpg: opvragen sleutel F8713BDF van hkp sleutelserver pgp.mit....


12

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...


11

This wouldn't be a problem at all. As you see in the picture in your link, there is a version with a smaller form factor (ID-000). This is the same card just with cut outs. Everything outside the contact area is just plastic. I made you a drawing in paint showing where the actual IC is in the card. Everything outside this box can be removed without any ...


10

Details depend on bank, card type and country, so they vary quite a lot, but the generic model is the following: The magnetic stripe contains, mostly, a computer-readable copy of the information embossed on the card: account number, holder name, expiration date. The chip contains a secret key which is used to "sign" (not necessarily a true signature; often ...


10

You could wrap up the rest of the answer with "The YubiKeys implements the cryptographic smart card protocol using a programmable microcontroller". So what does this imply? Cryptographic Smart Cards The idea behind cryptographic smart cards is that they're equipped with their own crypto processor, and are able to perform several operations: create ...


10

I will answer this although it seems to be worded sketchy. Calling cards, and credit cards do not work in a manner as you infer/interpret. In a calling card system, especially pre-paid cards, when you make a call it works like this: You --> call pre-paid number to enter a PIN PIN System --> you "What is your PIN #" You --> enter your PIN PIN System ...


10

I guess you will have bad luck, and this is not supported by GnuPG. When using OpenPGP smart cards, a secret key dummy is stored in your keyring, holding a reference to the smart card it is stored on. The secret key subpacket looks like this when displayed through gpg --list-packets: :secret sub key packet: version 4, algo 1, created 1358985314, ...


9

OpenPGP smartcards do not reveal your secret keys. Basic signing and decryption tasks are performed by the card's built-in crypto processor, and are only available after entering your PIN code. Imagine your OpenPGP client (for example, GnuPG) sends a request "decrypt this cypher block" which then is performed by the card (the actual encryption is done using ...


8

Assuming the laptops to run under Windows, you would need the following: a PKI solution to initialize and manage smart cards; each smart card will contain a private key and the associated certificate; to enable smart card logon so that users open a session on the laptop with the smart card, instead of a password (the smart card itself will require entry of ...


8

GnuPG 2.1.0beta2 supports signing certificates in batch mode: Support X.509 certificate creation. Using "gpgsm --genkey" allows the creation of a self-signed certificate via a new prompt. Using "gpgsm --genkey --batch" should allow the creation of arbitrary certificates controlled by a parameter file. An example parameter file is Key-...


8

It is a question of liability: If a merchant uses chip & pin, and the transaction turns out to be fraud, the card issuer pays for the fraud (assuming the merchant has not been negligent). If a merchant uses the magnetic stripe, and the transaction turns out to be fraud, the merchant pays for the fraud. When chip & pin was first introduced, in ...


8

No, the Yubikey 4 is not Open Source: The implementation is not open source, that is correct. We have both internal and external review of our code to ensure that it is secure. It's important to remember that open source code is no guarantee that bugs/vulnerabilities will be detected as the bug you've linked to demonstrates quite well. The bug was inherited ...


8

Secret keys cannot be exported from OpenPGP smart cards -- that's the very idea behind them. If you created the key on a computer and imported it to the smart card, use the backup to copy it to the Yubikey. Otherwise, you'll have to create a new key. Be aware the Yubikey is just another OpenPGP smart card, so if you create the key directly on the Yubikey, ...


7

There is a security standard for smartcards under the Common Criteria scheme: the Smart Card Protection Profile. A protection profile defines the security properties that are expected from a device or system. The smart card PP is defined for EAL4+. To put it succintly, the EAL defines what aspects of the product's design are evaluated and to what extent (...


7

Found the solution myself. There is one smart card platform that implements Java Card 3.0.1 Classic, available as a smart card and as a USB token: Sm@rtCafé Expert 6.0 StarSign Crypto USB Token There also seems to be some similar card from CardLogix. However, these are all Java Card 3.0 Classic, which is very close to Java Card 2.2.2. The minute ...


7

You might want to clarify your question - here's an answer as to why it's safer card issuer: If a magstripe card is stolen it's quite easy for the thief to use it fraudulently - how often are signatures really checked (in fact in the US I've often had the card handed back to me before I've signed, even where extra ID isn't requested). If a chip&pin card ...


7

It uses digital signatures. The secret number stored on the card is a private key. To perform a transaction, the card reader generates a summary of the transaction: date, time, amount, merchant ID, etc. The reader sends this to the card. The card uses its private key to generate a digital signature of the transaction details, and sends this back to the ...


Only top voted, non community-wiki answers of a minimum length are eligible