Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Swiping left on magnetic stripes

mastercard.com

Post reply on HN
Print view View original

311–320 of 325 posts

Re: Swiping left on magnetic stripes

#311

Post by EvanAnderson »

Animats wrote: post #206
drclau wrote: post #12

Why does it take so long? Where’s the bottleneck? Where I lived over the last years (two countries in Europe), I don’t even have to use the physical card. I just use contactless payments with the phone. Prior to that, it was contactless with card. Even ATMs work with contactless (not all, yet). Prior to that, it was chip. I honestly don’t even recall the time when the magnetic stripe was needed. (edit) Think of this:…

Where’s the bottleneck? Gas stations. The gas station industry has been avoiding upgrading pumps. It's expensive. Retail checkouts usually just need a replacement of the desktop unit, but gas pumps require actual modification. They got a 3-year delay, until October 2020. Then April 17, 2021. Then they got hit by the coronavirus epidemic. The upgrade has to be done by a qualified installer; you don't want someone who…

The fuel dispenser industry, from an IT perspective, is a racket. My family owns a small independent gas station and recently did a POS replacement. The proprietary protocols for communicating to dispensers and controllers makes for crazy vendor lock-in and ridiculous installation fees, hardware prices, and ongoing support fees.

Re: Swiping left on magnetic stripes

#312

Post by metafunctor »

My MasterCard even has the raised numbers, and an unfilled spot for my signature. I remember a long time ago, some places still used a manual contraption to impress the digits on carbon copy paper. I wonder why they've retained that unused ability for decades.

Not that it matters much. I've made payments with almost 100% Apple Pay for years — a lot of the time I don't even carry the physical card with me.

Re: Swiping left on magnetic stripes

#313

Post by wrboyce »

asdff wrote: post #174
wrboyce wrote: post #151

Earlier quoted context omitted.

In the UK (and most of Europe afaik) the card is ejected immediately before the cash; the ejecting of the card indicates your authenticated session has ended.

There are some in the U.S. that do this, but it still didn't stop my friend from leaving his card in the ATM and having to go through a process with the bank and wait for a new card to show. Better to just make sure you have it by stopping you from doing anything else until you have it imo.

To drive the point home: you can’t have your cash until you have taken the card… I really do feel this is better in every way.

Re: Swiping left on magnetic stripes

#314

Post by 8fingerlouie »

kook_throwaway wrote: post #288
jacobr wrote: post #251

Earlier quoted context omitted.

It only knows your location when you open the app, why is that a problem?

I assume they will require an account of some sort, and their DB will inevitably be breached to leak it who knows where. It knows more about me than my location. Probably. I don't know what all the proprietary software running on my portable sensor suite does or knows. And almost without fail corporate one-off apps are bloated piles of contracted out and barely maintained garbage taking up too much space when a coupl…

They require an account yes, but don’t kid yourself, every time you use a credit card to purchase something, your habits are being tracked by the merchant, using your very identifiable card number.

As for garbage apps, the one I use is well maintained, 53.7 MB binary, so not much on the side of tracking considering it contains ALL of their gas stations with pump details, paid parking lots and car washes. I had to check if it actually used an account, because I don’t remember ever signing in to it.

So good apps do exist.

Re: Swiping left on magnetic stripes

#315

Post by supertrope »

lotsofpulp wrote: post #232
irrational wrote: post #212

Earlier quoted context omitted.

Also some retail places. Home Depot is a huge retailer in the USA, but they will not accept contactless payments. I assume it has something to do with having to pay a higher percent per transaction.

Contactless is not more expensive per transaction.

Initially only “credit” networks like Visa/MC supported tap to pay with interchange fees of 1 to 2.5%. The low fee debit networks did not. Regulated debit is as cheap as 21c + 0.05%. A lot of retailers have thin profit margins of 5%. So contactless adoption would mean more high interchange “credit” transactions and fewer low interchange debit transactions. Thus the retailer resistance to contactless.

Re: Swiping left on magnetic stripes

#316

Post by scoopertrooper »

barsonme wrote: post #199
scoopertrooper wrote: post #172

Earlier quoted context omitted.

At least in Australia the magnetic stripe is already gone for all intents and purposes. I can't remember the last time I used it. The American schedule may be a little aggressive though, you guys still use cheques extensively.

Define extensively. Anybody who pays with checks in situations where credit cards or cash can be used is gonna get funny looks, unless they’re a little old lady.

The difference is that in Australia literally zero retail businesses will ever accept a cheque under any circumstance and all government payments are made using electronic transfers. I haven't been issued a cheque book from my bank in over decade and I've maybe cashed 3 in my 30+ years alive.

I actually can't think of a single place outside of a bank where you can use a cheque and even then it's a challenge to actually exchange it for cash. Most banks in Australia have trouble coming up with $10,000 - even busy branches in the CBD of a major city.

Now, granted I haven't been to America, but I do read things on the internet. From what I understand, your financial system is held together by a system of pneumatic tubes passing cheques around, though I hear there is some experiment with telegram machines.

