Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Target's EasySweep – Simplifying Skimmer Detection

tech.target.com

Post reply on HN
Print view View original

111–120 of 151 posts

Re: Target's EasySweep – Simplifying Skimmer Detection

#111

Post by huslage »

hackmiester wrote: post #77
callalex wrote: post #65

Earlier quoted context omitted.

My pet theory is that transitioning to wireless payment also opens up user expectations for the vendor to participate in way more payment networks than just Visa/MC/Discover/AmEx. If you have a wireless reader but no agreement with Apple Pay, or Google Pay, or Samsung Pay, or WePay, or WhateverSomeNewMBACrap users will start putting in reports that the reader is “broken”.

You don't have to have an agreement with Apple or Google to accept Apple Pay or Google Pay. If the customer holds a Visa then the phone presents a Visa to the reader. There is no special thing you have to do to accept those payments.

Unfortunately that's not how it works. There is a protocol at the payment processor for Apple Pay (at least) that has to be followed so that the device card number (not the card number on your card and not a "virtual card") is tied to the correct account. It's a whole thing. Most POS systems ship with support for it at this point. And you have to sign some sort of agreement so that you are compliant.

https://www.forbes.com/advisor/business/how-accept-apple-pay...

Re: Target's EasySweep – Simplifying Skimmer Detection

#112

Post by havaloc »

hackmiester wrote: post #77
callalex wrote: post #65

Earlier quoted context omitted.

My pet theory is that transitioning to wireless payment also opens up user expectations for the vendor to participate in way more payment networks than just Visa/MC/Discover/AmEx. If you have a wireless reader but no agreement with Apple Pay, or Google Pay, or Samsung Pay, or WePay, or WhateverSomeNewMBACrap users will start putting in reports that the reader is “broken”.

You don't have to have an agreement with Apple or Google to accept Apple Pay or Google Pay. If the customer holds a Visa then the phone presents a Visa to the reader. There is no special thing you have to do to accept those payments.

This is true in theory, but I can think of one grocery store (rural, admittedly) where Apple Pay doesn't work, but tap does.

Re: Target's EasySweep – Simplifying Skimmer Detection

#113

Post by js2 »

huslage wrote: post #110
techsupporter wrote: post #67

Earlier quoted context omitted.

> I had used an iCloud Hide My Email address for the purchase so a day later I get another email from NoFraud I got hit by a merchant using "NoFraud" as well. After making an order from the merchant's site, using Apple Pay on the web (which is, allegedly, rather hard to fake), I received an email saying my order was canceled as it "appears that a merchant-specific email address was used" and to "please resubmit the o…

as if Email is some sort of durable identifier in the first place.

This is the thing that got me. Where the heck is NoFraud getting its training data[1] and why is an email address even considered relevant to the safety of the transaction? The item was shipping to my home address which matches my CC billing address.

[1] "NoFraud’s multi-layered solution analyzes thousands of data points fusing machine learning."

Re: Target's EasySweep – Simplifying Skimmer Detection

#114

Post by jackson1442 »

MBCook wrote: post #80
js2 wrote: post #16

Earlier quoted context omitted.

Even with EMV transactions, they are apparently able to get the card # which is transmitted in clear text by the chip. And the PIN from the keyboard overlay for debit transactions. Later they can clone the card # onto a fake mag stripe card and use the fake card for card-present purchases. They probably cannot make card-not-present (online) purchases since I don't think they can get the CVV. https://krebsonsecurity.c…

EMV doesn’t transmit the full card number in the clear. I don’t know how they’d get it. IIRC the track data is sanitized, but maybe it wasn’t always. I’m not even sure all cards give it in a modern EMV transaction. The old mag stripe emulation mode of contactless did, but that’s legacy and many places won’t accept it and cards won’t do it. However the good old “break the slot or chip reader so they have to use mag st…

I believe it’s at least stored on the EMV chip: if you tap a credit card to a flipper zero you’re able to read the full card number and expiration date, and contactless is just over-the-air EMV as I understand it.

Re: Target's EasySweep – Simplifying Skimmer Detection

#115

Post by sanex »

callalex wrote: post #57
thelastparadise wrote: post #49

Earlier quoted context omitted.

> Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me. What you are describing is Bitcoin.

No, a bitcoin wallet is not a bank.

You are the bank

Re: Target's EasySweep – Simplifying Skimmer Detection

#116

Post by MBCook »

jackson1442 wrote: post #114
MBCook wrote: post #80

Earlier quoted context omitted.

EMV doesn’t transmit the full card number in the clear. I don’t know how they’d get it. IIRC the track data is sanitized, but maybe it wasn’t always. I’m not even sure all cards give it in a modern EMV transaction. The old mag stripe emulation mode of contactless did, but that’s legacy and many places won’t accept it and cards won’t do it. However the good old “break the slot or chip reader so they have to use mag st…

I believe it’s at least stored on the EMV chip: if you tap a credit card to a flipper zero you’re able to read the full card number and expiration date, and contactless is just over-the-air EMV as I understand it.

Oh yeah, it must be in there. If you were to etch down to the chip with acid I’m sure you could see it.

Contactless has two forms. The old one is mag-stripe emulation. It would literally just respond with the information from the mag-stripes. It was exactly as secure as mag-stripe. Probably worse because you didn’t need to physically move the card over a read head.

That’s no longer supported in many (most?) modern cards. I know ApplePay refuses to do it. I think card brands have said to stop using it but I’m not positive.

The other mode (absolutely dominant in contactless) works through encrypted EMV tags the same as you get when using a physical slot. The order of things is a little different but it’s just as secure.

Re: Target's EasySweep – Simplifying Skimmer Detection

#117

Post by exabrial »

exabrial wrote: post #48

We wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.

Guys i appreciate the comment about EMV, I’m aware but it misses the point. They need to be _my_ keys, and ones _I_ can pick and verify. If you don’t generate the key, it’s not actually secure.

At minimum, EMV would need to be verifiable. Ideally rotatable. Best case: chooseable.

Re: Target's EasySweep – Simplifying Skimmer Detection

#118

Post by vanchor3 »

huslage wrote: post #111
hackmiester wrote: post #77

Earlier quoted context omitted.

You don't have to have an agreement with Apple or Google to accept Apple Pay or Google Pay. If the customer holds a Visa then the phone presents a Visa to the reader. There is no special thing you have to do to accept those payments.

Unfortunately that's not how it works. There is a protocol at the payment processor for Apple Pay (at least) that has to be followed so that the device card number (not the card number on your card and not a "virtual card") is tied to the correct account. It's a whole thing. Most POS systems ship with support for it at this point. And you have to sign some sort of agreement so that you are compliant. https://www.forb…

I think that's just EMV tokenization, not something exclusive to Apple Pay.

Re: Target's EasySweep – Simplifying Skimmer Detection

#119

Post by Operyl »

monkeymeister wrote: post #84
crote wrote: post #83

Earlier quoted context omitted.

Only for large retailers, though. Why not directly offer the CAD file for download right on that page, or make the resulting product available for purchase?

Likely to avoid defeat attempts. The corporate email requirement acts as a first-line defense to at least try to stave-off would be skimmers / scammers grabbing the CAD file and working out the measurements needed to defeat it.

Seems easier to just pay off an underpaid Target employee.

Re: Target's EasySweep – Simplifying Skimmer Detection

#120

Post by none_to_remain »

exabrial wrote: post #117
exabrial wrote: post #48

We wouldn't even need to worry about this dumb stuff if we had actual cryptographic PKI for payments. Honestly at some point fraud is 100% the card issuer's fault when the tech to prevent it is here and now. Why I still can't register a public key with my bank and say "do not under any circumstance honor a transaction unless it's signed with my private key" is beyond me.

Guys i appreciate the comment about EMV, I’m aware but it misses the point. They need to be _my_ keys, and ones _I_ can pick and verify. If you don’t generate the key, it’s not actually secure. At minimum, EMV would need to be verifiable. Ideally rotatable. Best case: chooseable.

I feel like if you want that, what you have to do is make a social change such that a number of people sufficient to form a marketable niche would even understand what you are talking about.

Like, I understand what you are talking about, most of the readers here understand what you are talking about, but I also understand that almost everyone else doesn't.

Post reply on HN