Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

221–230 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#221

Post by MBCook »

_carbyau_ wrote: post #118
seanp2k2 wrote: post #25

Is anyone else annoyed that: - We could have had chip & PIN, but for some reason (I'm guessing it's to do with how merchants take the hit for card fraud and VISA + MC think having to punch in a few numbers each sale will lead to fewer sales) - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? - Chip transactions take way longer…

> - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? I have no issues with the icon for tap. Although they do seem to rub off and I wonder if they are meant to have an accessible braille pattern. My dislike is tapping the screen, because then you block the visual feedback mechanism that lets you know whether it worked.

That’s what the tone is for.

I have OP’s problem too. When there’s an icon it’s easy, but some terminals (older ones?) don’t have the icon anywhere but support the functionality so you just have to sort of try to figure out where it is.

It can also be a problem on small terminals. The bigger ones have plenty of room, but sometimes the small ones put it awkwardly on the back where you would never look for it.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#222

Post by tzs »

toast0 wrote: post #128
seanp2k2 wrote: post #25

Is anyone else annoyed that: - We could have had chip & PIN, but for some reason (I'm guessing it's to do with how merchants take the hit for card fraud and VISA + MC think having to punch in a few numbers each sale will lead to fewer sales) - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? - Chip transactions take way longer…

How am I supposed to remember good PINs for the tenish payment cards in my wallet without writing them down (probably on the card itself), setting them all to the same thing, or setting them to poor choices?

Setting them all to the same is probably not unreasonable.

You could also do something like set the PIN for a given card to the security code backwards or to the last two digits of the account number concatenated with the first two digits of the security code.

Either of those should be fine under the threat models applicable to most HN readers.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#223

Post by iudqnolq »

_carbyau_ wrote: post #118
seanp2k2 wrote: post #25

Is anyone else annoyed that: - We could have had chip & PIN, but for some reason (I'm guessing it's to do with how merchants take the hit for card fraud and VISA + MC think having to punch in a few numbers each sale will lead to fewer sales) - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? - Chip transactions take way longer…

> - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? I have no issues with the icon for tap. Although they do seem to rub off and I wonder if they are meant to have an accessible braille pattern. My dislike is tapping the screen, because then you block the visual feedback mechanism that lets you know whether it worked.

Maybe you only go to stores that happen to use a specific brand of reader? About a third of the machines I tap on place the sensor somewhere different from the icon, and the staff just continually tell people to tap some other hidden location like a specific corner or the bottom middle of the screen. (Colorodo and California)

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#224

Post by MBCook »

gpt5 wrote: post #30
seanp2k2 wrote: post #25

Is anyone else annoyed that: - We could have had chip & PIN, but for some reason (I'm guessing it's to do with how merchants take the hit for card fraud and VISA + MC think having to punch in a few numbers each sale will lead to fewer sales) - Those tap targets on CC readers sometimes aren't where the antenna is, and you have to rub your card all over the reader to get it to work? - Chip transactions take way longer…

Contactless transactions using your phone are fast, secure and easy. Over time they will replace almost all current usage of chip & pin or magnetic stripe.

You may think that, but get an Apple Watch or other smart watch that can do it. 10x better than the phone was. Don’t need to get anything out of your pocket or even carry the phone in the first place.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#225

Post by ilaksh »

naet wrote: post #27
ilaksh wrote: post #3

ATMs, ATM cards, banks and fiat currency are all obsolescent technologies.

Curious what you use if you don't use an ATM, ATM card, a bank, or fiat currency? People like to use this type of rhetoric around crypto and crypto-maximalism, but you absolutely cannot function day to day using purely crypto at this point in time.

That's why I used the word "obsolescent" rather than "obsolete".

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#227

Post by gtirloni »

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card.

Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story.

Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular?

Everywhere I go in South America and Europe, businesses have portable readers. The card companies just sent them new readers and they were accepting chips overnight. Same when NFC was introduced.

The US payment and banking systems are truly maddening.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#228

Post by devman0 »

gcanyon wrote: post #226

The article suggests using the contactless sensor, but how is that not another potential "skimmer" device?

Contactless uses a cryptographic operation to secure the transaction, both reader and chip are active participants. Compare with magstripes which are passively read and thus trivially subject to replay attacks.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#229

Post by MBCook »

quickthrower2 wrote: post #114
btown wrote: post #57

I've always wondered about how modern contactless methods are more resistant to skimming. Couldn't someone compromise two machines and essentially MITM the NFC communcations, intercepting the card's response from the first machine, and replaying it against another remote machine, along with the PIN recorded from a camera? Though I suppose the ATM company could combat this by encoding the machine's ID or a nonce with…

Surely that’ll get you a one use token but not data good for repeat use? In addition you would have to send that to the network as a retailer yourself. So it would not be anonymous.

It’s completely useless. Because the terminal you’re using is involved in what gets signed, even if you replayed the data to a different but identical contactless terminal (say the next gas pump over) the signatures would fall apart and it wouldn’t work. The serial numbers and such are different.

Also there are transaction counters involved. So even if you could overcome that the processor would see that your card had two transactions with counter 268753 and reject the second. The terminal also has its own transactions counter mixed in too.

And even if you could overcome those I’m almost positive that timestamps are involved too. So even if you could replay the transaction to the same exact terminal and get around the transaction counter issue the time would be different and I think that would cause it to fail.

It really is a well designed system. It follows that software law that people can know absolutely everything about the process and it’s still secure as long as the private keys aren’t given away.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#230

Post by mindcrime »

Macha wrote: post #152
giantg2 wrote: post #81

Earlier quoted context omitted.

The small number of places with older swipe only terminals. Or when the chip isn't working (Lowes has a stripe reader on the register if the main terminal isn't working; mainly used for gift cards though). And finally, an alert employee might not accept a damaged card.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails.

As far as I'm concerned, chip cards can get stuffed. They're utter shit in my experience.

Post reply on HN