Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#161

Post by imtringued »

toolslive wrote: post #159

Hold on. PIN is not secure either. With the card reader, you can verify the pin locally: You don't need anything but the card and a card reader. No internet, no nothing. Since the verification can be done on the client side entirely it's subject to hacking. You can freeze the chip, slowing it down so you can actually see it run under a microscope. You can make it read-only (so the pin miss is not recorded on the chip…

Most credit card fraud happens by cloning an existing card because the victim will stay unaware of the crime. If you physically steal a card it will be frozen by its owner who will also pay close attention to suspicious transactions.

Re: Is your chip card secure? Much depends on where you bank

#162

Post by fomine3 »

Nursie wrote: post #113
Shivetya wrote: post #49

Earlier quoted context omitted.

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retaile…

Maybe it's not two "Factor" auth because ID/pass and card number is both knowledge of secret.

Re: Is your chip card secure? Much depends on where you bank

#163

Post by tomatocracy »

Symbiote wrote: post #123
tomatocracy wrote: post #70

Earlier quoted context omitted.

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable com…

I don't think disability requires using the magstripe. The chip can mark what security is required, just like many American cards are "Chip and Sign".

I don't know if this is still the case but I think some people with eg dementia or some rare memory disorders kept mag stripe cards (which they'd previously been issued with very long expiry dates) when chip and PIN was first introduced.

Re: Is your chip card secure? Much depends on where you bank

#164

Post by AniseAbyss »

Mandatum wrote: post #142
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

Thanks to COVID contactless payments in my country are at 60% now.

Re: Is your chip card secure? Much depends on where you bank

#165

Post by randompwd »

Mandatum wrote: post #142
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

> magstripe is the backup, but thoroughly validated option

Chip and pin is also used for offline transactions. Never once in Europe have i signed/seen someone sign https://www.emv-connection.com/emv-faq/#q9

Pin is verified on card,not over network.

Re: Is your chip card secure? Much depends on where you bank

#166

Post by Mandatum »

knolax wrote: post #158
ulfw wrote: post #155

Earlier quoted context omitted.

Weird how the whole globe managed that, from small city states over third world nations to old established countries. And yet...

A lot of the third world leapfrogged to mobile payments and never had widespread credit card adoption. So it's more like 4% of the world hasn't done a thing the 10% of the world that HN perceives as "rest of the world" has done.

Yeah, no. Europe and Asia-Pacific all adopted chip and pin just fine (minus China).

Re: Is your chip card secure? Much depends on where you bank

#167

Post by Mandatum »

reaperducer wrote: post #147
Mandatum wrote: post #142

Earlier quoted context omitted.

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

upgrading the terminal is expensive It's not the terminal upgrade that's the barrier. At many businesses, if you upgrade the terminal you also have to replace the point-of-sale system. Then you have to integrate it with your existing backend sales system, fulfillment system, inventory system, and more. And you're lucky if all of that can then be integrated into your accounting system. Then you have to retrain all of…

The interface of the terminal is usually decoupled, there are adapters built for terminals to retro-fit older systems.

Re: Is your chip card secure? Much depends on where you bank

#168

Post by Harvesterify »

randompwd wrote: post #165
Mandatum wrote: post #142

Earlier quoted context omitted.

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

> magstripe is the backup, but thoroughly validated option Chip and pin is also used for offline transactions. Never once in Europe have i signed/seen someone sign https://www.emv-connection.com/emv-faq/#q9 Pin is verified on card,not over network.

I used the signature last year in Germany, when the cashier stripped my card without asking first whether I wanted to pay using my PIN or the stripe.

Re: Is your chip card secure? Much depends on where you bank

#169

Post by bluntfang »

Dylan16807 wrote: post #152
bluntfang wrote: post #56

Earlier quoted context omitted.

I'm really not trying to be rude here, but a disposable plastic glove isn't a "cost nothing" scenario. Plastic pollution is bad. Climate change is real. Trash islands are real. Microplastics in the entire food chain is real. I admire your dedication to stay safe, and don't want you to stop feeling safe, but we must all begin to accept what we're doing to the environment.

Understandable, but the cost to produce a glove is still very minor. And the way you solve pollution and microplastics from items in the trash can is by making sure that trash from cans is handled appropriately. Not by having consumers reduce their trash by a few percent. The climate damage is the only thing where you can really put responsibility on the consumer, and that can be fixed with a well-directed fraction o…

>the cost to produce a glove is still very minor.

It's not about your individual glove. It's the 300million-ish people using 10 disposable gloves a day.

>And the way you solve pollution and microplastics from items in the trash can is by making sure that trash from cans is handled appropriately. Not by having consumers reduce their trash by a few percent.

How can you handle the level of trash we have responsibly? what's the plan? You seem to know, so please share it with the world so we can save the planet.

Re: Is your chip card secure? Much depends on where you bank

#170

Post by pc86 »

Spivak wrote: post #71
pc86 wrote: post #45

Earlier quoted context omitted.

> the fault isn't with the victim nor really with the perpetrator The perpetrator isn't at fault?

The perpetrator defrauded the bank, not you. The fault for your account not showing the correct balance should be on the bank.

That seems completely orthogonal to my question.
Post reply on HN