Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

231–240 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#231

Post by josh2600 »

gcanyon wrote: post #226

The article suggests using the contactless sensor, but how is that not another potential "skimmer" device?

Contactless checkout has a different security scope for card issuers. Magstripe + Pin is reusable, contactless auth has protections that bind the key exchange to that specific merchant and multiple pay auth attempts from a merchant get throttled.

I haven't looked into it, but I would guess that there's a key exchange with the reader that binds the contactless payment to that reader in such a way that the card produces a signed unique identity that proves it is the card without leaking the actual card numbers to the reader. Just a guess, but that's how I would want to build something like this. You don't have that much room on a chip but way more than a magstripe. (Security pattern: something you have that is time/merchant delimited)

I believe that in magstripe they just have a strip magnetized to produce some digits + your pin (Security pattern: something you know + something you have).

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#232

Post by Loocid »

dleslie wrote: post #122
willhackett wrote: post #34

I think the magnetic strip needs to go. We hardly use them in Australia to the point where one of our major banks actually has a touch reader on their machine. Some sort of one-time verification would be great. An SMS or a push notification would go a long way to making this type of scraping harder. Or eliminate the card altogether - Cardless Cash.

I have no idea why, but chip cards always fail on me within six months of receiving a new one. Been this way for years.

Personally I've never had a chip fail.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#233

Post by MBCook »

emkoemko wrote: post #211

who is still using these old card? don't they expire? i mean its been like more then 10 years since we all switched to chipped cards i don't even know any place that has a strip reader or any bank that has them even enabled, i mean whats the point of adding a chip for security if your still allow strip readers...

Absolutely everywhere in the US has them. They exist for two purposes: first they’re used for fall back if there’s a problem with the EMV chip. Second I’m not aware of any gift cards (except perhaps prepaid debit cards) that have EMV chips. So if you buy a $20 gift card to Home Depot for someone that’s going to be magstripe.

Honestly I didn’t start seeing EMV/contactless available on gas pumps until about 18 months ago.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#234

Post by ruined »

TaylorAlexander wrote: post #210
ynx wrote: post #168

Earlier quoted context omitted.

Snark about Apple's shortsightedness tends to land better when you're not literally lying about using their product.

The problem is with the system Apple designed. They have a small removable wallet with magnets on the back. While I’m using a Popwallet brand wallet with my iPhone, the way it is designed I don’t think the official wallet would be any different. It has to have one side with exposed magnets per Apple’s design, and when handling the removable wallet I’ve found myself accidentally touching the magnetic side with my card…

dont let the haters get you down

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#235

Post by josh2600 »

jmharvey wrote: post #80
tialaramex wrote: post #44

Earlier quoted context omitted.

As the article says, some smaller outfits still use card stripe data. The impetus to get retailers to start using the chip was "Liability shift". The payment networks gradually changed the rules (I think in the US pay-at-pump gasoline purchases were last to get this, while big retail stores were earlier) so that the liability if a transaction is latterly discovered to be fraudulent is with the retailer who accepted t…

In my experience, the mom and pop outfits usually have a reasonably modern system from verifone/square/etc that accepts tap to pay; it's the giant behemoths (e.g. USPS or Lowe's) where I'm more likely to encounter antiquated payment tech.

Never underestimate the length of an Enterprise purchasing cycle.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#236

Post by MBCook »

grishka wrote: post #136
quickthrower2 wrote: post #109

Hopefully we can go contactless on ATMs. Seems antiquated to insert a card.

Wait, there are still places in the developed world where there are no contactless ATMs?

Ha. Honestly I’m having a blast at all the reactions from Europeans (and others) in this thread.

The large local bank in my city doesn’t support it. Their ATMs only started using EMV as few years ago. I’ve seen contactless on national chain bank ATMs once or twice but I don’t think it worked for me for some reason.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#237

Post by Nextgrid »

mbreese wrote: post #105
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Originally I was thinking they could handle an open tab like a gas station — place a hold on the card for $X for an open tab. But then, the more I thought about it, I’m not sure I want to be the bartender that has to explain why there was a hold of $100 on a college kid’s debit card. Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok! There’s got to be a better way…

> Sorry you can’t buy lunch, but the hold will get released in a few days, so it’s ok!

I've bought gas in France with a Monzo card and the pump was able to hold and release money immediately - ~150EUR hold initially, as soon as I put the pump down it adjusted to the real amount.

Seems like the tech to make this happen does exist, it's just a matter of not using a shitty bank.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#238

Post by MBCook »

emkoemko wrote: post #215
fortran77 wrote: post #123

Since cards have relatively recently gone to not having embossed numbers, the card slots are now probably just a little bit wider than most new cards, allowing a device like this to fit.

not here cards still have embossed numbers

Depends on the card in the US. One card I got very recently had them, one card I got very recently didn’t.

Since they don’t serve a purpose anymore since absolutely no one uses the old carbon copy system… I’m a little surprised they lasted this long.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#239

Post by brewdad »

Mountain_Skies wrote: post #154
roguesherlock wrote: post #125

Do people not get any messages when they make any transactions? In my county you literally get messages for every transaction. And you also have to add in otp for every transaction online.

That's opt-in but I think every credit card company in the US offers to alert you by SMS or app notification when a transaction has been made. I have that setup for my cards but it is annoying each month when the internet bill hits my card because they do their processing at 3am.

iOS Do Not Disturb mode from 10pm-7am changed my life. I used to hate getting those 3am notifications on my Android.

Most of my cards offer an email notification option rather than SMS or in-app. Much less intrusive.

Post reply on HN