Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What happens when you swipe a credit card

tech.affirm.com

Post reply on HN
Print view View original

71–80 of 178 posts

Re: What happens when you swipe a credit card

#71

Post by pjc50 »

digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

CVV is not just more entropy, it's handled differently: https://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3...

The whole point is that you can't skim the CVV2 from the magnetic data and then use it to make purchase.

Re: What happens when you swipe a credit card

#72

Post by flylib »

Johnie wrote: post #53
flylib wrote: post #25

anyone got a collection of more posts like this?

Are you asking about payments specifically or general "how things work" series? When Apple Pay launched, Clover had a detailed post on tokenization. http://clover-developers.blogspot.com/2014/09/apple-pay.html

either payment or in general

Re: What happens when you swipe a credit card

#73

Post by [deleted] »

coin wrote: post #12
jwilk wrote: post #5

Earlier quoted context omitted.

Why sadly?

Because swiping is so much more convenient. With a magnetic transaction I can just swipe and put my card away. Most of the time I swipe at the beginning of a long checkout (grocery store). With a chip transaction, I need to leave the card in until the very end. I now need to leave my wallet out, or put the wallet away and then remember to take the card back. More card readers are optimized for swiping with card inser…

[deleted]

Re: What happens when you swipe a credit card

#74

Post by jdmichal »

nodesocket wrote: post #68
digler999 wrote: post #48

What annoys me is the expiry date and CVV. It seems like their solution to "more secure" is just to add more numbers. How about put the last 3 digits on the back, and call it the cvv ? How about use alphanumeric card numbers so we dont have to use as many digits ? Get rid of the expiry date used as validation. It's just more entropy, if you need more entropy then add another digit. It's just annoying having to type t…

I think we can all agree the correct model is a card that generates a globally unique card number for each and every transaction (e.g. coin failed , final). It should also have a 2nd factor authorization like CVV which is not embedded in the magnetic strip (can't be read by swipers).

Which is (roughly) exactly how EMV chips work. Crypographic challenges that result in unique tokens for every transaction.

Re: What happens when you swipe a credit card

#75

Post by umeshunni »

vinceguidry wrote: post #60
JshWright wrote: post #50

Earlier quoted context omitted.

Outside the United States.

That was easy enough to infer, what wasn't was where in the world contact-less payment systems came to dominate. Even in Europe chip appears to be the norm. China? Japan?

In UK and AU, contactless payments dominate, particularly for low value transactions. I suspect that's the case in Japan too.

China has a mishmash of system from in-app payments (a la WeChat) to QR-code based systems.

Re: What happens when you swipe a credit card

#76

Post by endgame »

Interestingly, interchange fees in Australia for credit cards are going to get capped to 0.8% later this year. This is forcing banks to re-evaluate their reward card offerings. AIUI, American Express isn't affected because they have direct relationships with each individual merchant.

The big 4 banks in Australia have historically offered an Amex card and a Visa/MasterCard linked to the same account (because Amex isn't accepted everywhere and often attracts surcharges). If ANZ's recent move is anything to go by, it looks like the banks won't be able to afford offering a linked Amex with their accounts.

Re: What happens when you swipe a credit card

#77

Post by hibikir »

Cyph0n wrote: post #11

I'm kind of disappointed that you didn't go into the security features present in a typical credit card transaction. For example, you could describe the crypto protocols used to communicate with the gateway and/or card processor, what kind of data the stripe and chip contain and how it is used for authentication, etc. Another thing I find interesting is the anti-tamper features that are present in a standard credit c…

The way I see it, this is describing the system exactly as much as it needs to make its case that 'banking system is bad and expensive, use our stuff'. Covering security, or the lower fees in Europe (thanks mostly to the security features), goes against the narrative.

An interesting tidbit: An extra reason US fees are so high are premium credit cards choke full of rewards: Not every card has the same fees, and the highest fees come from cards that are handing you extra rewards, that are paid pretty much directly by the merchant. It's just that banks know that the better the rewards the more people will use the credit card, and the easier it is to take the business away from cheaper cards, as nobody charges you more at the register for using a Chase Sapphire Preferred instead of a debit card.

Security features also make US cards extra expensive, as the best you have is Chip and signature, and that doesn't cover online. If we demanded 2FA in every transaction, including online, fraud would go very close to zero, and with it, fees.

With more modest rewards and better security, interchange fees could shrink by over a percentage point: Banks just don't do this because there's little to no competitive pressure.

Re: What happens when you swipe a credit card

#78

Post by coin »

chrisseaton wrote: post #8
coin wrote: post #4

> swipe your card Sadly swiping is being replaced by chipcard.

Chip cards replaced swiping over a decade ago, and a couple of years ago contactless replaced chip cards for most purposes. Does anyone literally swipe a credit card any more? I can't remember seeing it done in years except in some parts of Europe.

> Chip cards replaced swiping over a decade ago

No so for the US, they're still relatively new having been introduced in the last 5 years

Re: What happens when you swipe a credit card

#79

Post by umeshunni »

Cyph0n wrote: post #11

I'm kind of disappointed that you didn't go into the security features present in a typical credit card transaction. For example, you could describe the crypto protocols used to communicate with the gateway and/or card processor, what kind of data the stripe and chip contain and how it is used for authentication, etc. Another thing I find interesting is the anti-tamper features that are present in a standard credit c…

The transactions on the network (i.e. between the banks and the association) typically use the ISO 8583 protocol: https://en.wikipedia.org/wiki/ISO_8583

The actual implementation (for e.g. between the hardware terminal and their gateway) is usually using some custom API/protocol - for e.g. Stripe/Braintree have their own APIs as do other older players like like PTI (https://www.chasepaymentech.com/developercenter/index.html?W...).

Re: What happens when you swipe a credit card

#80

Post by coin »

alkonaut wrote: post #39
coin wrote: post #12

Earlier quoted context omitted.

Because swiping is so much more convenient. With a magnetic transaction I can just swipe and put my card away. Most of the time I swipe at the beginning of a long checkout (grocery store). With a chip transaction, I need to leave the card in until the very end. I now need to leave my wallet out, or put the wallet away and then remember to take the card back. More card readers are optimized for swiping with card inser…

The swipe is a 1 second job, but the insert+PIN takes maybe 10sec. I do the card+pin at any point while the cashier is registering my groceries. By the time he finished scanning them all, the card has been back in my pocket a long time. The only thing I do at the end is hit "ok" to confirm the amount. The procedure would be exactly the same with a magnetic card. Even just the convenience of a more reliable read is wo…

This doesn't work in the US. Where I live, for a credit card chipcard, the cashier has to finish, then there's a 2-way authentication with the server whereby the card has to stay in the reader. This is why the card has to stay out until the very end.
Post reply on HN