Hacker News new | ask | show | jobs
by PreInternet01 569 days ago
> In the line of sight of victim

Yeah, you can actually check out the details in https://www.emvco.com/specifications/contactless-specificati... -- relevant parameter is "Device Estimated Transmission Time For Relay Resistance R-APDU", which is specified as "typically 1.5ms".

That's already hard to achieve reliably (in-store WiFi is right out, but possibly Bluetooth?) but would definitely make the required on-device malware even more complicated...
1 comments
eknkc 569 days ago
Also, the underlying processing also takes some time obviously. Hence the 1.5ms timeout. If the cards take 0.5ms on average to respond in real world that leaves even less time to relay.

But I bet in close proximity, sub 1ms would not be a big deal for specialized hardware. Just flood the room with infrared if it gets the job done.

link