Is your chip card secure? Much depends on where you bank • Hacker News Board

Re: Is your chip card secure? Much depends on where you bank

#21

Post by throwaway_pdp09 » Thu, Jul 30, 2020, 4:08 PM UTC

lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

> because consumers have absolutely no idea how cards differ and what the options are

Well if there's a time and a place to educate people, it's here and now. Your knowledge would be appreciated, TIA

Re: Is your chip card secure? Much depends on where you bank

#22

Post by Nursie » Thu, Jul 30, 2020, 4:08 PM UTC

SomeHacker44 wrote: post #16

Nursie wrote: post #12

Earlier quoted context omitted.

Why would you need it, you've got an iPhone right? (semi serious here - I'm sure they want you to use Apple Pay)

There is a little thing called COVID. All my main payment cards are contactless now. I am not an Apple card customer.

Sure, but if you have an Apple card you're going to have an Apple phone, most probably, and that can do the contactless bit for you. Not sure if apple cards and android phones work, but android-pay is the other option for most cards.

Both are more secure than using the card directly with contactless - you have verified to your phone that it is you using it, by logging in with face ID, touch ID, passcode, PIN, whatever. It's a form of cardholder verification that is missing when you use the card.

That was my (slightly snarky) point - you don't need contactless on the card when you have a smart device that does it better.

Re: Is your chip card secure? Much depends on where you bank

#23

Post by cosmie » Thu, Jul 30, 2020, 4:11 PM UTC

lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

> They get away with this because consumers have absolutely no idea how cards differ and what the options are.

Do you have any tips/resources for how an interested consumer can become more informed (whether for personal or small business accounts)?

Would you be able to get this type of information you'd be able to get to through contacting support, if you know the right way to ask? Or would it be considered too sensitive for the bank to give out implementation details that easily?

Re: Is your chip card secure? Much depends on where you bank

#24

Post by samblogs » Thu, Jul 30, 2020, 4:19 PM UTC

Does anyone have a good detailed article on the crypto behind iCVV/dynamic CVV? This article summarizes how it works, but I haven't found a good detailed article after much googling

Re: Is your chip card secure? Much depends on where you bank

#25

Post by Scoundreller » Thu, Jul 30, 2020, 4:23 PM UTC

dhosek wrote: post #17

ceejayoz wrote: post #10

Earlier quoted context omitted.

> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)

My credit union cards still have the old-style credit card number on the front (but no raised digits for the ker-chunk machine). My Chase card has the numbers in small type on the back in a non-contrasty color. It's not possible to read in non-ideal lighting conditions.

What I like about those is that you can stack more cards in the same space.

And the embossed cards tend to have their ink rub off anyway.

Re: Is your chip card secure? Much depends on where you bank

#26

Post by WorldMaker » Thu, Jul 30, 2020, 4:24 PM UTC

Nursie wrote: post #12

ceejayoz wrote: post #10

Earlier quoted context omitted.

> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)

Why would you need it, you've got an iPhone right? (semi serious here - I'm sure they want you to use Apple Pay)

If you want more convenience in your contactless payments, Apple suggest that you get a more recent Apple Watch.

(Also semi-serious.)

Re: Is your chip card secure? Much depends on where you bank

#27

Post by rblatz » Thu, Jul 30, 2020, 4:27 PM UTC

lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

Re: Is your chip card secure? Much depends on where you bank

#28

Post by humaniania » Thu, Jul 30, 2020, 4:29 PM UTC

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

Re: Is your chip card secure? Much depends on where you bank

#29

Post by WorldMaker » Thu, Jul 30, 2020, 4:31 PM UTC

ceejayoz wrote: post #10

im3w1l wrote: post #2

What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.

> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)

Apple Cards also have the nice feature that the entire mag-stripe CC number is virtual and different/distinct from the number used by contactless/Apple Pay, the number used by the EMV, and the number given by the App for cases where something requests you manually type in a CC number. Most of those numbers can be changed in the App when needed. So even in the cases where someone skims or leaks an Apple Card CC number you typically have more protection than an average card.

Re: Is your chip card secure? Much depends on where you bank

#30

Post by untog » Thu, Jul 30, 2020, 4:31 PM UTC

Nursie wrote: post #13

Nextgrid wrote: post #5

Earlier quoted context omitted.

A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.

Starting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)

I used to live in the UK (and still visit often) but now live in the US. You'd be amazed how far behind US banking is, even compared to the UK ten years ago.