How does encrypting the security code or the money on the card improve anything? The values are transmitted in a way that can be "sniffed". So whether or not they are encrypted doesn't matter, you still get the encrypted string value and present that to the card and it will let you write to it.

The only way to prevent this is to have some sort of key exchange (like Diffie Helman) where the security code would then be sent across after establishing a secure tunnel. I am not sure whether these cards have that capability.

BTW: http://www.digg.com/security/Fedex_Kinko_s_Smart_Cards_Hacked

A former employee states on here that they are only allowed to refund $10.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/newsbriefs/150/692#692