Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

271–280 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#271

Post by TaylorAlexander »

throwaway-blaze wrote: post #263
TaylorAlexander wrote: post #46

This is why I really like the added security of the new Apple magnetic wallet I got. The wallet holds your cards and attaches to the back of the phone using magnets. While the inside of the wallet is magnetically shielded, I’ve found it’s nearly impossible when actually handling the magnetic wallet not to accidentally pass the card past the outside of the magnetic wallet. I have found that my card no longer works in…

So you mention lower in the thread that in fact you didn't get the new Apple magnetic wallet, but actually a 3rd party wallet and just assume Apple's will have the same problem. That seems like a distinction worth mentioning, especially with the first comment on the article. While it seems reasonable that Apple's wallet might have the same problem, you dont actually know.

Yes I didn’t realize how seriously people would view this until after I could no longer edit the comment. I mostly thought my story was funny. Though it is true that my Popwallet demagnetized my cards due to the ease with which once can accidentally contact the non shielded exterior of the magnetic wallet with the magnetic card. As I said down thread, apple intentionally designed a wallet that has to have relatively powerful magnets on the exterior. A lot of people in thread are claiming their apple wallet hasn’t demagnetized their cards, but they have not confirmed if they’ve accidentally contacted the magnetic exterior of the apple wallet with their card. Obviously the inside of the wallet is shielded and I don’t believe my card was demagnetized due to poor shielding, but by accidental contact with the magnetic face of the wallet during handling. Apple is clear in their marketing materials that the inside of their wallet is shielded, but they say nothing about risks associated with accidental card contact on the magnetic exterior of their wallet. And this is the situation of concern for me. Perhaps they use much weaker magnets than Popwallet, and you’re right that I can’t say for sure, but I suspect they still use reasonably powerful magnets and accidental contact with a magstripe on the magnetic side of their wallet could pose a problem for cards.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#272

Post by derefr »

garyrichardson wrote: post #269
sigmoid10 wrote: post #171

Earlier quoted context omitted.

Mag stripe needs to die anyways. It is such a glaring security issue, I openly welcome any effort towards getting rid if it.

You must be in the US -- America is the only place where mag stripe still exists. Everyone else is using tap or chip and pin.

Do you mean that credit cards in other countries don't have magnetic stripes, or just that nobody uses them?

Living in Canada, there's basically no instance where we'd swipe our credit cards, but they've still got mag stripes; and when I visit the US, I sometimes have to swipe my card, and it does work to do so.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#273

Post by derefr »

TaylorAlexander wrote: post #268
giancarlostoro wrote: post #258

Earlier quoted context omitted.

You don't actually need them to hold the phone though, just some people want to hold on to less of their phone to keep it on their hand. I personally just hold on to my phone with my own hand.

I do this and it gives me hand pain due to how I have to hold my pinky to steady the phone. I use the large phone model.

Perhaps the large phone is not for you, but rather for people with large hands.

People never complain that tiny devices are too small for their big hands — they correctly conclude that they're made for children or for adults with small hands. But for some reason people expect to be able to use huge phones and phablets with regular-sized hands, rather than accepting that they're intended to be comfortably held by people with huge hands, who find regular-sized phones too small.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#274

Post by gffrd »

Ephil012 wrote: post #113
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

Carrying cash is more common in NYC due to many small businesses there being cash-only. For instance, halal food carts are cash-only. As a result, there is higher ATM usage in NYC where these ATM skimmers were found.

Best $6 you’ll ever spend.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#275

Post by toomuchtodo »

arjvik wrote: post #264
akira2501 wrote: post #164

Earlier quoted context omitted.

Charged as in has a full and operational battery. A card with a chip in this does not require that. I can also intentionally give someone else my card to effect a purchase and neither myself nor my phone actually has to be there. Fraud clearly hasn't had a deleterious effect on the entire system, and the penalties for fraud align incentives to fight fraud properly. It's not such a large problem that I'm willing to ta…

Modern iPhones actually support being used for NFC payments even when they're dead (using a tiny bit of reserve power)

Wouldn’t it be cool if payment terminals were also Qi enabled so even if the phone was dead it could provide enough power wirelessly to enable payments to be made?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#276

Post by derefr »

Mister_Snuggles wrote: post #250
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The problem is that there's no equivalent party in the "infrastructure" position in the US that Interac occupies in Canada. There's just 500 different state-level banks, who all license different companies to make their ATM cards. (This is the same reason it took so long for the US to get past two-day ACH settlement.)

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#277

Post by derefr »

dymk wrote: post #253
bobsmooth wrote: post #244

Earlier quoted context omitted.

It's because of tiny gas stations in the middle of nowhere.

USPS delivers to them, guaranteed

Delivers... new gas pumps? Because often with self-serve pumps, the pump and the card reader are one-and-the-same. Probably modular in some internal sense, but not with an expectation of owner serviceability; more "call the manufacturer" serviceability.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#278

Post by filoleg »

JasonFruit wrote: post #72
renewiltord wrote: post #2

I use contactless to get money out of the ATM. It looks like they'd get my PIN in this method but they can't replicate the card, then, right?

"Contactless" is not a noun, and I refuse to allow it to become one without opposition.

I feel about it the same way I feel about people saying "i am on wireless" (when telling people whether they are using ethernet or wifi). Totally fine in the context.

Since we are talking about payment card skimmers, "contactless" feels appropriate here too.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#279

Post by pdntspa »

justsomehnguy wrote: post #172
bri3d wrote: post #157

Earlier quoted context omitted.

There are a large number of “smart” tab systems in use in US bars where the system retains your magnetic stripe data for the duration of your visit. You pass off your card, it is swiped and immediately returned. If you don’t settle your tab, it’s automatically settled with a pre-set tip using the stored track data. It’s convenient for bar owners and patrons as the bar doesn’t have leftover cards to deal with and the…

>> It’s convenient for bar owners and patrons LOL. It's convenient for bar owners. Patrons doesn't give a shit about that.

Speak for yourself, I can't tell you how many times I've left my card at the bar because of an open tab. Nowadays I'll favor places that give me my card back when I open a tab.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#280

Post by aidenn0 »

Mister_Snuggles wrote: post #251
bobsmooth wrote: post #244

Earlier quoted context omitted.

It's because of tiny gas stations in the middle of nowhere.

Gas stations are interesting here. Here in Alberta, it's the law that you need to pay before you pump[0]. If you're at a modern pump you insert your card, it does a preauth for some amount (you can select common amounts, like $20 of fuel, or "fill up" which is like $125 or $250 depending on the station), then when you're done it does a purchase for the exact amount. If you're not at a modern pump, or you're paying ca…

US is the same, except the pre-auth is set by the gas station owner, so you may need to go inside to pay with a debit card with less than that amount, and large trucks need two transactions to fill up
Post reply on HN