Use Your PDA As A Secure 'Wallet' 15
aphor writes "The The Infrared Data Association has drafted a standard for IrDA "Point and Pay" devices. Its called Infrared Financial Messaging (IrFM) Point & Pay, and its supposed to turn your handheld computer or cell phone into a digital wallet that can handle credit card, debit, check [and maybe even secure anonymous digital cash ala CyberCash?] transactions. I think this is significant, because instead of trusting a closed device like a smart card or magstripe on a credit card (we all know the problems with those), you receive a challenge from the vendor on your IR port, and you control how your device responds to it. Palm OS and Linux are specifically mentioned in their documentation as platforms for IrFM Point-and-Pay. BTW: I can't see anything that would prevent turning your Palm device into a handheld cash register. The specs for their protocol can be downloaded for free."
NYC and MetroCards (Score:5, Interesting)
I have what's called a "weekly" metrocard. Unlimited trips for the entire week. The way to stop people from swiping others through, is by limiting the amount of time before you can use it in that spot. You can go to other spots w/o a problem serially. Just not the same one before 20 minutes are up.
The problem is, when this thing misreads/miswrites. It would give an error, to see the clerk and won't let me through. The clerk will usually find something like, "You just used this 4 minutes ago." It's up to the discression of the clerk to either let you through, computer error, or to wait 20 minutes.
What happens when this happens with these little devices? Neat in theory, but there's something that humans do better than any machines. Communicate and understand, in full duplex, a transaction.
Re:NYC and MetroCards (Score:3, Interesting)
That's what IrFM does. The cash-register/POS terminal, IrDA connection, and your handheld device all mediate the same conversation you're talking about.
You get some stuff to the checkout at the store. They stuff gets scanned. The message on the screen flashes "Credit/Debit/Cash," and your Palm Pilot flashes the vendor name at the top of a list of the stuff that was scanned, tax, and totals
so you mean.... (Score:1)
Hmm... (Score:1)
My issue would be with IR signal jacking. Ever changed the channel on your tv by aiming the remote away from it and into a mirror? What's to stop someone from using an IR sniffer device, to pick up random reflected transmissions?
Would PayPal sue? (Score:3, Insightful)
I give it 6 months... (Score:5, Funny)
So much for my 'I only have plastic' excuse.
Smart card less secure ? (Score:1)
There always is a challenge & response, plus the device itself cannot be tampered with : there is no possibility to use a probe to get internal content.
Steal a smart card vs. steal a Palm IrFM device (Score:5, Insightful)
Smart cards are more OBSCURED than this. If someone steals your palm-pilot, they would still have to guess your password before they could use it. Steal a smart card, and then keep on stealing! If you think tampering is an issue, then you don't know about zero-knowledge proofs, public-key crypto, haven't actually understood the IrFM protocol, and thus you aren't qualified to make the inference you draw between tamper-resistance and security. The devil is in the details.
Re:Steal a smart card vs. steal a Palm IrFM device (Score:1)
Of course, a blank password on a smartcard is a bummer.
Re:Steal a smart card vs. steal a Palm IrFM device (Score:2)
If a smart-card has no data display or input, then how are you supposed to know what kind of challenge (from whom) you are actually answering? This is very vulnerable to sniffing and known plaintext cryptanalysis attacks (if the CRAM is encrypted).
Lets be honest (Score:2)
Re:Lets be honest (Score:1, Insightful)
a LOT of people get a mobile phone with irDA and Java: is ALREADY happening