Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Crazy Thin ‘Deep Insert’ ATM Skimmers

krebsonsecurity.com

Post reply on HN
Print view View original

351–360 of 484 posts

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#351

Post by mcv »

kibibyte wrote: post #320
tehaugmenter wrote: post #315

Earlier quoted context omitted.

What is scary though is how easily the rfid can be read off of a person. It's a great thing to have but card issuers should include some kind of protective sleeve with every card rather than relying on the consumer to be both aware of and able to use an rfid blocking wallet.

Old payment card RFID contactless was really insecure; it basically spat out the data on the magnetic stripe. New contactless is directly tied to the EMV chips and requires the whole cryptographic round trip and such. You can put a protective sleeve around your cards if you want, but it doesn't really add much in real security anymore.

If payment can be authorized through the chip by mere proximity, without any explicit authorization by the owner, then it's still insecure. Of course the thief would need to have an official payment terminal, but those are everywhere.

I use my app, not my card, for this reason.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#352

Post by DanAtC »

NavinF wrote: post #348
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

Banks don't eat reversed charges, the retailer does.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#353

Post by yardstick »

jjav wrote: post #327
yardstick wrote: post #324

Earlier quoted context omitted.

Cash is only optimal for privacy, not convenience or availability or speed or security. If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surrender to them my pin). Not so with cash. Cards take a second or two to process payments on average. Not so wish cash. My bank account / credit card limits always have enough to cover my purchases, whereas my physical wallet might be…

> Cash is only optimal for privacy, not convenience or availability or speed or security. Security == privacy. And cash certainly wins availability by a long shot, it can't be blocked by any kind of outage. Convenience is arguable I suppose. I'd rather hand over cash than deal with anything electronic that can fail. > If my credit card is stolen, I get my money back (so long as I reported it in time, and didn’t surre…

> In many areas electricity outages are a daily occurrence.

I’ve lived in 4 continents, never had daily, weekly, or even monthly outages.

> Security == privacy. And cash certainly wins availability by a long shot, it can't be blocked by any kind of outage.

If you don’t have enough cash in your wallet then you don’t have any availability. If you have a internet outage your debit/credit cards still work offline.

Also security does not equal privacy. If you are living in a state where this is true, you have bigger issues with the entire system than ATM skimmers.

> Credit cards don't have a PIN, that's a debit card.

Everywhere I have lived bar the US has PINs on all card types. It’s only a matter of time before it becomes ubiquitous in the US too.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#354

Post by neilalexander »

NavinF wrote: post #348
Mister_Snuggles wrote: post #250

Earlier quoted context omitted.

When Canada moved to Chip and Pin there was no fanfare. Merchants started getting chip terminals as part of the regular replacement cycle, consumers started getting chip cards as part of that regular replacement cycle, and eventually the terminals started telling users to insert their card. Interac was the first mover because most people were already familiar with swipe and pin, so the move to chip and pin was a virt…

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#355

Post by gumby »

gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#356

Post by LelouBil »

jjav wrote: post #319
bryan0 wrote: post #9

It's crazy how I never carry cash anymore. I can't even think of the last time I used an ATM. I often just leave the house with my phone and buy stuff with apple pay. Also how is magnetic strip still a thing? I thought this was replaced with chip and tap years ago...

If your phone breaks or you lost it, if there is no connectivity, if apple decides to cancel your digital existence, then what? And it means everything you buy is associated with you and recorded forever to be sold to endless advertisers (and worse) and the transaction may be blocked by third parties. If you pay cash it works without a depending on anything external (no internet, no electricity), it is not traced, it…

In France, some banks have created a group and offer NFC payment via phone in their own app (for Android)[0]. They are not working with Google Pay.

So I have no risk of some company unrelated to my banking erasing my digital existence and making me unable to pay.

[0] https://www.paylib.fr/paiement-sans-contact/

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#357

Post by NavinF »

neilalexander wrote: post #354
NavinF wrote: post #348

Earlier quoted context omitted.

The vast majority of terminals in the US use chip, but I doubt the US will ever require pin numbers for credit card purchases. It's just too inconvenient. Banks are willing to eat the tiny reversed transactions in exchange for making the payment flow more efficient.

What about it is inconvenient? We've had Chip+PIN in the UK since 2006 and contactless payments since 2007 and it isn't inconvenient at all. Supporting card machines are everywhere and in addition portable card machines are extremely commonplace. Even in restaurants they just bring the card reader to the table and you either tap-to-pay or you put your card in and enter your PIN.

It takes a few more seconds. Never gonna happen.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#358

Post by grishka »

Macha wrote: post #156
grishka wrote: post #136

Earlier quoted context omitted.

Wait, there are still places in the developed world where there are no contactless ATMs?

We dropped magstripes over a decade ago for chip and pin (though cards still ship with them for use overseas), and pretty much every payment terminal in stores have supported contactless for two years, but I haven't seen a contactless ATM here in Ireland - I assumed there was some liability reason they wanted chip and pin

Here in Russia you still have to enter the PIN after you tap the card. You used to be able to tap with your phone too, back when Google Pay and Apple Pay worked.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#359

Post by trasz »

gumby wrote: post #355
gtirloni wrote: post #227

> However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer’s card. Who are these businesses? Seriously, stop issuing cards without chips and send new card readers to theses businesses. End of story. Is it because US businesses use deeply embedded card readers in custom POS machines that aren't modular? Everywhere I go in South America and Europe, busi…

Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.

NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.

Re: Crazy Thin ‘Deep Insert’ ATM Skimmers

#360

Post by aembleton »

trasz wrote: post #359
gumby wrote: post #355

Earlier quoted context omitted.

Hilarious that chips are the new tech in the USA when other countries are going essentially all-NFC. Try using a chip card in Australia.

NFC is kind of old too. In some countries, like China, it's already been replaced by phone payments.

NFC means I can pay with my watch. I think in China they rely upon phone cameras and QR codes. Great if you've got your phone with you, but I can go out for a run with just my watch and pay using NFC.
Post reply on HN