Wednesday, November 7, 2007

Insecurity of Using Magnetic Swipe Cards for Access Control

Magnetic stripes are not inherently secure.

The problem with being easy to manufacture and encode is that it also makes it easy for the crooks to do the same. Several schemes are available for creating a secure encoding on a magnetic stripe, Watermark Magnetics, XSec, Holomagnetics, XiShield, Jitter Enhancement, ValuGard, and MagnaPrint are a few. Each of these technologies exploits some aspect of the magnetic stripe, the card, and the data on the stripe to tie everything together to make counterfeiting the card in some fashion very difficult.

The security schemes all work in basically the same way. They focus on some part of the card/magnetic stripe/encoding and record the information that makes it different from any other card. This could be the noise in the magnetic stripe, an intentional permanent signature in or on the stripe, or some external feature on the card that is permanent.

The advantage to using one of these techniques is that the card and data become tied together making the duplication of the data very difficult. The disadvantage to these techniques is that they cost money and are for the most part, proprietary.

Several of the techniques have been used in large applications where the system demanded some form of extra security.

Read on about the fundamentals of magnetic swipe cards here.