Live data from Hacker News

Chipotle Reports Findings from Investigation of Payment Card Security Incident

chipotle.com

51–60 of 73 posts

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#51
post #31

Earlier quoted context omitted.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Weirdly, I've only really noticed this in the US. Back in Australia where we've been using chips for about a decade, I rarely remember it taking more than a couple of seconds, certainly not 10. We also have contactless payment on most of our credit cards (as in built into the card, not Android/Apple Pay) and support for it on ~90% of terminals as well though so it's not much used anymore.

Likewise in New zealand. I've always heard the argument that the US is bigger so it's harder to change (for everything - POS, the metric system, any kind of regulation etc).

Even after a decade in the US it amuses me that NASA can run a fleet of vehicles on Mars, that the country produced places like silicon valley, and that American ideology is one of entrepreneurship/innovation but as a country we struggle with changes the rest of the world has decided are worth the effort.

It makes me wonder what the US would be like if we weren't still wasting huge sums of money on healthcare and credit card fraud etc!

Of course some may say that the US is what it is because of these things...

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#52
post #5

Hopefully this pushes more and more restaurants towards using separate chip-reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to-point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

You can do EMV in under 4 seconds. Source: https://squareup.com/townsquare/weve-chipped-away-at-emv-tra... and http://www.digitaltransactions.net/news/story/With-an-Update...

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#53
post #42
post #38

Earlier quoted context omitted.

That's a massive list. 2249 restaurants.

I am appalled at the attempt by Chipotle to downplay the scope and scale of the incident. The sentence which reads, " Not all locations were involved, and the specific time frames vary by location", is a blatant attempt to deflate the significance of the problem. This public disclosure should have been more direct, and disclose in plain language the number of stores affected. Chipotle should explain the full impact i…

I think there are around 3,000 total restaurants, so that's 75% affected...

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#54
post #31

Earlier quoted context omitted.

Weirdly, I've only really noticed this in the US. Back in Australia where we've been using chips for about a decade, I rarely remember it taking more than a couple of seconds, certainly not 10. We also have contactless payment on most of our credit cards (as in built into the card, not Android/Apple Pay) and support for it on ~90% of terminals as well though so it's not much used anymore.

American card terminals pretty much universally suck compared to everywhere else in the western world so it's not that surprising to me. According to staff at a few shops in my area when asked why they always ask if tap to pay is ok they said a lot of people still don't allow them to tap and insist on chip+pin still.

It's not done right unless there's a 1200 baud modem somewhere in the chain.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#55
post #7
post #4

Earlier quoted context omitted.

A ton of POS systems run on windows. Most on windows xp embedded

In the industry I am in (mostly grocery, convenience, some specialty retail), most have moved to at least POSReady 7, and some are looking at Windows 10, though there are other concerns with PCI compliance there. Most of the large retailers are pretty good about keeping these things away from the general Internet, but once an attacker is in your network, most bets are off. The most important thing to do is to look fo…

> Windows 10

I'd be worried about the system rebooting to do a system update while I turn my back for a minute to help a customer.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#56
post #36

Why is there no legal recourse here outside of spending my own time/resources to cancel cards and deal with all the BS that occurs with that whenever this happens? There should be financial repercussions, each affected individual should be awarded monetary compensation for their time.

I believe that since Chipotle was still using magstripe credit card readers that they are now financially liable for any fraudulent charges on your account.

A bit misleading- Chipotle is responsible for Chipotle transactions that get disputed as fraudulent. Not just any fraudulent charges (subsequent transactions occurring after a swipe at Chipotle).

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#57
post #5

Hopefully this pushes more and more restaurants towards using separate chip-reader (EMV) pinpad devices. I've noticed several area restaurants switching lately (Arby's, Wendy's), and I hope it continues. These devices use point-to-point encryption, meaning that even if the POS machine is comprimised, no sensitive card data can be stolen. The POS machine never sees raw card data.

Chipreaders are terribly slow, I don't understand how they could not develop a secure payment system without 10-second~ delay times. My local grocery store installed new chip readers and within a week had taped over time in favor of the more-expensive but quicker stripe processing.

Have you used Square's chip reader? Wicked fast recently.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#58
post #42

Earlier quoted context omitted.

I am appalled at the attempt by Chipotle to downplay the scope and scale of the incident. The sentence which reads, " Not all locations were involved, and the specific time frames vary by location", is a blatant attempt to deflate the significance of the problem. This public disclosure should have been more direct, and disclose in plain language the number of stores affected. Chipotle should explain the full impact i…

They are international now, right? I at least think I have memory of running across them in Canada. The file name in question (thanks, heywire) is "us.json". I'm left wondering whether and how much of an international scope there might be to this. While the version of their web site that I'm receiving by default seems to be geo-centric to the U.S. and doesn't mention foreign locations, Wikipedia has: https://en.wikip…

There's a Canada one at the least, too. https://drpma142ptgxf.cloudfront.net/assets/campaigns/2017-s...

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#59
post #50
post #47

Earlier quoted context omitted.

Leaving you without a card for 7-10 business days.

No, this generally doesn't involve immediately cancelling your existing card, sending you a new card and canceling the old one when it arrives is a much smoother experience. Who doesn't ship next day anyway?

Me experience is that at the first evidence of fraud or compromise the card is cancelled. The replacement arrives 7-10 days later. I'm sure it depends on the issuer, but banks in the US tend to a lowest common denominator customer experience.

Re: Chipotle Reports Findings from Investigation of Payment Card Security Incident

#60
post #50
post #47

Earlier quoted context omitted.

Leaving you without a card for 7-10 business days.

No, this generally doesn't involve immediately cancelling your existing card, sending you a new card and canceling the old one when it arrives is a much smoother experience. Who doesn't ship next day anyway?

Chase didn't bother sending me my chip-and-pin card before canceling my old one. Took a week to get the replacement.

Pissed me off to hell since the previous card was less than a year old and they should have just issued me the chipped card then.

Post reply on HN