Offline card payments should be possible no later than 1 July 2026 • Hacker News Board

Re: Offline card payments should be possible no later than 1 July 2026

#501

Post by lxgr » Sat, Oct 04, 2025, 3:12 PM UTC

lstodd wrote: post #485

lxgr wrote: post #395

Earlier quoted context omitted.

That said, just because there is no passenger connectivity doesn't mean the airline doesn't have some, for operational reasons. Even if that's just a narrowband satellite or VHF (ACARS) link, credit card transactions take very little data (POS terminals are 80s technology, after all). That said, I still don't think that that's too common – building out cabin Wi-Fi for card authorizations only is probably not worth it…

Well while seats do have a passenger name to them, people end up in interesting places on underbooked long flights like over the Atlantic. Cabin crew sometimes gets excited if people move too much. But this is rare.

Especially when expensive in-flight shopping is involved, I'd expect cabin crews to become even more interested in wandering passengers.

Re: Offline card payments should be possible no later than 1 July 2026

#502

Post by lxgr » Sat, Oct 04, 2025, 3:14 PM UTC

mytailorisrich wrote: post #474

lxgr wrote: post #374

Earlier quoted context omitted.

Yes, stored value cards are a very mature technology. For various reasons, they're mostly used in closed-loop systems these days (think laundromats, transit systems etc.), but historically there were open-loop deployments in many European countries, and in some countries, stored-value POS payments are still very popular, e.g. in Japan. It's a real shame that the entire world moved to online-only. Sure, it's much easi…

Stored values cards were the way French public phone booths worked when they first moved away from coins in the 80s. There were single-use chip cards that you bought and kept in your wallet. Plain eeprom. I remember I built a reader for them as a teenager...

These were storage only though, right? Such systems are trivial to compromise.

Stored-value payment cards usually contain at least a secret key and some logic that allows them to establish a secure channel to another trusted entity, such as a merchant smartcard (which can be embedded in a terminal) or a backend server (and a corresponding HSM).

Re: Offline card payments should be possible no later than 1 July 2026

#503

Post by lxgr » Sat, Oct 04, 2025, 3:24 PM UTC

avianlyric wrote: post #471

lxgr wrote: post #370

Earlier quoted context omitted.

> However there has been a bit of shift towards online transactions Not just a bit of a shift: Offline-preferred transactions are basically a thing of the past. EU rules have nothing to do with it (offline EMV is fully SCA compliant as well, as the chip can keep count, although it's a bit annoying to keep counters in sync if there's more than one); it's mostly for risk management and simplification reasons, I believe…

> EU rules have nothing to do with it (offline EMV is fully SCA compliant as well, as the chip can keep count, although it's a bit annoying to keep counters in sync if there's more than one); EU rules have everything to do with it. Meeting EMV with offline counters is tricky to get right. The reason I can confidently claim the SCA drove the migration of online transactions is because I was responsible for the technic…

> The reason I can confidently claim the SCA drove the migration of online transactions is because I was responsible for the technical implementation of SCA for a bank

Ok, "nothing to do with it" was too strong: I don't doubt that SCA was the death knell for many offline implementations. However, I've seen online-only cards in the field by many banks well before SCA became effective.

And on the other hand, I also know SCA-compliant EMV implementations that do still support offline transactions. As you say it's tricky, but it's possible. Europe is large, and you probably haven't talked to every single bank/processor :)

> This is where you are simply wrong. Again speaking as someone with actual experience working on this stuff, [...] they have no way of validating that a specific card or transaction hasn’t been forged.

Huh? If you have worked on this stuff, surely DDA and CDA ring a bell? They're both based on asymmetric cryptography, and they absolutely allow the terminal to dynamically verify whether a given card is authentic or cloned, without having to go online.

Without that, you could indeed copy the static signature data from any EMV card and replay it to an offline terminal and get away with it. That's why SDA has long been deprecated for offline transactions.

> The manufacturer and distribution of the chips in cards is extremely tightly controlled, so you can’t just buy them. [...] In theory anyone with a million dollars and ASIC contract could manufacture their own ICs

You can absolutely get them on Aliexpress straight from the manufacturer for a few bucks each, cheaper in bulk. They run Java, so you can just write your own software – the EMV specs are public!

What you can't get there is the cryptographic private key specific to the card number that the issuing bank embeds into it at personalization time.

EMV is a cryptographically sound (if dated and very complex) scheme, and secrecy of implementation is actually much less of a security factor than you seem to claim, despite the industry's (largely historical) obsession with secrecy.

Re: Offline card payments should be possible no later than 1 July 2026

#504

Post by lxgr » Sat, Oct 04, 2025, 3:42 PM UTC

ifwinterco wrote: post #382

majkinetor wrote: post #330

Earlier quoted context omitted.

I always wondered how come that some online merchants where I record the card do not ask for auth or 2 factor and some other does. For example, I have recorded my card info in a webapp that I use to pay the bills, and it never asks for anything, which is good, as I have many bills to pay, and I wouldn't want spam of 2FAs. Can you provide some technical terminology on this behavior or links, since you seem to be in th…

Amazon as well seems to never do proper auth (at least here in the UK). When using an existing card where the delivery address matches the billing address, card transactions go through instantly

In my experience, they do the auth immediately before shipping, instead of at order time like almost every other online merchant.

I find that super annoying, as it's bitten me more than once in the past when I used the wrong card for a given order without instant feedback.

