Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

251–260 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#251

Post by Mister_Snuggles »

bobsmooth wrote: post #244
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

It's because of tiny gas stations in the middle of nowhere.

Gas stations are interesting here.

Here in Alberta, it's the law that you need to pay before you pump[0]. If you're at a modern pump you insert your card, it does a preauth for some amount (you can select common amounts, like $20 of fuel, or "fill up" which is like $125 or $250 depending on the station), then when you're done it does a purchase for the exact amount.

If you're not at a modern pump, or you're paying cash, you have to go into the store, prepay for something that you think will fill your tank, fill your car, then go back into the store and get your change.

[0] https://calgary.ctvnews.ca/station-owners-and-gas-and-dash-v...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#252

Post by thematrixturtle »

Tijdreiziger wrote: post #69
willhackett wrote: post #34

I think the magnetic strip needs to go. We hardly use them in Australia to the point where one of our major banks actually has a touch reader on their machine. Some sort of one-time verification would be great. An SMS or a push notification would go a long way to making this type of scraping harder. Or eliminate the card altogether - Cardless Cash.

> I think the magnetic strip needs to go. Absolutely. Here in the Netherlands, magstripe payments are disabled by default. Only if you’re travelling outside Europe do you need to enable them manually (through your bank’s app or website).

Magstripe is long dead throughout Asia as well. The US (as always) has been behind the curve on this, but contactless became pretty ubiquitous during COVID.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#253

Post by dymk »

bobsmooth wrote: post #244
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

It's because of tiny gas stations in the middle of nowhere.

USPS delivers to them, guaranteed

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#254

Post by Semaphor »

mindcrime wrote: post #230
Macha wrote: post #152

Earlier quoted context omitted.

I've seen a few people in the US mention "when the chip isn't working". I don't think I've encountered this... ever? Of course, when the merchant's only alternative is handling cash, maybe there's more incentive to keep the card machine in order

At best I've found chip reading to work about 60% of the time across a range of local merchants here. And now the debit card I have, which is less than a year old, has a chip which has completely quit working. Making it totally useless for the (thankfully small) number of merchants whose POS systems won't let you fall back to mag-stripe when the chip fails. As far as I'm concerned, chip cards can get stuffed. They're…

That sounds like you are somehow mistreating them, or your local merchants use "special" terminals (or maybe your bank is just using crappy materials). I can’t even remember how long ago it was that swiping worked, but chips have never broken until I cut them for the replacement card, this is over 3 different banks.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#255

Post by dleslie »

LeonB wrote: post #200
dleslie wrote: post #122

Earlier quoted context omitted.

I have no idea why, but chip cards always fail on me within six months of receiving a new one. Been this way for years.

Do you work at a magnetron manufacturing plant?

No, but I have similar issues with electronics in general.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#256

Post by raybb »

Mountain_Skies wrote: post #154
roguesherlock wrote: post #125

Do people not get any messages when they make any transactions? In my county you literally get messages for every transaction. And you also have to add in otp for every transaction online.

That's opt-in but I think every credit card company in the US offers to alert you by SMS or app notification when a transaction has been made. I have that setup for my cards but it is annoying each month when the internet bill hits my card because they do their processing at 3am.

Definitely not every bank offers this (looking at my small credit union) but most do and it's great! I just wish it would let me know when restaurants add the tip on.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#257

Post by Semaphor »

samatman wrote: post #143
noirbot wrote: post #90

Earlier quoted context omitted.

If you go anywhere where they hold a tab open, such as a bar, you can't do that with tap/chip. Not that that's a blocker, since worst case you do a bunch of single transactions, but it's an annoyance.

Do you not give them the card, then they swipe it once at the end and you get it back? How does a stripe affect that?

The whole "giving your card away" thing is so foreign to me (German). Fuck no, I’m not giving you my card. In restaurants and bars they either come by with their handheld terminal, or you go to the machine at the register and simply pay like in any other place.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#258

Post by giancarlostoro »

w-ll wrote: post #248
TaylorAlexander wrote: post #210

Earlier quoted context omitted.

The problem is with the system Apple designed. They have a small removable wallet with magnets on the back. While I’m using a Popwallet brand wallet with my iPhone, the way it is designed I don’t think the official wallet would be any different. It has to have one side with exposed magnets per Apple’s design, and when handling the removable wallet I’ve found myself accidentally touching the magnetic side with my card…

Well my thought on "pop sockets" is when one of your flagship products needs another product for people to hold it... some one f'd up and is not there anymore to call out the bs.

You don't actually need them to hold the phone though, just some people want to hold on to less of their phone to keep it on their hand. I personally just hold on to my phone with my own hand.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#259

Post by hansvm »

sigmoid10 wrote: post #171
Aperocky wrote: post #83

Earlier quoted context omitted.

Can't have a mag stripe vulnerability if there is no more mag stripe, such simple and elegant solution is tradition for Apple (can't have a broken home button when you don't have one!)

Mag stripe needs to die anyways. It is such a glaring security issue, I openly welcome any effort towards getting rid if it.

To be fair, chips have a similar vulnerability; it's just limited to being exploited immediately rather than being stored and played back later.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#260

Post by w-ll »

giancarlostoro wrote: post #258
w-ll wrote: post #248

Earlier quoted context omitted.

Well my thought on "pop sockets" is when one of your flagship products needs another product for people to hold it... some one f'd up and is not there anymore to call out the bs.

You don't actually need them to hold the phone though, just some people want to hold on to less of their phone to keep it on their hand. I personally just hold on to my phone with my own hand.

For one hand usability they kinda are a must for most people. I can manage. But still, I'm OG SE camp.

https://www.youtube.com/watch?v=9g0Mft1CQ7A

Post reply on HN