Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

81–90 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#81

Post by jackson1442 »

blahyawnblah wrote: post #55
lsllc wrote: post #40

Earlier quoted context omitted.

That may have been the case, but pretty much everywhere I go stores have newer EMV capable terminals (e.g Ingenico etc). The only place I really use mag swipe now is a gas station pump (who have no excuse not to switch to contactless EMV). You'd think with COVID-19, there'd be a rush to move to contactless payments.

Lots of gas stations do use the chip, but it's the same process of inserting the card.

Never been to a pump that uses chip personally, unless you pay inside. I've seen ~5 with a contactless tap point, but only got about 2 of them to work.

This is in Texas, for reference.

Re: Is your chip card secure? Much depends on where you bank

#82

Post by llsf »

rblatz wrote: post #27
lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

That is the thing that it took me a while to understand once arriving in US from Europe. In Europe I did not care the least if someone managed to hack my credit card. The bank is liable. The bank is responsible to make as secure as possible. That is probably why we had credit card with chip & pin since the 80's. Banks had incentive to reduce the fraud as they could not easily pass it to the customers. But when I arrived here in US, I heard all those horror stories with fraudulent charges (and it happened to me too) and why I should take it seriously. And why I should protect my CC details ?!? (like my US social security number... but that is for another thread :) Coming from a country where CC used chip & pin for more than 30 years, and only have US embracing it (but only half-way) in recent years, is bizarre.

Re: Is your chip card secure? Much depends on where you bank

#83

Post by PascLeRasc »

bryanthompson wrote: post #66

On this topic, if anyone can point me toward a US-based issuer where I can open an account and get a card that supports credit pin (not pin for cash advance on a credit card), I'll happily venmo you a pizza or something. The issuers I have spoken to[1] all tell me it is impossible to get such a card in the US, which seems ridiculous. [1]: https://wallethub.com/credit-cards/chip-and-pin/ I discussed each of the cards…

I believe AmEx charge cards (Green, Gold, Platinum, possibly others but these are the good ones) are all chip-and-pin. The Blue Cash one on that website isn't.

Re: Is your chip card secure? Much depends on where you bank

#84

Post by thesimon »

bryanthompson wrote: post #76
xenospn wrote: post #74

Earlier quoted context omitted.

Had many arguments with cashiers in Europe who refused to let me sign receipts and insisted I just enter a pin.

Also interesting how there are such specific requirements at grocery stories. None of my US-based cards could be used in several grocery stores in the Netherlands. When the cashier looked at my cards, they immediately knew it was because I didn't support whatever networks they expect.

Maestro or VPay they expected, the european old-school debit brands.

Re: Is your chip card secure? Much depends on where you bank

#85

Post by ceejayoz »

PascLeRasc wrote: post #83
bryanthompson wrote: post #66

On this topic, if anyone can point me toward a US-based issuer where I can open an account and get a card that supports credit pin (not pin for cash advance on a credit card), I'll happily venmo you a pizza or something. The issuers I have spoken to[1] all tell me it is impossible to get such a card in the US, which seems ridiculous. [1]: https://wallethub.com/credit-cards/chip-and-pin/ I discussed each of the cards…

I believe AmEx charge cards (Green, Gold, Platinum, possibly others but these are the good ones) are all chip-and-pin. The Blue Cash one on that website isn't.

My Gold is definitely not chip-and-pin. Chip, yes. Pin, no.

Re: Is your chip card secure? Much depends on where you bank

#86

Post by tricolon »

Nursie wrote: post #13
Nextgrid wrote: post #5

Earlier quoted context omitted.

A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.

Starting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)

I'm in the US and have never heard of it.

Re: Is your chip card secure? Much depends on where you bank

#87

Post by tzs »

OK, so if I grasp this, the problem is that an EMV skimmer gets the card number and an iCVV. The bad guys make a stripe card with that number and the iCVV.

That should not work because banks are supposed to look for the iCVV only on dipped transactions, and look for the CVV on swiped transactions (and the CSC for online/telephone transactions).

Some banks apparently left out the logic of matching the type of code to the transaction method, and so using iCVV in place of CVV works for them.

Even if all banks got this right, though, it seems to me you could still get fraud. The CVV is only three digits. Once you've got the card number just make a stripe card and guess the CVV. If it fails, try another CVV. As long as you don't do too many guesses too close together and cause the bank to lock out the card, you should eventually find the right CVV.

Even if the bank is very trigger happy on fraud lockouts, if your skimmers got several thousand card numbers you are going to have many CVV guesses turn out to be right the first time.

Instead of the stripe on cards that have both EMV and stripe being just a copy of the same card that is in the EMV side of things, shouldn't they be separate? The issuing bank should issue two logical cards for the underlying account, with one being EMV only and one being stripe/online only.

Re: Is your chip card secure? Much depends on where you bank

#88

Post by tialaramex »

tomatocracy wrote: post #70
humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable com…

This is called "Liability shift" yes. Shift is imposed where a retailer cannot/ does not accept chip cards rather than where for whatever reason a chip card wasn't able to be used. In the US shift was supposed to be imposed everywhere left this summer, I expect COVID-19 is offered as another reason to yet again delay, but retails stores are already covered, it's mostly things like some unattended 24 hour gasoline pumps that are still mag-stripe in the US.

Also most (all?) card holders don't have a problem with the chip, they may be unable to remember a PIN, or unable to enter one, in which case the chip terminal requests a human witness them signing something or asks the retailer to accept just the chip. Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead.

Re: Is your chip card secure? Much depends on where you bank

#89

Post by donarb »

I use my chipped card frequently when going to the grocery store. Pretty much 20% of the time, it won't read the chip, reporting "Chip Malfunction". Even wiping any sort of gunk off the chip contacts doesn't fix it. So you have to go through 3 failed read cycles before it will let you use the mag strip on the back.

Going back to the store a few days later and the same machine will work, I wonder how often the machine's readers are cleaned.

Re: Is your chip card secure? Much depends on where you bank

#90

Post by jack_h »

donarb wrote: post #89

I use my chipped card frequently when going to the grocery store. Pretty much 20% of the time, it won't read the chip, reporting "Chip Malfunction". Even wiping any sort of gunk off the chip contacts doesn't fix it. So you have to go through 3 failed read cycles before it will let you use the mag strip on the back. Going back to the store a few days later and the same machine will work, I wonder how often the machine…

I've had problems with the chips themselves. I had a card whose chip worked perfectly for maybe a year or more before I lost it. The replacement chip worked for about a week then I'd get a chip error every time and everywhere. So I got another replacement which didn't work out of the envelope. So I got a third replacement and it worked exactly one time before breaking.

At this point I've just given up and insert the card three times before being forced to use the mag strip. I don't even know what else to do...

Post reply on HN