EMV Switch This Week Could Threaten Many Businesses in U.S • Hacker News Board

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#51

Post by MrRadar » Thu, Oct 01, 2015, 5:56 PM UTC

wnissen wrote: post #13

QUFB wrote: post #8

Earlier quoted context omitted.

The local Walmart setup chip & signature a couple of months ago. Magstripe transactions are denied by default on my card that has the chip.

The first few times it was really slow, but recently it's only added a couple seconds to the transaction. I really think this will be a non-issue in a couple months.

It seems to me like it's only going to get worse as more people get chip cards. The cafeteria at the office where I work replaced their card machine earlier this year with a model that accepts EMV cards and since we have a lot of employees that travel internationally a good chunk of the people that work here pay with an EMV card (myself included). The increased card processing time has resulted in a noticeable increase in the wait time at the register, commonly backing up the line by 1-3 people. I recently figured out the terminal also supports NFC payments so now I use my phone with Android Pay (since it only takes 1-2 seconds vs 10-15) but I'm the only one who uses it so far and I'm not sure anyone else knows.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#52

Post by lucaspiller » Thu, Oct 01, 2015, 6:07 PM UTC

jdeibele wrote: post #22

irl_zebra wrote: post #17

Earlier quoted context omitted.

I noticed this recently as well at Walmart. Tried to swipe my card and it didn't work, swiped again and it didn't work. Finally bothered to read the error message, which was "Insert Card into Slot at Bottom of Terminal." My experience in Europe has been with Chip and PIN, I wonder why we're gravitating toward Chip and Signature.

Me, too. Found http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur... "Most card issuing banks and Visa don’t want PINs because the PINs can be stolen and used with the magnetic stripe data on the same cards (that also have a chip card) to withdraw cash from ATM machines. Banks eat the ATM fraud costs. This scenario has happened with the roll-out of chip cards with PIN – in Europe and in Canada."

I don't quite follow this... how do you use your card at an ATM if it doesn't have a PIN? In Europe cards had PINs for this, even before EMV.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#53

Post by lucaspiller » Thu, Oct 01, 2015, 6:21 PM UTC

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

In the US (even without a chip) you usually don't need to sign for smaller transactions - the shop assistant just swipes your card and it's done. This can even work on some European cards there (it did for my UK credit card).

Chip-and-PIN was invented to make card transactions more secure at a time when most transactions were 'offline', i.e. there was no direct connection from the card terminal to the issuer, so it wasn't possible to ask the issuer whether a transaction should be allowed. To attempt to combat card skimming, the chip was added, and terminals upgraded to require the PIN to be entered if the card had a chip [1].

Nowadays almost all transactions happen 'online', so the bank is asked whether the transaction should be authorised first (this is why there is sometimes a delay on terminals as they connect to the issuer). This means the issuer can run their own fraud detection before the transaction takes place. In the US they took this a step further, and just used that instead of requiring a signature to be collected for most purchases. To the end user it's an even better experience than NFC provides.

[1] This also means you have no reason to give your card to anyone, when the card needs to be inserted above/below the PIN pad, so it prevents another opportunity for skimming.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#54

Post by MrRadar » Thu, Oct 01, 2015, 6:23 PM UTC

lucaspiller wrote: post #52

jdeibele wrote: post #22

Earlier quoted context omitted.

Me, too. Found http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signatur... "Most card issuing banks and Visa don’t want PINs because the PINs can be stolen and used with the magnetic stripe data on the same cards (that also have a chip card) to withdraw cash from ATM machines. Banks eat the ATM fraud costs. This scenario has happened with the roll-out of chip cards with PIN – in Europe and in Canada."

I don't quite follow this... how do you use your card at an ATM if it doesn't have a PIN? In Europe cards had PINs for this, even before EMV.

US credit cards (both chip and non-chip) have PINs they're just used only at ATMs when taking cash advances. The article jdeibele referred to said that if you forced people to use their PINs all the time the rate of cash advance fraud would go up since it would be more likely that a skimmer would have the PIN (since there would be more opportunities to intercept it).

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#55

Post by MrRadar » Thu, Oct 01, 2015, 6:35 PM UTC

stevep98 wrote: post #21

It seems to take a couple of extra seconds to process the transaction, compared to a swipe. I'm surprised that this bothers me so much. I might use Apple Pay more often if this doesn't get improved.

