4 ms·

Yes, now that you point it out it does seem odd. The physical presence of the card and lack of authentication are common to both methods but: - NFC reduces ris

by Veratyr 11y ago

Yes, now that you point it out it does seem odd. The physical presence of the card and lack of authentication are common to both methods but: - NFC reduces risk by limiting transactions to $100. - EMV is slower (much slower) and more cumbersome due to the requirement that a signature still be collected and the card be inserted into the terminal. This takes a minimum of 15-20s while exchanging receipts etc compared to NFC's ~1s. NFC has the same level of security while reducing risk and increasing convenience.

mikeash 11y ago
It's pretty common not to require a signature on smaller purchases. It depends on the merchant and the card, but most purchases under $50 are just swipe and go. Presumably they'll change to be insert and go. I totally agree with you that NFC wins for convenience and speed. I just don't see much of a security advantage, and it looks to me like EMV should substantially reduce in-person fraud, since you won't be able to copy them the way you can copy magnetic stripes. The card companies seem to think this way, at least: the way they're pushing EMV isn't to require it, but simply to say that if you don't have it and you participate in a fraudulent transaction, you're liable for it.
- Veratyr 11y ago
  That's true but it's still possible to make a completely unauthenticated $4000 purchase with a physically stolen US credit card. I didn't mention this earlier but NFC payments over $100 generally only require a PIN be entered but this is a relatively (to signatures) painless process and comes with the benefit of requiring something not printed on the credit card. For small payments, NFC is faster. For large payments, NFC (at least as implemented in Australia, with PIN), is significantly more secure.
  - mikeash 11y ago
    That certainly does sound better for fraud, but that's just a policy choice, not anything inherent to NFC or EMV. NFC could be without limits (I think that's how it is in the US) and EMV could require a PIN (as is typically the case in Europe). It would be interesting to see the breakdown of different types of credit card fraud. How much fraud is physically stolen card versus copied card versus online purchases? I have no real idea myself.

by Veratyr 11y ago

mikeash 11y ago

It's pretty common not to require a signature on smaller purchases. It depends on the merchant and the card, but most purchases under $50 are just swipe and go. Presumably they'll change to be insert and go. I totally agree with you that NFC wins for convenience and speed. I just don't see much of a security advantage, and it looks to me like EMV should substantially reduce in-person fraud, since you won't be able to copy them the way you can copy magnetic stripes. The card companies seem to think this way, at least: the way they're pushing EMV isn't to require it, but simply to say that if you don't have it and you participate in a fraudulent transaction, you're liable for it.

Veratyr 11y ago
That's true but it's still possible to make a completely unauthenticated $4000 purchase with a physically stolen US credit card. I didn't mention this earlier but NFC payments over $100 generally only require a PIN be entered but this is a relatively (to signatures) painless process and comes with the benefit of requiring something not printed on the credit card. For small payments, NFC is faster. For large payments, NFC (at least as implemented in Australia, with PIN), is significantly more secure.
- mikeash 11y ago
  That certainly does sound better for fraud, but that's just a policy choice, not anything inherent to NFC or EMV. NFC could be without limits (I think that's how it is in the US) and EMV could require a PIN (as is typically the case in Europe). It would be interesting to see the breakdown of different types of credit card fraud. How much fraud is physically stolen card versus copied card versus online purchases? I have no real idea myself.