Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#111

Post by asveikau »

pc86 wrote: post #45
LeifCarrotson wrote: post #39

Earlier quoted context omitted.

If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card…

> the fault isn't with the victim nor really with the perpetrator The perpetrator isn't at fault?

The perpetrator is in one sense to blame but this isn't a good justification for lax security on the part of the card issuers.

You wouldn't leave your door unlocked at night because it's the burglar's responsibility to be a better citizen.

Re: Is your chip card secure? Much depends on where you bank

#112

Post by Nursie »

woodruffw wrote: post #92
IshKebab wrote: post #46

Earlier quoted context omitted.

> If a transaction doesn't get made because it was over $40, that represents unacceptable missed profit Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit".

> Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit". This isn't true with US payment cards, in my experience. I've charged over $1000 on a credit card multiple times while using contactless methods (both RFID and Apple Pay, specifically). I was also able to do the same with my (American) cards while in Europe.

Apple/Android pay is generally unlimited here in the UK, but using contactless cards is limited to £40, blanket.

This is because contactless card payments have no cardholder verification.

I am quite surprised if you can do that with your cards in Europe as the limit is usually enforced on/by the merchant, not the card.

Re: Is your chip card secure? Much depends on where you bank

#113

Post by Nursie »

Shivetya wrote: post #49
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

>Second is, is there a way to gain the safety of the chip and pin with online purchases.

In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?)

It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retailer systems.

It's not the same level.of assurance as EMV, but it is something, and any transactions that don't go via that system are more likely to be declined or flagged as fraud.

Re: Is your chip card secure? Much depends on where you bank

#114

Post by Nursie »

jgalt212 wrote: post #94
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

Mag stripes via fingerprinting of the actual stripe, can make make them more secure than EMV or contactless. Both the standard card data and the underlying magnetic fingerprint of the card is read, all in a single swipe. [1] [1] https://www.magtek.com/product/magnesafe-intellihead

That's still not really "more secure" than EMV, which includes active security measures like PIN validation capabilities, various active anti-fraud measures like offline velocity checks, transaction amounts encoded in cryptographic tokens, and which can in theory be remotely disabled etc.

I guess it makes it "more /just as able to be authenticated as a genuine card" though.

Re: Is your chip card secure? Much depends on where you bank

#115

Post by [deleted] »

IshKebab wrote: post #46
LeifCarrotson wrote: post #39

Earlier quoted context omitted.

If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card…

> If a transaction doesn't get made because it was over $40, that represents unacceptable missed profit Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit".

[deleted]

Re: Is your chip card secure? Much depends on where you bank

#116

Post by Alupis »

joncrane wrote: post #62
kevin_thibedeau wrote: post #31

Earlier quoted context omitted.

Won't work for gas stations which are the last holdouts.

You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.

Stumbled across my first one of these the other day.

It's not obvious at all that you should leave it in - particularly when accustomed to the ubiquitous slide-in-and-out-fast kind.

This one tried to lock my card in, but when I reflexively yanked on it to pull it out, somehow it lost contact with the chip or something. What followed was a stuck card in this machine, and the machine stuck on "verifying"... no cancel buttons worked either. Eventually, after a long and disconcerting minute had passed, it finally released my card and told me to go inside for payment.

Definitely not user friendly in the slightest... and just an awful way to start your morning on your way to work.

Re: Is your chip card secure? Much depends on where you bank

#117

Post by meragrin_ »

donarb wrote: post #89

I use my chipped card frequently when going to the grocery store. Pretty much 20% of the time, it won't read the chip, reporting "Chip Malfunction". Even wiping any sort of gunk off the chip contacts doesn't fix it. So you have to go through 3 failed read cycles before it will let you use the mag strip on the back. Going back to the store a few days later and the same machine will work, I wonder how often the machine…

A cashier gave me a tip once. Try pushing on the face of the card so the chip end is levered up against the machine tighter. It seems like there is something wrong with the contacts in the reader and do not make appropriate contact with the chip.

Re: Is your chip card secure? Much depends on where you bank

#118

Post by 0xffff2 »

joncrane wrote: post #62
kevin_thibedeau wrote: post #31

Earlier quoted context omitted.

Won't work for gas stations which are the last holdouts.

You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.

I travel a decent amount in the Western US, mostly in California and Oregon. I have never once encountered this.

Re: Is your chip card secure? Much depends on where you bank

#119

Post by 0xffff2 »

Nursie wrote: post #113
Shivetya wrote: post #49

Earlier quoted context omitted.

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retaile…

How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.

Re: Is your chip card secure? Much depends on where you bank

#120

Post by alistairSH »

tialaramex wrote: post #88
tomatocracy wrote: post #70

Earlier quoted context omitted.

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable com…

This is called "Liability shift" yes. Shift is imposed where a retailer cannot/ does not accept chip cards rather than where for whatever reason a chip card wasn't able to be used. In the US shift was supposed to be imposed everywhere left this summer, I expect COVID-19 is offered as another reason to yet again delay, but retails stores are already covered, it's mostly things like some unattended 24 hour gasoline pum…

Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead.

Or, in the case of unmonitored "kiosks", the American is just left with a failed transaction. This was my experience with train ticket terminals in Italy and unattended petrol stations in the UK. Fortunately, in both cases, my secondary card has a PIN enabled. It was irritating that my primary card didn't offer a PIN, so I cancelled it upon my return to the US.

Edit - this was 5 years ago, may have changed since, not sure as I changed cards to one that explicitly offered chip/pin at the time.

Post reply on HN