SSOCircle

The newspapers “Zeit” and “c’t” revealed that credit cards with new chip-and-pin based security (EMV) can be cloned and used for payments.

At first glance very surprising as EMV credit cards are smartcards with crypto graphic measures, which allow a bank to recognize modifications to cards or transaction data. These cards are per se more secure than older cards which only rely on data stored in an easily copied magnetic stripe.

So what happened? The answer is simple: Although the EMV standard is well designed and secure, some banks did not implement the cryptographic checks. As a result, the system falls back to the less secure standard and approves the payment transaction.

What do we learn from that story? It is not enough to trust in blind faith, if someone says they rely on secure standards. Whether it is a credit card or a single sign on network, you better CHECK it. At least if you can! For SAML service providers SSOCircle provides you with SSOCheck to verify the crypto security of your “trusted” SaaS provider. More about SSOCheck is here

If you are interested to read more about the MacGyver credit card fraud, here are the links to the original articles in German:
Zeit Article
c’t Article