Is your chip card secure? Much depends on where you bank
krebsonsecurity.com
Is your chip card secure? Much depends on where you bank
1–10 of 180 posts
Re: Is your chip card secure? Much depends on where you bank
#2What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.
Re: Is your chip card secure? Much depends on where you bank
#3Guessing Visa can "fix" this problem in the same way they fix the fallback to magstripe: make the vendor pay a fee for noncompliance.
https://www.cardfellow.com/blog/emv-fallback-fees-definition...
Re: Is your chip card secure? Much depends on where you bank
#4Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer.
Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have absolutely no idea how cards differ and what the options are.
Re: Is your chip card secure? Much depends on where you bank
#5What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.
A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.
Re: Is your chip card secure? Much depends on where you bank
#6What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.
Depends on where you bank I suppose. Also depends on where you credit.
I can't use my bank card without mutual validation, same with my credit card. Even if you do it manually we still get a challenge-response that you use a hardware device or an app for.
Re: Is your chip card secure? Much depends on where you bank
#7Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…
Can you give any recommendations on banks that really get it right? How about the inverse?
Re: Is your chip card secure? Much depends on where you bank
#8So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV.
Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020.
They should have been retired over a decade ago.
Re: Is your chip card secure? Much depends on where you bank
#9Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…
What features make a secure credit card and how can a consumer verify their presence?
Re: Is your chip card secure? Much depends on where you bank
#10What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.
> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits?
Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)