THE BORE
General => The Superdeep Borehole => Topic started by: recursivelyenumerable on November 02, 2009, 04:22:48 PM
-
Instead of this horribly vulnerable system, why can't we just do something like
- Public/private key pair associated with each credit card/account
- When you want to pay for something, you bundle together your account number + amount of payment + a Transaction ID and encrypt them with your private key, resulting value is encoded as an alphanumeric sequence that you can give out over the phone or whatever
- There's a chip on the credit card itself that does the encryption + displays the resulting code on a little built-in segmented LED display or something. There are credit-card-form-factor calculators now so this shouldn't be prohibitive
- Transaction IDs must be monotonically increasing so each code you give out can only possibly be used once and only for the exact amount you've authorized.
Is there something I'm missing? this system was just the first thing that popped into my head so I'm sure a professional could do much better, but why don't they?
-
public key encryption is hhhhaaaaaaaaaarrrrrrrrrdddddddd
cleartext is easy!
and yes, the ease of use of credit cards is what makes them so popular. Keep in mind that the idea of instant transaction approval via electronic verification is actually a pretty recent phenomenon. I still know some businesses that use the ol' carbon paper method of capturing CC transactions.