Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

201–210 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#201

For all the people saying why not use chip and pin cards for all your payments, using cash is EXTREMELY common for day to day small purchases in NYC and doesn't seem to be going away any time soon.

Some people say NYC is like a separate nation, but that’s naive, it’s a separate planet.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#202

Earlier quoted context omitted.

I'd love to see what happens if I eat a meal, then say, "Sorry, I only have cash." They can be mad about it, but I don't think I'm breaking any laws by not having their preferred payment method to pay that debt, right? They can even ban me from the restaurant but—for that meal—I can't get charged with theft of services (or whatever the innkeeper laws are that relate to this situation)

Might depend on if there was clear notification before ordering your meal that they don't accept cash. In that case, you've incurred a debt that you knew you would be unable to pay. That might be some sort of fraud but it probably varies by jurisdiction.

They must either take the cash or forgive the debt, no matter what the sign says. If they don't want cash they shouldn't have served you food until they got their preferred payment method, in which case you could just walk out without having eaten and owe them nothing. Since they decided to serve you, then you now owe them money, which you must be allowed to pay back in cash with US currency. This rule is written on the face of the currency itself.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#203
post #153
post #53

Earlier quoted context omitted.

I’ve had an Apple Wallet since they came out and never had any cards lose their magnetic strip. Same with my wife.

Yeah, OP clarified he was using another brands wallet lol. Weird to dunk on Apple implying they under engineer their products. Engineering and (probably) precision manufacturing some magnetic shield is exactly the kind of thing Apple would do. From [0]: According to Apple's site, "the leather wallet is shielded so it’s safe for credit cards." That shield protects both Low Coercivity (LoCo) and High Coercivity (HiCo)…

Sorry if I wasn’t clear, but I’m saying that it’s easy when handling the small removable wallet to accidentally touch the non-shielded side of the wallet. Both my Popwallet and the Apple wallet have essentially the same design. A shielded pouch for credit cards, and a magnetic backing that attaches to the phone. The magnetic back cannot be shielded on the side that attaches to the phone, or it wouldn’t attach to the phone. The problem is not insufficient shielding on the inside of the wallet, the problem is the way apple designed the system. Apple designed a small removable wallet with magnets on one exterior face of the thing. When handling the magnetic wallet I’ve found myself accidentally touching my card to the unshielded side of the wallet. I think the way apple designed it, their solution is “don’t do that”, but it’s very easy to do.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#204
post #151
post #57

I've always wondered about how modern contactless methods are more resistant to skimming. Couldn't someone compromise two machines and essentially MITM the NFC communcations, intercepting the card's response from the first machine, and replaying it against another remote machine, along with the PIN recorded from a camera? Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with…

The magnetic stripe is just data. NFC is a handshake: the chip is a tiny MCU. There is still a root of trust required to prevent MITM, but the device would need to be compromised. This is why keys and certificate chains are stored in secure memory that is resistent to side channel, and even physical attack (it breaks easily and the die can't be shaved down).

“A tiny MCU” in this case means Microcontroller Unit, not Marvel Cinematic Universe. Don’t expect to find Antman running around on your chip preventing fraud.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#205

Earlier quoted context omitted.

Even EMV contactless is designed to work offline. There's no need for the mag stripe at all anymore unless you encounter a truly ancient card terminal. The last time I remember encountering one was at a toll booth in Italy around 2011 or so. And the transaction was immediately declined by my UK bank!

I've always wondered: What happens if I use a paused/canceled card on a plane? Do I just get the item for free?

Yep, like this person who used that method to steal £25,000 worth of goods from airlines: https://www.manchestereveningnews.co.uk/news/greater-manches...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#206
post #81
post #59

Earlier quoted context omitted.

With just about everything either chip or tap now, is there any danger in just scratching out the mag stripe of my cards?

The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.

I’ve had the readers at Home Depot occasionally fail to read my chip card. The last time it happened an employee told me that the readers were designed for slightly thicker cards than some banks are using and so don’t always make contact but if you lightly press down on the exposed end after you insert it that lifts the chip end up enough to be read.

I’ve had no problems with their readers since I started doing that.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#207

Earlier quoted context omitted.

So your point about Apple, is in fact, not about Apple at all. Cool.

I’m mostly having fun, but Apple’s official wallet also has magnets on the back. The point is apple designed a system where a small removable wallet needs to be handled with your cards. That’s apple’s system design. And I suspect that you would encounter the same issue with Apple’s official wallet. Just like my Popwallet apple says the inside of the wallet is shielded. But the outside cannot be shielded as it has to…

> The problem is with the system apple designed

Is it? Numerous people up and down this thread who do use the official one have told you they've not experienced it, so I'm not sure your assumption holds.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#208

Earlier quoted context omitted.

I've always wondered: What happens if I use a paused/canceled card on a plane? Do I just get the item for free?

Yep, like this person who used that method to steal £25,000 worth of goods from airlines: https://www.manchestereveningnews.co.uk/news/greater-manches...

Oh wow, that's taking things to another level.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#209
post #24
post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

I love using cash. Sometimes I don't when my local ATM is down (which seems to happen so often...), but when I can it feels much better to me. No digital records, no potential for this type of skimmer or other scam, don't have to give up my ATM pin, no worrying about my phone running out of charge, able to give it away freely to anyone in need without setting up a digital transfer, the old taco truck still only takes…

> Already there are a (small) number of modern restaurants that don't accept cash in my area.

Wow. This year in my area, a lot of the restaurants started charging 3% extra if you DON'T use cash.

And generally, in my state of Montana, there are still restaurants that won't accept credit cards at all.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#210
post #168

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in…

Snark about Apple's shortsightedness tends to land better when you're not literally lying about using their product.

The problem is with the system Apple designed. They have a small removable wallet with magnets on the back. While I’m using a Popwallet brand wallet with my iPhone, the way it is designed I don’t think the official wallet would be any different. It has to have one side with exposed magnets per Apple’s design, and when handling the removable wallet I’ve found myself accidentally touching the magnetic side with my card. I genuinely don’t think it would be different with the official wallet.
Post reply on HN