6 ms·

Presumably it's more secure as it shouldn't expose your credit card number to the point of sale. Given the number of major hacks in that area in recent years, t

by Zikes 11y ago

Presumably it's more secure as it shouldn't expose your credit card number to the point of sale. Given the number of major hacks in that area in recent years, that should really be the #1 touted feature of such "X Pay" systems.

RussianCow 11y ago
EMV chips more or less solve this problem, though, they just haven't caught on here in the US yet.
- usaphp 11y ago
  All of my credit card companies and banks issued me new "chipped" cards within a month or so without my request, so I am guessing they are tryingto take it serious now
  - abakker 11y ago
    FWIW, the transaction time using the chip to authorize vs apple pay is night and day. The Apple pay swipe is quick and you can put the phone back in your pocket. The chip card has to linger through the authorization process and makes the whole thing feel slow.
  - jcheng 11y ago
    EMV liability shift is why both banks and retailers suddenly got serious: http://www.emv-connection.com/understanding-the-2015-u-s-fraud-liability-shifts/ http://www.emv-connection.com/understanding-the-2015-u-s-fra...
- Swizec 11y ago
  The funny part with those chips in the US is that on most terminals I've used you can just click "Yes" instead of entering your PIN number. This gives you the option to sign for it. So it really doesn't solve the problem at all. Afaik you can't do that in Europe. At least I've never heard of it being possible.
  - LastMuel 11y ago
    That's one issue. I still cannot seem to get my mind around another, though. Conceptually, I don't grasp how possibly exposing my PIN number at a point of sale is MORE secure. I just can't get past the idea that I'm now using the number I use to withdraw funds at an ATM at MORE places than just at my bank.
    - moheeb 11y ago
      I've always had to enter my PIN when using my card...so I don't see it as any LESS secure. I doubt it will take much for you to get past it.
    - Swizec 11y ago
      You're not exposing the PIN number. Properly designed card readers make the dialpad hard to read for anyone looking over your shoulders (you obscure it with your hand and there's a guard thingy around so they can't see your fingers). And the machine itself checks the PIN against the chip. No sending anywhere, no checking by the clerk. You only have to trust the machine itself. If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? Card+signature is security by "something you have", Card+PIN is "something you have and something you know". That's much more secure. A signature isn't "something you know" because it's written on the card anyway. If it's not written on the card, then using the signature doesn't do anything in the first place. And nobody checks those signatures anyway. This is why for large purchases they ask to see your ID.
      - jessaustin 11y ago
        If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? If a machine charged you too much, either it would say so on the receipt and you could protest immediately, or the receipt wouldn't match the charge so you could protest later. Sure, the first few customers might get fucked, but soon the bad machine would be caught. OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years.
- jonknee 11y ago
  They're slow though. EMV is being rolled out in the US and it will fail because it's slower than a swipe or a tap.
  - joosters 11y ago
    When chip+pin rolled out in the UK, it noticeably sped up checkouts, it is certainly faster than signing.
    - jonknee 11y ago
      The US does a lot of swipe+pin or just swipe, but the EMV process itself takes a long time (regardless of a PIN or signing afterwards): http://www.lowcards.com/emv-transactions-slow-37884 http://www.lowcards.com/emv-transactions-slow-37884 Compared to Apple/Android Pay it's painfully slow, but it's also noticeably slower than swiping.
      - joosters 11y ago
        That page is just plain wrong. You can put the card into a reader, type your PIN in, and get your card back almost straight away. 5 seconds is possible if you don't forget your PIN! The process can be slower if the retailer uses an older system that hasn't got a permanent network connection. With some ancient terminals, you could hear a modem dialing up and talking to the bank. That was slow, but luckily those kind of terminals are now rare.
        profmonocle 11y ago
        This is anecdotal, of course - but it's been much slower than swiping at every store I've used it at. These stores were using the exact same terminals for swiping just a few months ago, so it's not the network. Hopefully it's just crappy hardware in the terminals that's not optimized for EMV. Edit: Swiping used to take 1-2 seconds to process, EMV seems to take about 10.
        mdp 11y ago
        That page is specifically talking about EMV in the US, and for whatever reason, I've never seen a EMV 'dip' that takes less than 5-10 seconds here. Target for example has consistently been around 10 seconds every time I've used EMV there and I doubt they are using dial-up.