That's my experience too. Fortunately most of the EMV-activated terminals I've run into also accept NFC so I've just been using Android Pay to avoid the extra hassle.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#56

Post by xmm » Thu, Oct 01, 2015, 6:58 PM UTC

slashink wrote: post #32

quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

1. I understand coming from only swipe but in my mind (Sweden) you insert your card while you perform the entire transaction as a identifier compared to swiping. That's at least how me and my friend think about it after asking him. 2. Machines in Europe has been doing this for a long time and it's never been an issue. I guess in the rare case power goes out (aren't these machines on UPS?) it you just call the provide…

3. I have seen this, some Swedbank cards will ask you to choose "konto" (debit) or "kredit" (credit). It needs to be obvious which choise to pick.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#57

Post by someguy1233 » Thu, Oct 01, 2015, 9:39 PM UTC

davb wrote: post #33

creshal wrote: post #7

It's depressing to see the US still treating EMV cards like a strange exotic novelty while Europe is already upgrading those again and moving to NFC-enabled cards after EMV has worked without any major issues for 20 years . For small, repeated transactions you just hold the card to the reader and are done in 1-3 seconds. The first transaction on each reader and random transactions every 20-50$ (and all transactions a…

> The first transaction on each reader and random transactions every 20-50$ (and all transactions above a $20 limit) will require chip+PIN verification Not necessarily. In the UK (at least, at the banks where my fiancée and I hold accounts), you need to enter your PIN: 1) On the first transaction after activating a new card 2) On transactions above £30 (~$45) starting 1st Sep 2015 (however apparently some terminals h…

I believe the fact you haven't been caught by the random transaction issue is because you use Chip&Pin a lot, which might reset the contactless counter (since it knows that you have the pin, so you're likely the card holder)

When I went to the MetroCentre the other week, I did about 5-6 contactless transactions in a day (probably somewhere around £100 spent total), by the end of the day my card got declined and I had to use Chip&Pin, so it does definitely happen in the UK, though the limits may be quite high (wonder if this may also vary based on the bank, I'm with a certain bank which refused to give me a contactless card until I had a credit check).

This is the first time since I got the card (quite a few months ago) that it was actually declined however, so it's quite a rare occurrence.

As for the EMV spec, It sounds like the terminal is the one that decides whether or not to request Chip&PIN:

During kernel processing, the kernel will determine from the acceptance environment and issuer settings in the card whether a cardholder verification is needed for the transaction. Methods that may be supported are online PIN and signature – offline PIN is not suitable due to the “card in field” timing issues.

what is the kernel?

The kernel contains interface routines, security and control functions, and logic to manage a set of commands and responses to retrieve the necessary data from a card to complete a transaction.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#58

Post by coleca » Fri, Oct 02, 2015, 12:51 AM UTC

stordoff wrote: post #41

quux wrote: post #29

EMV cards are a big improvement for security but the UX is a step big back from mag swipes. Here's an example from a recent stop at the ATM. * I dipped my card and then was told to reinsert the card and leave it in for the duration of the transaction. I wonder how long it will take for me to insert/leave by default instead of dipping. * The machine mechanically locked my card into the slot until I had taken my cash,…

Every ATM I've use in the UK will wait for you to remove the card before finishing the transaction (e.g. dispensing the receipt or cash you asked for). If you lose the card in the machine, a new one can be mailed to you (within two days IIRC), though this has never happened to anyone I know. I've never seen a "Application" choice, so I can't really comment on that. Is that US specific? Overall, I've found the UX on n…

I was talking to a manufacturer of fuel pump payment terminals and he was commenting that in the US we have spent the last 10 years training customers to dip their cards into the terminal and remove them before pumping fuel. Now the cards are going to be clamped in the terminals (in 2017) and not available until after the pump is returned. He guaranteed that it will be a nightmare with people leaving their cards behind at the pumps.

Re: EMV Switch This Week Could Threaten Many Businesses in U.S

#59

Post by toomuchtodo » Sat, Oct 03, 2015, 6:30 AM UTC

creshal wrote: post #19

pjc50 wrote: post #16

Earlier quoted context omitted.

Indeed. There were a bunch of security objections to the system by Ross Anderson et al at launch; it has turned out that EMV is not at all the weak link compared to online transactions, which are where most of the fraud is. Or skimmed ATMs, which don't seem to use the chip.

As far as I can tell, skimmers in Germany still copy the (fallback) magnet stripe and PIN, to use those in countries that don't require EMV. It's far easier than trying to break EMV chips.

Can I wipe my magstrip so only the EMV chip can be used?