Nearly All U.S. Home Depot Stores Hit By Credit Card Theft • Hacker News Board

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#81

Post by ptwiggens » Thu, Sep 04, 2014, 3:12 PM UTC

diafygi wrote: post #22

jacquesm wrote: post #11

Earlier quoted context omitted.

> Would be interesting if payment processors such as Stripe, Braintree, and Balanced periodically purchased CC dumps, and blacklisted cards. Wouldn't purchasing them create just one more incentive? Also, this opens the door to disgruntled employees blacklisting all of the customers of their former employers (assuming they have access to credit card data, which shouldn't happen but often does).

> If a couple of Texas brothers could corner the world silver market,[HB] there is no doubt that the U.S. Government could openly corner the world vulnerability market, that is we buy them all and we make them all public. Simply announce "Show us a competing bid, and we'll give you 10x." Sure, there are some who will say "I hate Americans; I sell only to Ukrainians," but because vulnerability finding is increasingly…

I think that the intelligence agencies would rather have the vulnerabilities for their own use and roll the dice on being on the receiving end rather than buy up everything and close it, making it so they can't use it either.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#82

Post by diminoten » Thu, Sep 04, 2014, 3:16 PM UTC

kaared wrote: post #41

mzuvella wrote: post #10

Earlier quoted context omitted.

Having chipped cards would not prevent this. It would slow down criminals cloning cards but the numbers can still easily be used fraudulently online.

In Norway, the most common type of card is a debit card that can also be used as a Visa or MasterCard credit card. The card has a smart chip on the front, and on the back you have your national id number/date of birth, photo and signature, etc. The card is frequently used as an id card. When you pay using the debit card, you have to insert the part of the card with the chip into a reader and enter your pin. Typically…

The US has debit cards and you can activate that kind of behavior if you want (I know Visa will do it).

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#83

Post by mangodroppings » Thu, Sep 04, 2014, 3:20 PM UTC

js2 wrote: post #66

jvm wrote: post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

All of my cards (Amex, visa, mc, discover) are sig-only.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#84

Post by wglb » Thu, Sep 04, 2014, 3:22 PM UTC

awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

Well, note the numbers shown here: http://krebsonsecurity.com/2014/05/the-target-breach-by-the-...

0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions).

So do we know if it would have stopped the Home Depot breach?

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#85

Post by hannibalhorn » Thu, Sep 04, 2014, 3:37 PM UTC

DrTarantism wrote: post #69

mattmanser wrote: post #51

Earlier quoted context omitted.

That's not close to being a chicken and egg. The card companies just have to release the cards, then up the fees for using it without chip & pin. What's the point of buying the POS systems when no-one can use it and there's no guarantee the cards will be rolled out? It happened very rapidly here in Britain once the cards were out.

It's all politics. Its a big financial commitment for whichever side goes first. The US has a bigger population than Britain. And perhaps the industry politics were different there too. The card companies may have got their way.

There's liability to consider as well. In the US, the consumer is generally not liable for fraud; I've certainly heard that in other countries with chip and PIN, if somebody steals and uses your card (having somehow obtained your PIN) you don't necessarily get your money back.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#86

Post by dionidium » Thu, Sep 04, 2014, 3:39 PM UTC

js2 wrote: post #66

jvm wrote: post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

This is wrong. The vast majority of cards are signature only. I have one chip and signature card and it's regarded as kind of a novelty.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#87

Post by drzaiusapelord » Thu, Sep 04, 2014, 3:41 PM UTC

js2 wrote: post #66

jvm wrote: post #48

Earlier quoted context omitted.

Chip and PIN is scheduled for 2015. http://www.forbes.com/fdc/welcome_mjx.shtml

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

I have three cards. Only my debit/credit card has a chip and there's no pin. I can press it against one of the few readers that support this (Walgreens, Subway) and it'll work. My other two cards don't even have this. Of course, if these guys are storing my card in a non-encrypted way, its still the same issue as using swipe.

On the plus side Google Wallet works at Walgreens. I have yet to see any other brick and mortar support it. Paying for stuff with your smartphone is such a no-brainer. Shame Apple won't play ball with Google (or even put NFC in its phones) and Verizon is doing its own thing with ISIS and not allowing Google Wallet to be installed on any phones on its network. There's a lot of wrong here and its not just limited to credit card number theft.

If we have a more diversified way to pay for things it could limit the damage when one method is cracked but the others aren't. Sure Targets credit cards got stolen, but imagine if we were allowed to use Google Wallet. We'd be immune to it.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#88

Post by wlesieutre » Thu, Sep 04, 2014, 3:52 PM UTC

tedunangst wrote: post #79

js2 wrote: post #66

Earlier quoted context omitted.

My understanding is that almost every US [edit: EMV] card is [edit: going to be] chip and signature. http://www.flyertalk.com/forum/credit-card-programs/1304271-... https://docs.google.com/spreadsheet/lv?key=0Ani-u3tGk5hedGRv... Edit: clarifying - what I meant was that the US EMV cards will be chip and sig, not chip and pin. Most US cards are obviously still mag stripe. I'm traveling to Europe later this year so I wa…

Only one of my cards is chip and sig, and I had to go out of my way to get it. It's not the default for all new cards, and certainly not for existing cards.

When my credit card expired recently I received a chip and sig replacement without requesting it. They're definitely starting to be offered by default.

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#89

Post by Crito » Thu, Sep 04, 2014, 4:13 PM UTC

awjr wrote: post #38

I'm quite surprised by the blasé attitude the US has to card security. The lack of chip and pin still surprises me. I'm surprised a lot of the bigger retail companies haven't put pressure on the banks to bring this in.

> "I'm quite surprised by the blasé attitude the US has to card security."

Currently, if my CC information is stolen, I am not liable for any fraudulent charges. So why would I care?

CC security is for the CC companies and the merchants, not for the consumers. That is why Americans (with the exception of those with Europe Envy or those who are merchants) don't care. There is no reason for them to.

(In past discussions on this, somebody has mentioned that C+P would be beneficial for American consumers because it would mean less confused American tourists in Europe. The typical American does not vacation in Europe very frequently.)

Re: Nearly All U.S. Home Depot Stores Hit By Credit Card Theft

#90

Post by mitchty » Thu, Sep 04, 2014, 4:14 PM UTC

radmuzom wrote: post #43

kaared wrote: post #41

Earlier quoted context omitted.

In Norway, the most common type of card is a debit card that can also be used as a Visa or MasterCard credit card. The card has a smart chip on the front, and on the back you have your national id number/date of birth, photo and signature, etc. The card is frequently used as an id card. When you pay using the debit card, you have to insert the part of the card with the chip into a reader and enter your pin. Typically…

That is exactly what happens in India too, except that most banks issue debit and credit cards which are typically separate and not combined into a single card. It also does not serve as a national id. Is this not the case in US?

Basically the same here. I have both debit and credit cards are from the same bank. National id is a bit more contentious here but generally the two cards are about the same. With the caveat of much lower daily withdrawal limits on the debit (think 300).