Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is your chip card secure? Much depends on where you bank

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 180 posts

Re: Is your chip card secure? Much depends on where you bank

#41

Post by eli »

lsllc wrote: post #40
abrowne wrote: post #35

Earlier quoted context omitted.

My understanding for part of it is that magstip readers were much more common in the US, and businesses (a) didn't want to pay to upgrade all their terminals and (b) don't want to turn away a purchase because a customer doesn't have a chip or the chip isn't working.

That may have been the case, but pretty much everywhere I go stores have newer EMV capable terminals (e.g Ingenico etc). The only place I really use mag swipe now is a gas station pump (who have no excuse not to switch to contactless EMV). You'd think with COVID-19, there'd be a rush to move to contactless payments.

A lot of people think COVID-19 is indeed the thing that will tip this into the mainstream default: https://www.bankingdive.com/news/will-covid-19-push-contactl...

Re: Is your chip card secure? Much depends on where you bank

#42

Post by hocuspocus »

rblatz wrote: post #27
lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

European customers aren't liable for fraudulent charges either, I don't really understand your logic here.

Everyone pays the price of fraud and it's probably one major reason that explains high interchange fees in the US.

Re: Is your chip card secure? Much depends on where you bank

#43

Post by lsllc »

lmilcin wrote: post #4

Hi. I have worked for one of the acquirers (card acceptors) for couple of years, designing and implementing credit card terminals and security infrastructure. I was also security officer. Basically, credit cards can be very secure. But it also costs. Banks do simple cost/benefit decisions and may in many cases significantly lag behind in technology for various reasons. They get away with this because consumers have a…

I think the bigger issue is not the terminals themselves, but the software behind it that's designed to process the payment from the track data.

Contactless magstripe (MSD) is a workaround that allows for a contactless payment, but really is just sending the same (insecure) track data through the backend software. Contactless EMV is the right way, but requires more sophisticated software.

Re: Is your chip card secure? Much depends on where you bank

#44

Post by gruez »

8K832d7tNmiQ wrote: post #34
im3w1l wrote: post #2

What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.

Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. I don’t know about other countries, but this is basically the premise of QRIS Technology [0] used in Indonesia, basically to put an end on competing in QR-based payment method. [0]: https://www.bi.go.id/QRIS/Contents/Default.aspx

The one thing I like about the credit card system (as opposed to "app" pay system) is that the usability is so much better. You don't have to worry about your phone being smashed or running out of battery. It's also less work than a phone, all you need to do is wave your card in front of a reader. No need to get out your phone, unlock it, open the app, wave around your camera so it scans, and finally confirming the payment. Not having to install a potentially privacy invading app is also a plus.

Re: Is your chip card secure? Much depends on where you bank

#45

Post by pc86 »

LeifCarrotson wrote: post #39
humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card…

> the fault isn't with the victim nor really with the perpetrator

The perpetrator isn't at fault?

Re: Is your chip card secure? Much depends on where you bank

#46

Post by IshKebab »

LeifCarrotson wrote: post #39
humaniania wrote: post #28

Earlier quoted context omitted.

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card…

> If a transaction doesn't get made because it was over $40, that represents unacceptable missed profit

Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit".

Re: Is your chip card secure? Much depends on where you bank

#47

Post by C1sc0cat »

hocuspocus wrote: post #42
rblatz wrote: post #27

Earlier quoted context omitted.

But also banks take on all the liability for misuse. Customers aren’t liable for fraudulent charges, that’s why America has lagged behind Europe on rolling out chip cards, customers don’t demand it because they don’t pay the price for card fraud.

European customers aren't liable for fraudulent charges either, I don't really understand your logic here. Everyone pays the price of fraud and it's probably one major reason that explains high interchange fees in the US.

IN Europe the liability shifted to the non complying partner - which helped takeup.

Re: Is your chip card secure? Much depends on where you bank

#48

Post by penagwin »

lsllc wrote: post #40
abrowne wrote: post #35

Earlier quoted context omitted.

My understanding for part of it is that magstip readers were much more common in the US, and businesses (a) didn't want to pay to upgrade all their terminals and (b) don't want to turn away a purchase because a customer doesn't have a chip or the chip isn't working.

That may have been the case, but pretty much everywhere I go stores have newer EMV capable terminals (e.g Ingenico etc). The only place I really use mag swipe now is a gas station pump (who have no excuse not to switch to contactless EMV). You'd think with COVID-19, there'd be a rush to move to contactless payments.

Yeah I actually choose gas stations that support contact less payments. No card contact + one disposable glove is the way to go.

Overkill.. Maybe? But it costs me nothing so I'll take the peice of mind.

Re: Is your chip card secure? Much depends on where you bank

#49

Post by Shivetya »

Nursie wrote: post #8

So this effectively lets you use chip data to recreate a magnetic stripe, which passes validation when the banks don't check against the right CVV. Yeah, not great. OTOH I worked on an early EMV implementation almost 20 years ago now, and it was obvious even then that mag stripe was a huge security problem. I'm amazed we're still talking about mag stripes and issuing cards with them in 2020. They should have been ret…

First I would love to find a way to find which banks or processors are vulnerable.

Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

Post reply on HN