CC fingerprints

-----BEGIN PGP SIGNED MESSAGE-----

http://cnn.com/TECH/9705/16/t_t/magnetic.security/index.html

Catching counterfeit credit cards

Researchers find way to check magnetic 'fingerprints'

ST. LOUIS, Missouri (CNN) -- Researchers at Washington University here have 
come up with a way to spot counterfeit credit cards by detecting the unique 
"fingerprint" on the back of each card. 

<snip>

Their solution, called the Magneprint system, reads the millions of tiny 
magnetic particles, which are unique on each card, says Professor Ronald 
Indeck. 
Each magnetic stripe on the card has two important areas. The first looks 
like a bar code, which contains the account number. The rest is a random 
pattern of magnetic information -- a signature that is different on every 
card and impossible to duplicate, Indeck says.

<snip>

The inventors say the Magneprint system can be used to stop other kinds of 
fraud, involving airline tickets, currency, and checks.
It's expected to be made available to card companies later this year.

========================================================================== 


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQEVAwUBM311bjltEBIEF0MBAQHq1Af9EIo98F80FaAbiYJv9JBfR8QIFpwIHnCG
HPZAyRFPz8Yx1AMApGc0i5JckqanriXzAEE/+3K1YiLcpL0X0yxUEA6wBc31nYG1
6so/mWdeaBMy81/Coa+534vPcWpPN4/TyBsiGitNzeh4dVit2yYg/AwW2NV092B2
p6ERgI91UtIxVov18CG2wpt960H2q4QNGnl5pI43xhHeutsZHvt97eDpoMTqaR6v
nam1TpolXxQSxcubmOfUFyvI1hZN3bUx472OnfcrtuuNHMPsoGX11J9Z2NtTzwjx
FbcpDJ0KCQtTlY1ViGHI60XqFFFWXUQ/pTZgXF8bVeOsIzOkicU0Ug==
=Y3gr
-----END PGP SIGNATURE-----

harka@nycmetro.com wrote:

| Their solution, called the Magneprint system, reads the millions of tiny
| magnetic particles, which are unique on each card, says Professor Ronald
| Indeck.
| Each magnetic stripe on the card has two important areas. The first looks
| like a bar code, which contains the account number. The rest is a random
| pattern of magnetic information -- a signature that is different on every
| card and impossible to duplicate, Indeck says.

	"Impossible to duplicate."  Perhaps he has never heard of the
ironing trick?  (You use an iron to heat one card in the proximity of
the other.  This breaks up the cohesion of the particles on the card
close to the iron.  The magnetic field in the other card causes the
particles to realign themselves as they cool.)

	I suspect that a conventional card reader won't duplicate the
other areas of the card.  But the duplicability of bits is a
fundamental fact. Thats why Chaum's original systems are online, and
safer than the smartcard system.  The smartcard based systems depend
on the cost of breaking behing higher than the payoff for criminals.
(Or the cost of breaking the smartcard based system as opposed to
breaking some other system.)

	A mag stripe card, with no defenses built in, can be
duplicated.  Are they offering prize money for beating thier system?
My only worry would be that they read finely enough that they notice
small deviations in the duplicate.

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

On Sat, 17 May 1997, Adam Shostack wrote:

> harka@nycmetro.com wrote:
> 
> | Their solution, called the Magneprint system, reads the millions of tiny
> | magnetic particles, which are unique on each card, says Professor Ronald
> | Indeck.
> | Each magnetic stripe on the card has two important areas. The first looks
> | like a bar code, which contains the account number. The rest is a random
> | pattern of magnetic information -- a signature that is different on every
> | card and impossible to duplicate, Indeck says.
> 
> 	"Impossible to duplicate."  Perhaps he has never heard of the
> ironing trick?  (You use an iron to heat one card in the proximity of
> the other.  This breaks up the cohesion of the particles on the card
> close to the iron.  The magnetic field in the other card causes the
> particles to realign themselves as they cool.)

I am currious how there new system responds to wear and tear on the card.
If it is as sensitive as they claim, I bet carrying the card around in
your pocket will bang the card up enough to make it show up as a
duplicate.

Sounds like an eventual article for Risks...