by Zikes 11y ago

RussianCow 11y ago

EMV chips more or less solve this problem, though, they just haven't caught on here in the US yet.

usaphp 11y ago
All of my credit card companies and banks issued me new "chipped" cards within a month or so without my request, so I am guessing they are tryingto take it serious now
- abakker 11y ago
  FWIW, the transaction time using the chip to authorize vs apple pay is night and day. The Apple pay swipe is quick and you can put the phone back in your pocket. The chip card has to linger through the authorization process and makes the whole thing feel slow.
- jcheng 11y ago
  EMV liability shift is why both banks and retailers suddenly got serious: http://www.emv-connection.com/understanding-the-2015-u-s-fraud-liability-shifts/ http://www.emv-connection.com/understanding-the-2015-u-s-fra...
Swizec 11y ago
The funny part with those chips in the US is that on most terminals I've used you can just click "Yes" instead of entering your PIN number. This gives you the option to sign for it. So it really doesn't solve the problem at all. Afaik you can't do that in Europe. At least I've never heard of it being possible.
- LastMuel 11y ago
  That's one issue. I still cannot seem to get my mind around another, though. Conceptually, I don't grasp how possibly exposing my PIN number at a point of sale is MORE secure. I just can't get past the idea that I'm now using the number I use to withdraw funds at an ATM at MORE places than just at my bank.
  - moheeb 11y ago
    I've always had to enter my PIN when using my card...so I don't see it as any LESS secure. I doubt it will take much for you to get past it.
  - Swizec 11y ago
    You're not exposing the PIN number. Properly designed card readers make the dialpad hard to read for anyone looking over your shoulders (you obscure it with your hand and there's a guard thingy around so they can't see your fingers). And the machine itself checks the PIN against the chip. No sending anywhere, no checking by the clerk. You only have to trust the machine itself. If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? Card+signature is security by "something you have", Card+PIN is "something you have and something you know". That's much more secure. A signature isn't "something you know" because it's written on the card anyway. If it's not written on the card, then using the signature doesn't do anything in the first place. And nobody checks those signatures anyway. This is why for large purchases they ask to see your ID.
    - jessaustin 11y ago
      If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? If a machine charged you too much, either it would say so on the receipt and you could protest immediately, or the receipt wouldn't match the charge so you could protest later. Sure, the first few customers might get fucked, but soon the bad machine would be caught. OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years.
jonknee 11y ago
They're slow though. EMV is being rolled out in the US and it will fail because it's slower than a swipe or a tap.
- joosters 11y ago
  When chip+pin rolled out in the UK, it noticeably sped up checkouts, it is certainly faster than signing.
  - jonknee 11y ago
    The US does a lot of swipe+pin or just swipe, but the EMV process itself takes a long time (regardless of a PIN or signing afterwards): http://www.lowcards.com/emv-transactions-slow-37884 http://www.lowcards.com/emv-transactions-slow-37884 Compared to Apple/Android Pay it's painfully slow, but it's also noticeably slower than swiping.
    - joosters 11y ago
      That page is just plain wrong. You can put the card into a reader, type your PIN in, and get your card back almost straight away. 5 seconds is possible if you don't forget your PIN! The process can be slower if the retailer uses an older system that hasn't got a permanent network connection. With some ancient terminals, you could hear a modem dialing up and talking to the bank. That was slow, but luckily those kind of terminals are now rare.
      - profmonocle 11y ago
        This is anecdotal, of course - but it's been much slower than swiping at every store I've used it at. These stores were using the exact same terminals for swiping just a few months ago, so it's not the network. Hopefully it's just crappy hardware in the terminals that's not optimized for EMV. Edit: Swiping used to take 1-2 seconds to process, EMV seems to take about 10.
      - mdp 11y ago
        That page is specifically talking about EMV in the US, and for whatever reason, I've never seen a EMV 'dip' that takes less than 5-10 seconds here. Target for example has consistently been around 10 seconds every time I've used EMV there and I doubt they are using dial-up.