Barclays rolls out contactless debit card

Barclays has announced the launch of its contacltess debit cards containing RFID technology, which enables them to use the debit card for transactions of up to ten pounds without having to enter a PIN.

However, the fact that the protocol behind the contactless technology has not been made available to academic security researchers is causing many security risks says Cambridge University researcher Steven Murdoch. He worries that while security researchers were not given required access to the protocol, it is clear that unwanted parties will get the access and might even cause harms to the system.
 
On the other hand, a Barclays spokesperson told ZDNet UK that the system has already been through a third-party testing and security risks around contactless payments had been diminished. 

Cambridge University researchers, Saar Drimer, Ross Anderson, and Murdoch, published a paper with the security flaws in the Chip Authentication Programme (CAP) used for UK payments cards. The paper states that the main problem with the cards was that they had been optimised for usability for the cost of sacrificing security. There also were design errors found in CAP. In addition, authentication tokens that are reused between point-of-sale and online banking transactions enable man-in-the-middle to attack online.

Apacs, a UK trade association stated the company was familiar with all the details specified in the paper. The company also highlighted that usability was also one of them main issues for any card possessing company.