Is your chip card secure? Much depends on where you bank • Hacker News Board

Re: Is your chip card secure? Much depends on where you bank

#61

Post by aerostable_slug » Thu, Jul 30, 2020, 5:17 PM UTC

lsllc wrote: post #37

kevin_thibedeau wrote: post #31

Earlier quoted context omitted.

Won't work for gas stations which are the last holdouts.

There's no reason why contactless EMV should not be required even at a gas station (not needing a limit).

Gas pump readers are very expensive. The solution for the wise customer is to go inside and use the POS terminal at the counter if possible.

Old school gas station attack: many gas stations queue and forward transactions for reconciliation in batches, waiting to do so when they don't have connectivity. People have taken advantage of this fact by climbing up on the roof of stations with satellite connections for their POS terminals, tin-foiling them or otherwise blocking their transmission, then buying a bunch of gas with a stolen credit card. Head down to the next gas station, lather rinse repeat, and by the time things get figured out you've got maybe a hundred gallons of gas and a bunch of candy bars you can trade for meth (this is not a Bond Villain-level crime).

Re: Is your chip card secure? Much depends on where you bank

#62

Post by joncrane » Thu, Jul 30, 2020, 5:18 PM UTC

kevin_thibedeau wrote: post #31

humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

Won't work for gas stations which are the last holdouts.

You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.

Re: Is your chip card secure? Much depends on where you bank

#63

Post by aerostable_slug » Thu, Jul 30, 2020, 5:18 PM UTC

humaniania wrote: post #28

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

This kind of thing is done today with EMV cards to determine whether the customer needs to enter a PIN or not. Under a threshold: swipe and go because the level of possible fraud is acceptable vs. the impact on the customer. Above a threshold, PIN required.

Re: Is your chip card secure? Much depends on where you bank

#64

Post by SAI_Peregrinus » Thu, Jul 30, 2020, 5:25 PM UTC

kevin_thibedeau wrote: post #31

humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

Won't work for gas stations which are the last holdouts.

The chain "Speedway" has chip card readers at their pumps, at least in my region (western NY).

Re: Is your chip card secure? Much depends on where you bank

#65

Post by swimfar » Thu, Jul 30, 2020, 5:27 PM UTC

the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

Because many consumers don't see chip and pin as an upgrade (though contactless is nice). So it depends on the banks to decide whether it's worth it. With debit cards, the extra security is valuable. But with credit cards it isn't really too important to me because I can just reverse fraudulant charges.

As for the experience of using each, it seems to depend a lot on the machines. I did not like using chip and pin in Europe because it seemed to take longer and required more interactions. With the magstrip I pull the card out, swipe it, put it away. I'm never waiting for anything. Sometimes I'd have to swipe it twice, but that didn't happen too often to me. But it seems like different people have very different experiences with these things.

edit: this mostly applies to credit cards, which are much more common in the US than in Europe. But the lack of significant benefit for credit cards to use this technology could have resulted in momentum that slowed the adoptation of it for debit cards.

Re: Is your chip card secure? Much depends on where you bank

#66

Post by bryanthompson » Thu, Jul 30, 2020, 5:30 PM UTC

On this topic, if anyone can point me toward a US-based issuer where I can open an account and get a card that supports credit pin (not pin for cash advance on a credit card), I'll happily venmo you a pizza or something. The issuers I have spoken to[1] all tell me it is impossible to get such a card in the US, which seems ridiculous.

[1]: https://wallethub.com/credit-cards/chip-and-pin/ I discussed each of the cards noted here with the issuers, not one is actually chip+pin credit.

Re: Is your chip card secure? Much depends on where you bank

#67

Post by eli » Thu, Jul 30, 2020, 5:32 PM UTC

lsllc wrote: post #52

eli wrote: post #41

Earlier quoted context omitted.

A lot of people think COVID-19 is indeed the thing that will tip this into the mainstream default: https://www.bankingdive.com/news/will-covid-19-push-contactl...

I hope so. On a related note, I don't know if this is just me, but I literally have not used cash since March (although I keep hearing about a "coin shortage", perhaps this is people just not using coin anymore).

Same. And yes, that's my understanding plus other factors: low usage of mass transit ticket machines and laundromats. Plus few people rolling coins and bringing them into a bank right now.

Re: Is your chip card secure? Much depends on where you bank

#68

Post by swimfar » Thu, Jul 30, 2020, 5:34 PM UTC

hocuspocus wrote: post #42

rblatz wrote: post #27

Earlier quoted context omitted.

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

European customers aren't liable for fraudulent charges either, I don't really understand your logic here. Everyone pays the price of fraud and it's probably one major reason that explains high interchange fees in the US.

Early on the customers were completely liable because the banks claimed that the only wait a fradulent charge could be made is if the customer "allowed" their PIN to get stolen. Eventaully they changed this and made it more customer friendly.

Re: Is your chip card secure? Much depends on where you bank

#69

Post by lotsofpulp » Thu, Jul 30, 2020, 5:35 PM UTC

bryanthompson wrote: post #66

On this topic, if anyone can point me toward a US-based issuer where I can open an account and get a card that supports credit pin (not pin for cash advance on a credit card), I'll happily venmo you a pizza or something. The issuers I have spoken to[1] all tell me it is impossible to get such a card in the US, which seems ridiculous. [1]: https://wallethub.com/credit-cards/chip-and-pin/ I discussed each of the cards…

I have inquired about this also and found no solution. If I use my US based credit cards abroad where chip and pin is the norm, I end up getting asked to sign a printed receipt.

I imagine the card networks just don’t want to spend money to change the infrastructure to support chip and pin because the merchant pays for most the losses in the US?

Re: Is your chip card secure? Much depends on where you bank

#70

Post by tomatocracy » Thu, Jul 30, 2020, 5:36 PM UTC

humaniania wrote: post #28

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable compromise to me.