Re: Offline card payments should be possible no later than 1 July 2026

#505

Post by eirikbakke » Sat, Oct 04, 2025, 3:44 PM UTC

mrtksn wrote: post #9

It's not about paying by cash but paying by card offline. How is this going to be implemented I wonder. On planes they often accept credit cards even when there's no internet. I assume this is a trust in-credit-based system because they don't accept debit cards, i.e. if you are worth being trusted with a card you can have your sandwich now and we will take care of the bank processing once we are on the ground. So may…

In Norway, the card terminals usually go into an "accept with signature" mode if they are temporarily offline. So they print a receipt that the customer has to sign. (This is for BankAxept debit cards, which are standard in Norway.)

In a grocery store line once, I remember a distraught customer whose card was declined due to insufficient funds. The store manager came over, yanked the ethernet cable from the payment terminal, and told the customer to try again. "Accepted with signature."

Re: Offline card payments should be possible no later than 1 July 2026

#506

Post by lxgr » Sat, Oct 04, 2025, 3:45 PM UTC

avianlyric wrote: post #231

t_mann wrote: post #226

Would be interesting how they work technically. The linked pdf mentions an EMV chip, which I assume is some sort of TEE. Other than creating recipient-specific one-time vouchers online, I can't think of a way to do offline payments without a TEE.

Yes EMV chips and the EMV standard are secure elements that were spec’d and have been manufactured since the 80s. The EU has been using these thing pretty much universally since the late 90s. They’ve also supported offline transactions that entire time. Indeed offline transactions was the norm for a long time because internet connections were expensive. So payment terminals did offline transactions, then literally ph…

EMV has been using asymmetric cryptography for a long time now, even though it's strictly optional in the specs.

Older cards indeed didn't have it for cost reasons, and online-only cards theoretically have no strict need for it even today, but practically, a symmetric-only card is a non-starter these days for several reasons. You won't be able to ride the Tube in London or Subway in NYC with a card that does not support it, for example.

Re: Offline card payments should be possible no later than 1 July 2026

#507

Post by Sammi » Sat, Oct 04, 2025, 3:51 PM UTC

dumbfounder wrote: post #260

derefr wrote: post #243

Earlier quoted context omitted.

I think they're talking about when merchants insist that you give them cash ("cash only"), not when buyers insist on giving cash. The usual assumption is that if e.g. a street-food cart is cash-only, it's not because they can't accept cards (it's rather trivial nowadays) but rather that 1. they don't want to pay the interchange fees, and more importantly, 2. they want to be able to cook their books when reporting rev…

There are businesses that attract people that use cards fraudulently and the business gets flagged demand eventually dropped. Gas stations in less desirable neighborhoods in the US have this issue and some only take cash.

As were discussing here, swedes almost exclusively use online card transactions. Don't see much card fraud because of this.

Re: Offline card payments should be possible no later than 1 July 2026

#508

Post by iwontberude » Sat, Oct 04, 2025, 3:52 PM UTC

eirikbakke wrote: post #505

mrtksn wrote: post #9

It's not about paying by cash but paying by card offline. How is this going to be implemented I wonder. On planes they often accept credit cards even when there's no internet. I assume this is a trust in-credit-based system because they don't accept debit cards, i.e. if you are worth being trusted with a card you can have your sandwich now and we will take care of the bank processing once we are on the ground. So may…

In Norway, the card terminals usually go into an "accept with signature" mode if they are temporarily offline. So they print a receipt that the customer has to sign. (This is for BankAxept debit cards, which are standard in Norway.) In a grocery store line once, I remember a distraught customer whose card was declined due to insufficient funds. The store manager came over, yanked the ethernet cable from the payment t…

This is why I don’t snitch on anyone stealing food. Skip the line.

Re: Offline card payments should be possible no later than 1 July 2026

#509

Post by Sammi » Sat, Oct 04, 2025, 3:53 PM UTC

qingcharles wrote: post #337

Etheryte wrote: post #5

Some context might be useful here. I spent some time living Sweden not too long ago and Swedes practically don't use cash. It's usually not said out loud, but cash is often considered to be dirty and criminal, to the point that most don't have any at all. Digital payments are very convenient and deeply integrated, so long as you have a local ID which allows you use the local payment system Swish etc. This worked nice…

It's funny. I live in rural USA and I overheard a girl say she wouldn't date a guy who uses a card as it wasn't very manly. He needs to use cash apparently. Where I live cards are seen as controlled by "them" and allow the government to spy on you and come after you for taxes.

High trust vs low trust society differences.

Re: Offline card payments should be possible no later than 1 July 2026

#510

Post by knallfrosch » Sat, Oct 04, 2025, 4:22 PM UTC

esskay wrote: post #469

akmarinov wrote: post #419

Earlier quoted context omitted.

That’s because credit card benefits suck in Europe and there’s no point to using them. If you need credit, there are credit options with much lower rates than what credit cards offer. And the reason credit card benefits suck is due to european interchange fee caps and regulation.

> That’s because credit card benefits suck in Europe and there’s no point to using them. Theres still a very good reason to use them - buyer protection. I use a Virgin Atlantic reward card and have it set to pay off automatically, never running up debt. It both protects me as a buyer, and has the benefit of taking ~£500 off annual family holidays, and gives me a free companion seat in the process, effectively halving…

>has the benefit of taking ~£500 off annual family holidays, and gives me a free companion seat in the process, effectively halving the price for one of the passengers.

You know you're paying higher sticker prices to finance that, right?