Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

311–320 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#311

Post by jdeibele »

bobsmooth wrote: post #244
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

It's because of tiny gas stations in the middle of nowhere.

I added some gas in Frenchglen, Oregon. Population 11. You went into the store, told the clerk (owner in this case, I'm sure) that you wanted gas, she turned on the pump, then you took a photo with your phone and took it back to her so she could charge you. $6.75/gallon, which was about $2 more than in Burns (population 2766).

She didn't have any problem taking a chipped card but I imagine there are self-serve places that can't. It was only in 2018 that Oregon allowed self-serve in counties with less than 40,000 people. 17 of the 36 counties qualify.

The advice I've seen with credit cards seems to be "always tap if you can" since that's not subject to skimming or stealing a PIN.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#312

Post by cmeacham98 »

derefr wrote: post #276
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The problem is that there's no equivalent party in the "infrastructure" position in the US that Interac occupies in Canada. There's just 500 different state-level banks, who all license different companies to make their ATM cards. (This is the same reason it took so long for the US to get past two-day ACH settlement.)

For the purposes of accepting these cards as payment (which seems to be a much more common skimmer threat, for example at gas pumps) don't MasterCard and Visa fill this role?

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#313

Post by qazxcvbnmlp »

mepiethree wrote: post #310
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

> Who are these businesses?

Airline ticket counters…

Replacing is not as simple as sending a new terminal. Then you’d have to integrate it with the legacy software workflow and modify the existing furniture at the airport to support a pin pad.

Also, we have your ID and you are going to be cleaning security, so we’re pretty certain you say who you are. Regardless of the physical security of the credit card.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#314

Post by [deleted] »

unstatusthequo wrote: post #219
akira2501 wrote: post #164

Earlier quoted context omitted.

Charged as in has a full and operational battery. A card with a chip in this does not require that. I can also intentionally give someone else my card to effect a purchase and neither myself nor my phone actually has to be there. Fraud clearly hasn't had a deleterious effect on the entire system, and the penalties for fraud align incentives to fight fraud properly. It's not such a large problem that I'm willing to ta…

If your threat model is a modern phone running out of battery, I suggest an external battery pack. Portable, powerful, and allows you not to carry a slow chip and pin.

[deleted]

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#315

Post by tehaugmenter »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

What is scary though is how easily the rfid can be read off of a person. It's a great thing to have but card issuers should include some kind of protective sleeve with every card rather than relying on the consumer to be both aware of and able to use an rfid blocking wallet.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#316

Post by DocTomoe »

lotsofpulp wrote: post #103
daniel-cussen wrote: post #92

Earlier quoted context omitted.

Well a restaurant bill is in some sense a debt for the food that was already provided.

There are restaurants where you do not receive the food until after you pay.

I wouldn't necessarily describe fast-food chains as "restaurants"...

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#317

Post by canadianwatcher »

Mister_Snuggles wrote: post #250
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

"When Canada"

I want to call out this country wide edict. I've seen this done in both the United States and Canada. I do not know your personal situation, but I'm fairly sure it wasn't across the entire country of Canada.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#318

Post by kibibyte »

mepiethree wrote: post #310
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

> Who are these businesses? Gas stations, parking meters, and ticket dispensers at most train/bus stations. They should replace them but I figure the problem is that they are built in to giant kiosks

With gas stations, there is so much more to it than just replacing a card reader in the kiosk, or even just replacing the kiosk itself. You may have to even tear out all of the old networking equipment. https://news.ycombinator.com/item?id=28207062

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#319

Post by jjav »

bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what?

And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties.

If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it can't be blocked by third parties.

Cash is the optimal payment mechanism for nearly everything. It only is inconvenient for very large payments, but for anything day-to-day, opt for cash.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#320

Post by kibibyte »

tehaugmenter wrote: post #315
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

What is scary though is how easily the rfid can be read off of a person. It's a great thing to have but card issuers should include some kind of protective sleeve with every card rather than relying on the consumer to be both aware of and able to use an rfid blocking wallet.

Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.
Post reply on HN