Is your chip card secure? Much depends on where you bank • Hacker News Board

Re: Is your chip card secure? Much depends on where you bank

#121

Post by specialist » Thu, Jul 30, 2020, 8:52 PM UTC

lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

How can noobs like me assess how good any given POS is?

Is there a rating system?

Any way to inspect transactions to see the whatnots?

Knowing nothing, I've been doing as much as possible using Apple Pay, because IIRC they do some kind of token exchange, vs sending my digits across the wire.

Re: Is your chip card secure? Much depends on where you bank

#122

Post by te_chris » Thu, Jul 30, 2020, 9:02 PM UTC

0xffff2 wrote: post #119

Nursie wrote: post #113

Earlier quoted context omitted.

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retaile…

How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.

You don’t sign up to anything, it’s with the issuing bank or provider.

Re: Is your chip card secure? Much depends on where you bank

#123

Post by Symbiote » Thu, Jul 30, 2020, 9:11 PM UTC

tomatocracy wrote: post #70

humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable com…

I don't think disability requires using the magstripe. The chip can mark what security is required, just like many American cards are "Chip and Sign".

Re: Is your chip card secure? Much depends on where you bank

#124

Post by ascorbic » Thu, Jul 30, 2020, 9:14 PM UTC

abrowne wrote: post #35

the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

My understanding for part of it is that magstip readers were much more common in the US, and businesses (a) didn't want to pay to upgrade all their terminals and (b) don't want to turn away a purchase because a customer doesn't have a chip or the chip isn't working.

Magstripe readers were ubiquitous in the UK 15 years ago. The banks started issuing chip and PIN cards and terminals, then did the liability shift a couple of years later. That shift is what's needed to make retailers switch, and is what still hasn't happened in the US.

Re: Is your chip card secure? Much depends on where you bank

#125

Post by Symbiote » Thu, Jul 30, 2020, 9:21 PM UTC

lotsofpulp wrote: post #93

bryanthompson wrote: post #73

Earlier quoted context omitted.

The liability shift in the US that affected most retailers occurred in October 2015 -- basically, merchants are and have been liable for fraud that occurs on swiped transactions. I'd be curious to find out how the example presented by the parent article could change this -- a valid-looking card that only has swipe would definitely be taken by a merchant for fraud, and if the card doesn't claim to be EMV-capable, it s…

Previous commenter and I were talking about chip and pin, not just chip (aka EMV). With EMV, someone can still use your card after they steal it. With chip and pin, that is far more difficult. I don’t know if merchant off the hook even with just chip, I presume the card networks kept some weasel language in order to allow them to blame the merchant.

EMV is the standard for the debit/credit cards with chips. It includes modes with PINs, signatures, and neither, depending on the configuration of the card (i.e. the bank) and the reader (i.e. the shop's bank/intermediary).

https://en.wikipedia.org/wiki/EMV

Re: Is your chip card secure? Much depends on where you bank

#126

Post by grishka » Thu, Jul 30, 2020, 10:04 PM UTC

Shivetya wrote: post #49

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

> Second is, is there a way to gain the safety of the chip and pin with online purchases.

Yes, there's this 2FA thing where you're redirected to your bank's website and you have to enter the code they send to your phone. I've had this for ages and I'm surprised there are still places where it's not mainstream.

Magstripes tho? I remember using mine when I visited the US in 2016 and that's about the only time when I used it. It was weird too, because most terminals had the chip slot but cashiers insisted that you swipe. The most bizarre part is that sometimes the transaction went through with just the swipe — no PIN, nothing.

Re: Is your chip card secure? Much depends on where you bank

#127

Post by jgalt212 » Thu, Jul 30, 2020, 10:26 PM UTC

Nursie wrote: post #114

jgalt212 wrote: post #94

Earlier quoted context omitted.

Mag stripes via fingerprinting of the actual stripe, can make make them more secure than EMV or contactless. Both the standard card data and the underlying magnetic fingerprint of the card is read, all in a single swipe. [1] [1] https://www.magtek.com/product/magnesafe-intellihead

That's still not really "more secure" than EMV, which includes active security measures like PIN validation capabilities, various active anti-fraud measures like offline velocity checks, transaction amounts encoded in cryptographic tokens, and which can in theory be remotely disabled etc. I guess it makes it "more /just as able to be authenticated as a genuine card" though.

Yes, I hear you. It would then come down to what's easier to do correctly, authenticate an EMV transaction or read and validate the fingerprint of a card's mag stripe.

To the best of my knowledge, I don't think anyone has been able to replicate a mag stripe's fingerprint on another card's mag stripe. However, this security measure has probably seen a few orders of magnitude less adversaries than EMV and RFID have.

Re: Is your chip card secure? Much depends on where you bank

#128

Post by Thlom » Thu, Jul 30, 2020, 10:26 PM UTC

Nursie wrote: post #112

woodruffw wrote: post #92

Earlier quoted context omitted.

> Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit". This isn't true with US payment cards, in my experience. I've charged over $1000 on a credit card multiple times while using contactless methods (both RFID and Apple Pay, specifically). I was also able to do the same with my (American) cards while in Europe.

Apple/Android pay is generally unlimited here in the UK, but using contactless cards is limited to £40, blanket. This is because contactless card payments have no cardholder verification. I am quite surprised if you can do that with your cards in Europe as the limit is usually enforced on/by the merchant, not the card.

Can tap-to-pay with no verification up to 500NOK (approximately $55), over that amount I have to type my pin. No limit with pin as far as I can tell.

Re: Is your chip card secure? Much depends on where you bank

#129

Post by kevin_thibedeau » Thu, Jul 30, 2020, 10:27 PM UTC

SAI_Peregrinus wrote: post #64

kevin_thibedeau wrote: post #31

Earlier quoted context omitted.

Won't work for gas stations which are the last holdouts.

The chain "Speedway" has chip card readers at their pumps, at least in my region (western NY).

The New York Speedways are all conversions from Mobil stations and they just upgraded their pumps. Few other stations are supporting chip cards.

Re: Is your chip card secure? Much depends on where you bank

#130

Post by Thlom » Thu, Jul 30, 2020, 10:32 PM UTC

SEJeff wrote: post #78

kevin_thibedeau wrote: post #31

Earlier quoted context omitted.

Won't work for gas stations which are the last holdouts.

Until EVs are more mainstream I guess, but that won't probably be for another 5-10 years.

Haha. A bit unrelated, not sure how it works in the rest of the world, but inNorway EV charging stations doesn’t even have a card reader, you have to sign up with an app and register your card there. And each charging company has their own app. Absolutely bonkers. You can get a chip for your key chain and tie it to all your apps so you can read that at the charging station, but still.