News for hackers. Stuff that matters.
Re:Coin by bdamm on Thursday November 14, 2013 @05:10PM (#6736027)
There are three tricks involved with this.

One, you may not be able to download the card app from one card and upload it to another. My GlobalCard fu is not well honed enough to tell you what ADPU you'd need to invoke in order to try, but it goes against the goals of the product to allow this anyway.

Two, if a credit card company provides you with an EMV card, it's got a private key loaded into the card, and may have even originally been generated on the card. It is outright not allowed under any circumstance to download that private key and upload it to another chip; that would be a major hole in the scheme.

Three, not all banks use the same crypto. Even if they all agreed to a single kind of crypto operation, different EMV chips have different performance characteristics when carrying out crypto operations. If the bank can't control the actual EMV chip any more, then they cannot control elements of their payments processing (e.g. session closure within a certain time frame). This problem is the easiest to solve of these three problems.

So, unless the banks get on board with allowing their apps and their keys to be provisioned on an already existing card, or provide some kind of proxy mechanism whereby an EMV card can delegate another card to act on its behalf (and imagine the security concerns with that) then this isn't going to happen.

I don't see the benefit to the banks for doing this. You're far more likely to see paypal succeeding in turning your phone into your wallet (and they are doing it) then you are to see Visa or MC allowing you to link multiple EMV cards into one.

Re:Coin by Nursie on Thursday November 14, 2013 @05:59PM (#6736348)
1) Agree, you can't get at various bits of data that must be present in order for the card to be able to do what it does. Most likely sits in private 'files' that READ DATA can't access.

2) Yup, and combined with '1' this means that you'd have to get the banks to do it

3) You'd have to get some more cross-scheme standards about the crypto capabilities sorted out. I estimate we could have all the schemes in agreement by... 2025? Or is that optimistic?

The benefit would only be to the consumer, in the same way that Coin may benefit people, however any method of doing this with EMV would present some sort of extra attack surface and that's generally Bad(TM).

Re:Coin by PeterisP on Thursday November 14, 2013 @06:12PM (#6736424)
The technical issues are solvable (by any reasonable issuer bank), but Visa/MC simply prohibit you to put competitors together with their cards.

Want to add some loyalty cards on the same chip? Sure!

Want to combine two different MC products? Sure!

Want to have Mastercard together with Visa or some local card network that we dislike? Nope, we don't want that so we'll not allow you to issue such cards.

Re:Coin by Nursie on Thursday November 14, 2013 @06:13PM (#6736431)
Very true. Forgot about that.

Share branding? Are you CRAZY???