Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 116 posts

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#31

Post by aianus »

jacquesm wrote: post #28
aianus wrote: post #23

Earlier quoted context omitted.

The correct way to implement chip-and-pin is alongside a paypass/paywave reader. Customers making purchases over $50 must use chip-and-pin, everyone else can just tap their wallets against the reader. Some other problems with chip-and-pin: - You get really cheap merchants who would prefer to waste your time rather than shell out for the contactless reader. - You get international merchants who have no idea what's goi…

I make several payments per day using chip&pin, according to my bank last month more than 300 pin transactions. That's 10 per day (travelling I do this a lot more than when I'm at home). Online it's not a problem either (fairly easy integration here with a system called 'iDeal'), typing in your pin at -40C at the gas station is still a requirement with the current prices of gas and I'm not one bit bothered by 'waiter…

> As for international merchants who have no idea what is going on: I spend more time abroad than I do in my home country and chip-and-pin have made my life a lot easier than it ever was before in this respect.

Well YMMV, of course, but here in Vietnam I've had to go around the other side of the checkout to type in my pin because the terminal was bolted to the desk. Multiple times. And then they still make me sign two receipts anyways.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#32

Post by jacquesm »

aianus wrote: post #31
jacquesm wrote: post #28

Earlier quoted context omitted.

I make several payments per day using chip&pin, according to my bank last month more than 300 pin transactions. That's 10 per day (travelling I do this a lot more than when I'm at home). Online it's not a problem either (fairly easy integration here with a system called 'iDeal'), typing in your pin at -40C at the gas station is still a requirement with the current prices of gas and I'm not one bit bothered by 'waiter…

> As for international merchants who have no idea what is going on: I spend more time abroad than I do in my home country and chip-and-pin have made my life a lot easier than it ever was before in this respect. Well YMMV, of course, but here in Vietnam I've had to go around the other side of the checkout to type in my pin because the terminal was bolted to the desk. Multiple times. And then they still make me sign tw…

I suspect that the 'Vietnam' factor may be a larger one than the chip-and-pin factor.

https://www.pacnetservices.com/wpg/country.php?alpha2=VN

Has a pretty explicit note that Vietnam is still primarily a cash based society, I think that is where your problems stem from, not necessarily from the technological merits or lack thereof of chip&pin.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#33

Post by hayksaakian »

MichaelApproved wrote: post #25
nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

In my experience, Stripe won't do anything like that. I manage a website that accepts donations. This tends to be a target that fraudsters like to utilize. They'll "donate" small amounts to the non-profit in order to check if the transaction went through. If the transaction was approved, they know the card is still valid. Meanwhile, we're stuck with the fraudulent transaction and have to refund the charge. Now, these…

Could you do a frontend validation? At the point of accepting a card, before it is tokenized?

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#34

Post by InclinedPlane »

aioprisan wrote: post #2

This is supposed to be much bigger than the Target breach. If this doesn't give the move to the more secure EMV chip and pin method in the US, nothing will.

Chip and pin is already being planned for the US over the next 2 years or so. I'm honestly quite surprised the news hasn't gotten more attention.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#35

Post by abrkn »

nodesocket wrote: post #9

How is http://rescator.cc/ still online and facilitating the transactions when they are clearly selling stolen goods? I assume they are in Russia or similar. Are they using bitcoin, or do they actually use PayPal? Their forum is also utterly amazing, and downrigh scary: https://lampeduza.so/ Would be interesting if payment processors such as Stripe, Braintree, Amazon Payments, and Balanced periodically got CC dumps,…

Why do they use ICQ?

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#36

Post by lucaspiller »

__david__ wrote: post #14
mzuvella wrote: post #10

Earlier quoted context omitted.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

I hear this a lot and I don't really know how EU's chip and pin works, but wouldn't it be best for the the card to spit out an encrypted blob that only the originating bank can decrypt? IE, no number that's useful to anyone in the middle at all? That seems like a better design to me.

A lot of places where I pay by PIN they still swipe it afterwards so that they have a record on their own system (not sure why they need this though) - I think this is what OP refers to.

The difference between US banks and mine though is that if I try to pay by signing my bank won't authorise it - I have to enter my PIN (and sometimes sign too) to make a payment.

Payments online is more of the retailers fault though. They shouldn't accept payments where the CVV check or address check fails. Here in the UK most retailers won't accept payments unless it all matches up, but as I understand this isn't as common in the US.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#37

Post by furyg3 »

kubiiii wrote: post #17
aianus wrote: post #8

Earlier quoted context omitted.

Before Canada implemented Chip and PIN, you usually didn't have to sign the receipt for those kind of small purchases. It takes at least 10x longer now to do the insert, type PIN, remove than just a swipe.

Contactless payment is more and more widespread in france for purchases < € 20.

This. In Holland we have chip and pin, which I've got to say goes much faster than someone can fish out cash from their wallet, certainly faster than someone can make change.

Recently many places also support RFID with no pin required for small purchases (I think it's €25). Goes much faster than the employee can bag your order up.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#39

Post by icebraining »

__david__ wrote: post #14
mzuvella wrote: post #10

Earlier quoted context omitted.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

I hear this a lot and I don't really know how EU's chip and pin works, but wouldn't it be best for the the card to spit out an encrypted blob that only the originating bank can decrypt? IE, no number that's useful to anyone in the middle at all? That seems like a better design to me.

Yes, and the infrastructure is there for chip&pin cards, you just need an ISO7816 USB reader, which are cheap nowadays (The problem is inertia, nothing else.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#40

Post by icebraining »

tonyedgecombe wrote: post #29
kubiiii wrote: post #17

Earlier quoted context omitted.

Contactless payment is more and more widespread in france for purchases < € 20.

We are starting to see it in the UK as well, it is very fast.

Our cards here in Portugal already support it as well, but the payment readers seem to be lagging behind.
Post reply on HN