Re: Swiping left on magnetic stripes

#317

Post by ohazi »

yarcob wrote: post #261
ohazi wrote: post #119

Earlier quoted context omitted.

From the card companies' perspective, the alternative to magstripe isn't contactless, it's contact (the smart card IC embedded in the physical card). In the US, the card companies convinced merchants to adopt the EMV contact standard by implementing a liability shift that would make the merchants liable for card-present magstripe fraud after a certain date. For merchants using POS terminals, the liability shift happe…

Contactless is not less secure than magstripe. I don't know where you got that from. You can't make a fake contactless card, because each card has a private key that you can't extract. But it's trivial to make a fake magnetic stripe card. One type of fraud with EU credit cards works like this: Criminal collects credit card numbers and pins by adding a hidden magnetic stripe reader to an ATM and a video camera, then c…

You're correct that you can't easily clone an NFC card from RF interactions alone, but beyond that just about every other aspect of these cards is worse.

Most contactless cards can be asked to transmit the cardholder's name, credit card number, and expiration date, and the card will happily do so, wirelessly. This is often enough to make fraudulent online transactions.

It's trivially easy to build a device that does this using a microcontroller and a coil of wire. You don't need to have a payment processor's encryption key, you can just make one up and the card will reply. You can walk around in a crowded area with such a device and capture responses from hundreds of cards in under an hour.

Electronic devices that clone your contactless card are usually better, as they generally require some sort of interaction before they'll respond -- actual physical contactless cards might as well be a megaphone attached to your credit card number.

If you can capture a genuine transaction between a POS terminal and a contactless card, and if the transaction amount is below the card's floor limit, the transaction can often be replayed or relayed to a different terminal.

With a cheap amplifier, this can be done reliably from low single digit ft away. The floor limit is usually somewhere around $20-$100 below which the terminal doesn't ask for a PIN or go online.

Re: Swiping left on magnetic stripes

#318

Post by ohazi »

bjowen wrote: post #273
ohazi wrote: post #119

Earlier quoted context omitted.

From the card companies' perspective, the alternative to magstripe isn't contactless, it's contact (the smart card IC embedded in the physical card). In the US, the card companies convinced merchants to adopt the EMV contact standard by implementing a liability shift that would make the merchants liable for card-present magstripe fraud after a certain date. For merchants using POS terminals, the liability shift happe…

Eh? No, it’s part of the EMV standard and uses the same triple-DES crypto. There have been contactless implementations with poor security, including some truly weird contactless-mag stripe devices, but they are not the current standard or widespread in most markets.

I said baseline standard. EMV contact is the baseline standard. EMV contactless is optional.

If you want to issue a new card today, it must have a chip, but it doesn't need to have contactless. There are currently no (public) plans to change this.

Re: Swiping left on magnetic stripes

#319

Post by hvidgaard »

watermelon0 wrote: post #182
chousuke wrote: post #131

Earlier quoted context omitted.

Living in Europe, I genuinely had no idea cards with magnetic stripes were still in use. I thought everything used chips nowadays. I still prefer my card for contactless payments though; using my phone is not really much more convenient since my phone case holds the card anyway and it at least works consistently.

It's more convenient if you need to pay more than 25 EUR (or whatever the limit is where you live), where you need to use your PIN with contactless card.

Mag strip or chip, you still need your pin here. With contactless there is a limit of 50-100 EUR, and when you use Apple Pay you never have to provide a pin.

Re: Swiping left on magnetic stripes

#320

Post by yarcob »

ohazi wrote: post #317
yarcob wrote: post #261

Earlier quoted context omitted.

Contactless is not less secure than magstripe. I don't know where you got that from. You can't make a fake contactless card, because each card has a private key that you can't extract. But it's trivial to make a fake magnetic stripe card. One type of fraud with EU credit cards works like this: Criminal collects credit card numbers and pins by adding a hidden magnetic stripe reader to an ATM and a video camera, then c…

You're correct that you can't easily clone an NFC card from RF interactions alone, but beyond that just about every other aspect of these cards is worse. Most contactless cards can be asked to transmit the cardholder's name, credit card number, and expiration date, and the card will happily do so, wirelessly. This is often enough to make fraudulent online transactions. It's trivially easy to build a device that does…

> You can't clone a NFC card from RF alone

You imply that it is possible to clone NFC cards with other means. Is that really possible? Crypto chips are usually hardened against all kinds of attacks, and I would assume that NFC cards are resistant to cloning even if you have physical access to the chip. I'd be curious to learn more about that if my assumption is incorrect.

Regarding replay attacks, do you have a source on that? I would assume that even offline POS terminals would use a nonce to prevent replay attacks. Is that assumption incorrect?

And finally, you can extract card holder name and card number from most cards just by looking at them. Claiming that NFC cards are somehow worse than mag stripe cards in that regard is just FUD.

Post reply on HN