Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

141–150 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#141

Post by quickthrowman »

tialaramex wrote: post #99
hocuspocus wrote: post #42

Earlier quoted context omitted.

European customers aren't liable for fraudulent charges either, I don't really understand your logic here. Everyone pays the price of fraud and it's probably one major reason that explains high interchange fees in the US.

No, US interchange fees pay for "reward" cards. You charge everybody 5% extra, you give Karen 5% cashback, she thinks you're "rewarding" her and everybody else get screwed, the payment network keeps the difference. The EU caps the interchange fee, does that mean the networks exit the business because they can't make money? No. Does it mean they've eliminated fraud? No. But it does mean they can't pay Karen 5% "reward…

I can assure you they use part of the interchange fee to cover fraudulent transactions or they offload the risk via insurance covering fraudulent transactions. There’s no way the issuing banks or Visa/MC just eat the fraud charges, we all pay for it.

Yes, rewards cards are paid for with interchange fees, but that doesn’t mean that’s the only thing they pay for. Most people pay more interest than they earn in fees per year anyways shrug

Re: Is your chip card secure? Much depends on where you bank

#142

Post by Mandatum »

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in business - or just use cash).

My guess is lobbying by insurance and reinsurance drove most of that conversation, because the only downside I've seen from chip & pin implementation is that you have to touch the terminal. Paywave and contactless are now mainstream, so this is a non-issue.

Re: Is your chip card secure? Much depends on where you bank

#143

Post by 0xffff2 »

tialaramex wrote: post #134
0xffff2 wrote: post #119

Earlier quoted context omitted.

How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.

They're kind of half-arsed. So far as it's possible to tell, nobody who knew anything about UX or digital security was anywhere close to these projects. So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago) If an online retailer performs Authorisation the API they talk to will…

Ah, actually that sounds pretty much exactly the same, except I've only ever been redirected once or twice. I think the only difference is that I didn't realize that it would eventually force you to sign up.

Re: Is your chip card secure? Much depends on where you bank

#144

Post by llsf »

kergonath wrote: post #101
llsf wrote: post #82

Earlier quoted context omitted.

That is the thing that it took me a while to understand once arriving in US from Europe. In Europe I did not care the least if someone managed to hack my credit card. The bank is liable. The bank is responsible to make as secure as possible. That is probably why we had credit card with chip & pin since the 80's. Banks had incentive to reduce the fraud as they could not easily pass it to the customers. But when I arri…

Coming from a country where your address and social security number are basically publicly-available information (so of course neither are used for anything sensitive), it took me some time to understand the fuss Americans tend to make about SSNs...

Yes, when I arrived my coworker gave me an orientation and highly suggest buy a paper shredder ?!? Why? I have never had a paper shredder before. I saw some at the lab I was working in Europe, but it made sense there (pre-2000 we use to print listing a lot). Yes, Social Security number is another oddness, with the credit score too :)

Re: Is your chip card secure? Much depends on where you bank

#145

Post by realusername »

the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

I don't get it as well, I've never seen magstripe being used in person, this technology has been retired since the 90s in France at least. Magstripe tech sounds kind of VHS to me.

Re: Is your chip card secure? Much depends on where you bank

#146

Post by toast0 »

jermaustin1 wrote: post #58
the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

What is crazier still, is I wasn't even sent a chip & pin from my bank until just last year. At least they did everything all at once, chip and contactless. But I'm still waiting for Capital One to send me a contactless card (its my preferred card to use internationally where contactless seems to be the standard).

> At least they did everything all at once, chip and contactless.

I got contactless cards about 10ish years ago, then when those renewed, it was back to stripe (and embossed) only; then chip and stripe and embossed; then chip and stripe but mostly flat; now this year I'm getting chip and stripe and contactless and apparently only Amex is embossing for carbon copy imprinters.

Re: Is your chip card secure? Much depends on where you bank

#147

Post by reaperducer »

Mandatum wrote: post #142
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

upgrading the terminal is expensive

It's not the terminal upgrade that's the barrier. At many businesses, if you upgrade the terminal you also have to replace the point-of-sale system. Then you have to integrate it with your existing backend sales system, fulfillment system, inventory system, and more. And you're lucky if all of that can then be integrated into your accounting system. Then you have to retrain all of the people who will ever touch any part of the entire process.

You see it as upgrading the terminal because that's all you see. But that is the very small tip of a very large iceberg.

Re: Is your chip card secure? Much depends on where you bank

#148

Post by AnssiH »

0xffff2 wrote: post #119
Nursie wrote: post #113

Earlier quoted context omitted.

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retaile…

How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.

Here in Finland Verified By VISA and Mastercard 3D Secure will just present the same 2-factor bank authentication you already use for your non-card online payments and bank transfers. There are no separate credentials or sign-up steps.

Practically all domestic online retailers here have used those over 10 years now, and AFAIK there is no opt-out (at least for regular bank-issued consumer VISA/MC cards).

Re: Is your chip card secure? Much depends on where you bank

#149

Post by reaperducer »

0xffff2 wrote: post #118
joncrane wrote: post #62

Earlier quoted context omitted.

You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.

I travel a decent amount in the Western US, mostly in California and Oregon. I have never once encountered this.

I've seen it in Arizona, Nevada, and New Mexico. California should get on board.

Re: Is your chip card secure? Much depends on where you bank

#150

Post by reaperducer »

the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

Why is it such an inferior experience compared to Europe?

Legacy hardware.

Europe was late to the credit card game, so when it finally got on board it had newer gear. The Americans already had their stuff in place and it worked.

Unlike computer nerds who will upgrade their computers just to feel current, businesses don't throw around money unless they have a very good reason.

Post reply on HN