Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

151–160 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#151

Post by reaperducer »

lsllc wrote: post #40
abrowne wrote: post #35

Earlier quoted context omitted.

My understanding for part of it is that magstip readers were much more common in the US, and businesses (a) didn't want to pay to upgrade all their terminals and (b) don't want to turn away a purchase because a customer doesn't have a chip or the chip isn't working.

That may have been the case, but pretty much everywhere I go stores have newer EMV capable terminals (e.g Ingenico etc). The only place I really use mag swipe now is a gas station pump (who have no excuse not to switch to contactless EMV). You'd think with COVID-19, there'd be a rush to move to contactless payments.

pretty much everywhere I go stores have newer EMV capable terminals

Go more places.

I know of a national restaurant chain and a regional coffee chain that are swipe only.

Also, Lowe's was swipe only the last time I was in there, but that was a several months ago.

Re: Is your chip card secure? Much depends on where you bank

#152

Post by Dylan16807 »

bluntfang wrote: post #56
penagwin wrote: post #48

Earlier quoted context omitted.

Yeah I actually choose gas stations that support contact less payments. No card contact + one disposable glove is the way to go. Overkill.. Maybe? But it costs me nothing so I'll take the peice of mind.

I'm really not trying to be rude here, but a disposable plastic glove isn't a "cost nothing" scenario. Plastic pollution is bad. Climate change is real. Trash islands are real. Microplastics in the entire food chain is real. I admire your dedication to stay safe, and don't want you to stop feeling safe, but we must all begin to accept what we're doing to the environment.

Understandable, but the cost to produce a glove is still very minor. And the way you solve pollution and microplastics from items in the trash can is by making sure that trash from cans is handled appropriately. Not by having consumers reduce their trash by a few percent. The climate damage is the only thing where you can really put responsibility on the consumer, and that can be fixed with a well-directed fraction of a penny.

Re: Is your chip card secure? Much depends on where you bank

#153

Post by [deleted] »

Mandatum wrote: post #142
Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

[deleted]

Re: Is your chip card secure? Much depends on where you bank

#154

Post by dathinab »

reaperducer wrote: post #150
the_mitsuhiko wrote: post #32

I will never understand why magstripe is still used in the US. Even after EMV became “mandatory” there are still magstripe transactions happening and when you are presented sith a chip reader it’s slow and awkward. Why is it such an inferior experience compared to Europe?

Why is it such an inferior experience compared to Europe? Legacy hardware. Europe was late to the credit card game, so when it finally got on board it had newer gear. The Americans already had their stuff in place and it worked. Unlike computer nerds who will upgrade their computers just to feel current, businesses don't throw around money unless they have a very good reason.

I don't think so, as far as I know all "old" terminals had to be replaced or upgraded in the EU some years ago to comply with the new chip technology.

Edit: so it's more about the willingness to require cost for upgrades then there being costs for upgrades, I thing.

Re: Is your chip card secure? Much depends on where you bank

#155

Post by ulfw »

reaperducer wrote: post #147
Mandatum wrote: post #142

Earlier quoted context omitted.

They were retired over a decade ago (in all main use-cases except where connectivity goes down - magstripe is the backup, but thoroughly validated option).. except in the US where there's this idea that implementing chip & pin is a barrier for sales and hurt small business because "upgrading the terminal is expensive" (no it's not - if you can't account for $150 every 10 years on taking payment, you shouldn't be in b…

upgrading the terminal is expensive It's not the terminal upgrade that's the barrier. At many businesses, if you upgrade the terminal you also have to replace the point-of-sale system. Then you have to integrate it with your existing backend sales system, fulfillment system, inventory system, and more. And you're lucky if all of that can then be integrated into your accounting system. Then you have to retrain all of…

Weird how the whole globe managed that, from small city states over third world nations to old established countries. And yet...

Re: Is your chip card secure? Much depends on where you bank

#156

Post by Dylan16807 »

Nursie wrote: post #13
Nextgrid wrote: post #5

Earlier quoted context omitted.

A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.

Starting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)

I've seen it once or twice ever and I didn't know the password it wanted.

Re: Is your chip card secure? Much depends on where you bank

#157

Post by watermelon0 »

dathinab wrote: post #154
reaperducer wrote: post #150

Earlier quoted context omitted.

Why is it such an inferior experience compared to Europe? Legacy hardware. Europe was late to the credit card game, so when it finally got on board it had newer gear. The Americans already had their stuff in place and it worked. Unlike computer nerds who will upgrade their computers just to feel current, businesses don't throw around money unless they have a very good reason.

I don't think so, as far as I know all "old" terminals had to be replaced or upgraded in the EU some years ago to comply with the new chip technology. Edit: so it's more about the willingness to require cost for upgrades then there being costs for upgrades, I thing.

Agreed.

A few years ago NFC terminals weren't really popular around here, but nowadays it's hard to find a terminal without the support. I think this applies for quite a few EU countries.

NFC technology is less secure, but every purchase above 25 EUR requires PIN verification, so there is a limit on how much can be stolen.

Re: Is your chip card secure? Much depends on where you bank

#158

Post by knolax »

ulfw wrote: post #155
reaperducer wrote: post #147

Earlier quoted context omitted.

upgrading the terminal is expensive It's not the terminal upgrade that's the barrier. At many businesses, if you upgrade the terminal you also have to replace the point-of-sale system. Then you have to integrate it with your existing backend sales system, fulfillment system, inventory system, and more. And you're lucky if all of that can then be integrated into your accounting system. Then you have to retrain all of…

Weird how the whole globe managed that, from small city states over third world nations to old established countries. And yet...

A lot of the third world leapfrogged to mobile payments and never had widespread credit card adoption. So it's more like 4% of the world hasn't done a thing the 10% of the world that HN perceives as "rest of the world" has done.

Re: Is your chip card secure? Much depends on where you bank

#159

Post by toolslive »

Hold on. PIN is not secure either. With the card reader, you can verify the pin locally: You don't need anything but the card and a card reader. No internet, no nothing.

Since the verification can be done on the client side entirely it's subject to hacking. You can freeze the chip, slowing it down so you can actually see it run under a microscope. You can make it read-only (so the pin miss is not recorded on the chip, aso aso).

There are recorded cases where the card also held a digital wallet and students made it read only so they had an infinite wallet for small expenses ...

Re: Is your chip card secure? Much depends on where you bank

#160

Post by hasa »

thewebcount wrote: post #137
Nursie wrote: post #113

Earlier quoted context omitted.

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retaile…

Yeah, whenever I hit one of those, I immediately back out of the transaction. I'm like, "Wait, I'm supposed to be paying business X, why am I at a different web site? Something's fishy here. Fuck this."

Actually 3DS is much more reliable than giving credit card numbers to random online merchant that will face data breach sooner or later.
Post reply on HN