191–200 of 360 posts
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
This is Japan we are talking about - a place where many people still rely on fax machines.
Earlier quoted context omitted.
I think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously,…
There would be huge room for impersonation fraud even with a government run PKI. Hackers would steal private keys from individuals and businesses using the same malware and phishing attacks that they use today for stealing credit card numbers.
Whereas the whole point of a public key system is that nobody needs your private key. So we don't need to provide individuals and businesses with a way to give their private key to somebody else. The only reason you'd give your private key to somebody else is because you want them to seamlessly impersonate you forever, so there's no need to make it any easier than, for example, giving your kidney to somebody else.
Concrete example: A WebAuthn/ U2F "Security Key" offers no way to get the Private Keys out. If you want to "steal" the credentials used to get into my GitHub your best bet is to somehow trick me into physically packaging up the USB authenticator itself and sending that to you by FedEx or something. Or maybe you could try putting a knife to my throat or something?
Earlier quoted context omitted.
I’m honestly surprised the move to contactless hasn’t occurred faster, as the costs for hardware seem lower for nfc versus chip.
It only hasn't moved in the US. In Australia, nearly all CC transactions are contactless, with the floor limit at AUD100 (USD70). During the pandemic, I haven't used cash for the last 6 months.
Earlier quoted context omitted.
Virtually every country other than the United States uses a cryptographic NFC and/or chip and pin system for in-person credit/debit transactions. In most countries, the card number is only used for online and phone transactions. There's probably no way to do better than this without abandoning cards entirely in favor of some kind of device (or app) that has enough of a user interface to do a human-readable challenge…
the us has had nfc and chip for years. we still support swiping too. your statement was true for a few short years when europe did chip first. which was much easier there, since credit cards were not as common, and didn't exist since 1950 like in america. we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can…
The rest of the world reached that point around 15 years ago, including countries with high credit card use (UK, France) and high debit card use (Northern Europe).
Earlier quoted context omitted.
the us has had nfc and chip for years. we still support swiping too. your statement was true for a few short years when europe did chip first. which was much easier there, since credit cards were not as common, and didn't exist since 1950 like in america. we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can…
Technically true, yet POS support for chip transactions is still a bit less widespread, no?
I think it's just not widely known about/common usage in the US even though the infrastructure seems to be widely there.
Earlier quoted context omitted.
Why don’t we teach schoolchildren the NATO phonetic alphabet? Seems like it wouldn’t take that long, and it would be a useful skill for their whole life.
We should. There are so many adults who think it's cute to make up their own phonetics not realizing the whole purpose is to reduce ambiguity, not make it fun to spell things aloud.
Earlier quoted context omitted.
Virtually every country other than the United States uses a cryptographic NFC and/or chip and pin system for in-person credit/debit transactions. In most countries, the card number is only used for online and phone transactions. There's probably no way to do better than this without abandoning cards entirely in favor of some kind of device (or app) that has enough of a user interface to do a human-readable challenge…
the us has had nfc and chip for years. we still support swiping too. your statement was true for a few short years when europe did chip first. which was much easier there, since credit cards were not as common, and didn't exist since 1950 like in america. we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can…
Earlier quoted context omitted.
then those merchants should use the widely popular 3d secure system, which lets you enter a pin. by using it, they are protected from reversals by the terms of service. so a system that prevents them losing a gazillion dollars is available, and they opt to instead lose the gazillion dollars. it's their fault, and they should lose that money. we don't need to tell them anything -we just need to point and laugh.
And then see customers complaining about the annoying extra steps. 3D Secure affects conversion rates adversely which means customers are generally happier without it and don't mind the fraud risk (as is consistent with the rest of this discussion on the thread).
Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…
Something not clear from the article: The tech already supports longer numbers. Diners, Discover, UnionPay cards already allow up to 19 digits officially. The problem could be in the custom forms which think 4x4 is the right format, but the back-end should "just work" with them. What I really don't understand is why the article makes it seem like a national problem given the prefix is assigned to the companies, rathe…
19 instead of 16? That's better but seems too little for the long run.