Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Reader

stripe.com

Post reply on HN
Print view View original

131–140 of 141 posts

Re: Stripe Reader

#131

Post by posguy »

jqmp wrote: post #111
posguy wrote: post #34

Earlier quoted context omitted.

Neither Square or Toast support PIN entry, whereas a Clover (made by First Data, the largest processing platform) and Ingenico/Verifone equipment have the proper hardware to ensure physical security while they encrypt the PIN in transit back to the bank your platform uses to process the transaction. PIN Debit transactions are less expensive to process since there is less risk, but it adds complexity (First Data has m…

Square does support PIN entry: you just enter the PIN into the touchscreen of the mobile device. Square developed a way of securing the PIN that doesn't require dedicated hardware. (It's now a PCI security standard: "Software-based PIN Entry on COTS".)

Square does not support PIN entry for US Debit or EBT Cash/Food cards, this appears to only be a feature in countries where Chip & PIN are mandatory: https://squareup.com/ca/en/townsquare/debit-is-here

Re: Stripe Reader

#132

Post by posguy »

wila wrote: post #114
posguy wrote: post #27

Earlier quoted context omitted.

Gravity Payments, First Data Merchant Services (the direct sales side of First Data), Vantiv/Mercury and numerous other platforms and platform resellers (Square & Stripe resell others processing platforms) have spent the last decade driving down prices. Some wholesale contracts for certain ISO resellers are as low as 1 basis point (.01% of a transaction) and $0.01 for bank underwriting (where the bank holds the charg…

There's certainly a lot going on now. Having previously implemented a variety of other payment providers, I am now looking at a Gravity Payment integration. Not done yet, but so far pleasantly surprised by how they communicate with integrators.

Beware, Gravity screwed over numerous businesses I work with. They purposefully misclassified businesses SICs (a code that defines what very specific category your business is, eg: a bar or a restaurant) to reduce credit card processing fees (interchange fees) for their customers, but were caught doing this for a massive number of businesses.

The card networks and issuing banks that had this money stolen from them went after the businesses that dodged these fees illicitly, with bills of tens of thousands or hundreds of thousands of dollars for fees that should have been paid.

Re: Stripe Reader

#133

Post by toomanybeersies »

elric wrote: post #95
swah wrote: post #93

I don't remember ever "swiping" a card and I'm in Brazil - in there any other market than US for this?

The last time I had to swipe a card in Belgium was in the 1990s. That was swipe-and-pin. At no point in my life have I ever had to sign a manual signature for a payment. Lately contactless payments (with and without pin) have been gaining in popularity. Most payment terminals now support them. I'm sure there's a market for Stripe Reader in the US, but I can't imagine there being one over here. Unless they're a lot ch…

The first and only time I've ever had to swipe and sign was on an AirAsia flight a few years ago.

I had never actually bothered to sign my car, which was apparently a problem for the flight attendants, even though my passport (with a matching signature) had the same name, and obviously did my ticket. But by whatever logic, they were happy with me signing the card there and then.

It amazes me that swipe and sign was ever considered vaguely secure. Most teenagers learn how to forge their parents signature during their high school years.

Re: Stripe Reader

#134

Post by toomanybeersies »

rjmunro wrote: post #124
edwinwee wrote: post #122

Earlier quoted context omitted.

It's designed to be integrated with a mobile app via our Terminal SDKs ( https://stripe.com/docs/terminal/sdk/ios ).

How do I know that the device is really running your mobile app, not a copycat app and the real app is running on a device under the table or elsewhere? Seems like an easy thing to fake.

By the same reason you know you're not going to get mugged by the cashier, because it's illegal.

Re: Stripe Reader

#135

Post by jqmp »

posguy wrote: post #131
jqmp wrote: post #111

Earlier quoted context omitted.

Square does support PIN entry: you just enter the PIN into the touchscreen of the mobile device. Square developed a way of securing the PIN that doesn't require dedicated hardware. (It's now a PCI security standard: "Software-based PIN Entry on COTS".)

Square does not support PIN entry for US Debit or EBT Cash/Food cards, this appears to only be a feature in countries where Chip & PIN are mandatory: https://squareup.com/ca/en/townsquare/debit-is-here

Yes, there may be some markets where Square doesn't support PINs. I took your comment to mean that Square doesn't support PINs at all, and that it's because of a physical security requirement. I couldn't resist responding to that, since neither of those has been true for a while.

Re: Stripe Reader

#136

Post by random3 »

pimlottc wrote: post #38
random3 wrote: post #28

Earlier quoted context omitted.

Also cute: "1649 roles across all locations and all teams."

I don’t get it, what’s significant about that number?

1.6K open positions is a pretty significant scale. At least for me as a founder for an early stage company working hard to get a few hires :)

Re: Stripe Reader

#137

Post by wila »

posguy wrote: post #132
wila wrote: post #114

Earlier quoted context omitted.

There's certainly a lot going on now. Having previously implemented a variety of other payment providers, I am now looking at a Gravity Payment integration. Not done yet, but so far pleasantly surprised by how they communicate with integrators.

Beware, Gravity screwed over numerous businesses I work with. They purposefully misclassified businesses SICs (a code that defines what very specific category your business is, eg: a bar or a restaurant) to reduce credit card processing fees (interchange fees) for their customers, but were caught doing this for a massive number of businesses. The card networks and issuing banks that had this money stolen from them we…

huh, that's unexpected.

Thanks for the warning, I'll pass it along.

Re: Stripe Reader

#138

Post by rjmunro »

elric wrote: post #129
rjmunro wrote: post #123

Earlier quoted context omitted.

What do you mean by using your PIN "feels more secure". It's more secure for the retailer, but it's less secure for you. Any time you have to enter your PIN you are putting yourself at risk of someone seeing it. It could even be a fake PIN pad, so covering with your other hand won't help. If they can then steal the card from you, they can spend freely at merchants and withdraw cash at any ATM up to 2X your daily limi…

You raise a good point about the limits -- although the contactless limits have been raised here due to the pandemic. But I think you're underestimating the physical security of the payment infrastructure. Card terminals (here at least) are extremely secure. They are highly tamper resistant; they cannot access the network if they've been tampered with. These NFC terminals on the other hand, I have my doubts about man…

The tamper resistance is less important if you don't have to enter your PIN. The protocols are secured from the card to the bank - the card has a CPU on board.

Tampering with the NFC reader doesn't really get you anything. Tampering with a PIN pad does let you copy someones PIN.

Re: Stripe Reader

#140

Post by swah »

JshWright wrote: post #94
swah wrote: post #93

I don't remember ever "swiping" a card and I'm in Brazil - in there any other market than US for this?

You say that as if "the US" isn't a big enough market to justify a product (swiping is pretty rare in the US as well though, EMV is pretty universal, and contactless is gaining ground quickly).

Nope, just asking really.
Post reply on HN