3 ms·

You're not exposing the PIN number. Properly designed card readers make the dialpad hard to read for anyone looking over your shoulders (you obscure it with you

by Swizec 11y ago

You're not exposing the PIN number. Properly designed card readers make the dialpad hard to read for anyone looking over your shoulders (you obscure it with your hand and there's a guard thingy around so they can't see your fingers). And the machine itself checks the PIN against the chip. No sending anywhere, no checking by the clerk. You only have to trust the machine itself. If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? Card+signature is security by "something you have", Card+PIN is "something you have and something you know". That's much more secure. A signature isn't "something you know" because it's written on the card anyway. If it's not written on the card, then using the signature doesn't do anything in the first place. And nobody checks those signatures anyway. This is why for large purchases they ask to see your ID.

jessaustin 11y ago
If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? If a machine charged you too much, either it would say so on the receipt and you could protest immediately, or the receipt wouldn't match the charge so you could protest later. Sure, the first few customers might get fucked, but soon the bad machine would be caught. OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years.
- Swizec 11y ago
  So really it's just a matter of how sophisticated the hackers are. Add keylogger to get PINs. Add thug to get cards. Win. There's no way around trusting the machine itself.
  - tass 11y ago
    If someone physically steals a credit card, it's quite obvious to the owner of the card, and they can have it cancelled.
- kalleboo 11y ago
  > OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years Banks already correlate fraud reports to where customers have used their cards to track down offending stores that skim cards. They don't have to find the bad firmware, they just have to see "well 10 customers had their cards skimmed, and the only store they had in common was that one"
jonknee 11y ago
Credit cards get skimmed by altered machines all the time, trusting the machine is the sketchy part. The nice part with mobile payments is you only have to trust your device. I'm pretty sure a mobster hasn't found my phone in the middle of the night and altered it. I am not so sure about a POS terminal at any random store. Target's POS got owned, why should I trust anyone else? If someone hacked the terminal I use for an Apple Pay transaction what exactly would happen? It's a one time token that gets passed to the terminal and I immediately get a push update about the transaction.

by Swizec 11y ago

jessaustin 11y ago

If you don't, you're fucked anyway because who says a hacked machine will only charge as much as it says it will? If a machine charged you too much, either it would say so on the receipt and you could protest immediately, or the receipt wouldn't match the charge so you could protest later. Sure, the first few customers might get fucked, but soon the bad machine would be caught. OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years.

Swizec 11y ago
So really it's just a matter of how sophisticated the hackers are. Add keylogger to get PINs. Add thug to get cards. Win. There's no way around trusting the machine itself.
- tass 11y ago
  If someone physically steals a credit card, it's quite obvious to the owner of the card, and they can have it cancelled.
kalleboo 11y ago
> OTOH if the machine processed the current transaction correctly while sending all your codes to the bad guys, it could do so until the store noticed its bad firmware, which could take years Banks already correlate fraud reports to where customers have used their cards to track down offending stores that skim cards. They don't have to find the bad firmware, they just have to see "well 10 customers had their cards skimmed, and the only store they had in common was that one"

jonknee 11y ago

Credit cards get skimmed by altered machines all the time, trusting the machine is the sketchy part. The nice part with mobile payments is you only have to trust your device. I'm pretty sure a mobster hasn't found my phone in the middle of the night and altered it. I am not so sure about a POS terminal at any random store. Target's POS got owned, why should I trust anyone else? If someone hacked the terminal I use for an Apple Pay transaction what exactly would happen? It's a one time token that gets passed to the terminal and I immediately get a push update about the transaction.