4 ms·

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard

by praptak 17y ago

> What else could be done simply? A simple thing that is actually being done: ATMs pulling in the card with a randomly changing speed. This makes it very hard for the skimmer to get a reliable reading. The actual reading by the ATM is done during the second phase, inside the ATM.

tptacek 17y ago
That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.
- TeHCrAzY 17y ago
  Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.
- ShabbyDoo 17y ago
  Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?
Timothee 17y ago
Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.
PanMan 17y ago
Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)
- praptak 17y ago
  The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.
  - prewett 17y ago
    There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?
    - praptak 17y ago
      "Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed." The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia. The security feature on ATMs makes it vary wildly within a single swipe.
daveungerer 17y ago
That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.

by praptak 17y ago

tptacek 17y ago

That's something companies like JPMC and Citi are doing. But there are tens of thousands of crappy Tranax deli-style ATMs out there that aren't going to change.

TeHCrAzY 17y ago
Interesting, I called my bank about this annoying "feature" and was told it is for security reasons, but never understood why (and they were unwilling or unable to inform me). Enlightening. This functionality is very common in Australia, at least in Sydney.
ShabbyDoo 17y ago
Perhaps the in-store machines are safer because it would be harder install and later retrieve the skimmer? Or, maybe an insider allows the skimmer to be installed? Aren't many small, retail ATMs owner-serviced, so no one with an incentive to audit would ever check it out?

Timothee 17y ago

Oh is that what it is? I have been wondering why my local Wells Fargo ATM was taking the card in in such a jerky fashion.

PanMan 17y ago

Why does that make it harder? It's a row of bits sliding by, right? Why does the speed matter? (I'm not saying your wrong, I'm just wondering why it would help?)

praptak 17y ago
The bits don't have "start of bit" nor "end of bit" marks. The only way the reader can know which impulse constitutes a bit is by timing.
- prewett 17y ago
  There are a lot of credit card machines where the purchases swipes the card themselves. Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed. (Like, say, putting 10101010 at the beginning, which you could use for calibration) So I'm not sure how a random speed helps things. Maybe ATM bits aren't encoded like credit cards?
  - praptak 17y ago
    "Since the speed that people swipe is going to be variable, it can't be too hard to read a card without knowing the speed." The speed just has to be fairly constant within a single swipe - then you can adjust for it. It usually is when humans do that - human hand has quite an inertia. The security feature on ATMs makes it vary wildly within a single swipe.

daveungerer 17y ago

That's a good idea. But I guess it's only a matter of time (and feasibility) before they add an optical sensor to pick up the card speed. Or more low-tech: a rubber wheel.