5 ms·

I really like the idea behind Square, but are customers really going to trust a dongle hanging out the end of someone's phone? Whats to stop someone reverse eng

I really like the idea behind Square, but are customers really going to trust a dongle hanging out the end of someone's phone? Whats to stop someone reverse engineering the dongle and creating a spoofed client that just records the data instead of performing a charge?

mortenjorck 17y ago
A valid concern, but a dishonest merchant can easily enough skim your credit card already. Ever since the proliferation of camera phones, it's not been hard for a bad employee to instantly and stealthily copy your card's information. To step back a bit: I love how elegantly Square has adapted the market's current de facto e-payment option, but I have to wonder if that's really the way forward. If Square is really in it for the long haul, they'll probably do a Netflix: build a solid business on applying good UX to the current technology, then use that leverage to pioneer in the next paradigm.
- pyre 17y ago
  > Ever since the proliferation of camera phones, it's not been hard for a bad employee to instantly and stealthily copy your card's information. Not only that, I remember hearing years ago about a scam where a cashier had a PDA and was swiping the cards twice that came through the register, once in the register and once in a card reader attached to the PDA.
cschneid 17y ago
So? That's already a risk every time your card leaves your sight. The details on the strip aren't much more than what's on the front of the card. I know I had access to people's cards back when I worked retail. The store-copy of receipts had full card number, name, and expiration date. This device is the least of your security worries when it comes to a credit card.
- bmalicoat 17y ago
  Not sure how long ago you worked in retail (hopefully a long time ago) but that practice is now illegal under US Federal law. This isn't to refute your point since credit cards carry little risk, a lot less than carrying around cash anyway.
  - cschneid 17y ago
    Is it? Interesting. It was 7 or 8 years ago now.
- qeorge 17y ago
  I agree, but technically this is not true: The details on the strip aren't much more than what's on the front of the card. The magnetic stripe gives you Track 2 data, which you can't read of the card without a machine.
qeorge 17y ago
I could see this being a great tool for electricians, plumbers, and other in home service persons. There is already a high degree of trust there, and certainly anyone who understands what reverse engineering a dongle entails also understands why the alternatives are equally vulnerable to fraud.
gte910h 17y ago
Who cares? This is already a solved problem with credit card laws (the very limited liability you suffer by some random dude stealing the number)
- pyre 17y ago
  See: http://news.ycombinator.com/item?id=1129797 http://news.ycombinator.com/item?id=1129797
- KWD 17y ago
  But what about those that use debit cards. Not the same protection, and much more chance for harm.
  - gte910h 17y ago
    I would say that's probably why you shouldn't.
bmalicoat 17y ago
A while ago 20/20 or Dateline did a special on a wearable ankle reader. Waiters would pretend to drop the card and on the way back from picking it up would covertly scan it on their ankle. This technique plus ATM skimmers mean this type of thing happens already. If you monitor your credit card and report the number stolen or compromised soon enough you shift most of the liability away from yourself.
brandonkm 17y ago
You bring up a really good point. There is definitely a perception gap square needs to overcome before a device like that is trusted by consumers on a wide scale. When someone buys something from a mall kiosk, the mini credit card machine is probably perceived as more secure and trustworthy than a square device on a iPhone. Theres no doubt that the concept and execution of square is ahead of the curve, but there certainly exists an array of intangibles that may prevent it from gaining critical mass.

mortenjorck 17y ago

A valid concern, but a dishonest merchant can easily enough skim your credit card already. Ever since the proliferation of camera phones, it's not been hard for a bad employee to instantly and stealthily copy your card's information. To step back a bit: I love how elegantly Square has adapted the market's current de facto e-payment option, but I have to wonder if that's really the way forward. If Square is really in it for the long haul, they'll probably do a Netflix: build a solid business on applying good UX to the current technology, then use that leverage to pioneer in the next paradigm.

pyre 17y ago
> Ever since the proliferation of camera phones, it's not been hard for a bad employee to instantly and stealthily copy your card's information. Not only that, I remember hearing years ago about a scam where a cashier had a PDA and was swiping the cards twice that came through the register, once in the register and once in a card reader attached to the PDA.

cschneid 17y ago

So? That's already a risk every time your card leaves your sight. The details on the strip aren't much more than what's on the front of the card. I know I had access to people's cards back when I worked retail. The store-copy of receipts had full card number, name, and expiration date. This device is the least of your security worries when it comes to a credit card.

bmalicoat 17y ago
Not sure how long ago you worked in retail (hopefully a long time ago) but that practice is now illegal under US Federal law. This isn't to refute your point since credit cards carry little risk, a lot less than carrying around cash anyway.
- cschneid 17y ago
  Is it? Interesting. It was 7 or 8 years ago now.
qeorge 17y ago
I agree, but technically this is not true: The details on the strip aren't much more than what's on the front of the card. The magnetic stripe gives you Track 2 data, which you can't read of the card without a machine.

qeorge 17y ago

I could see this being a great tool for electricians, plumbers, and other in home service persons. There is already a high degree of trust there, and certainly anyone who understands what reverse engineering a dongle entails also understands why the alternatives are equally vulnerable to fraud.

gte910h 17y ago

Who cares? This is already a solved problem with credit card laws (the very limited liability you suffer by some random dude stealing the number)

pyre 17y ago
See: http://news.ycombinator.com/item?id=1129797 http://news.ycombinator.com/item?id=1129797
KWD 17y ago
But what about those that use debit cards. Not the same protection, and much more chance for harm.
- gte910h 17y ago
  I would say that's probably why you shouldn't.

bmalicoat 17y ago

A while ago 20/20 or Dateline did a special on a wearable ankle reader. Waiters would pretend to drop the card and on the way back from picking it up would covertly scan it on their ankle. This technique plus ATM skimmers mean this type of thing happens already. If you monitor your credit card and report the number stolen or compromised soon enough you shift most of the liability away from yourself.

brandonkm 17y ago

You bring up a really good point. There is definitely a perception gap square needs to overcome before a device like that is trusted by consumers on a wide scale. When someone buys something from a mall kiosk, the mini credit card machine is probably perceived as more secure and trustworthy than a square device on a iPhone. Theres no doubt that the concept and execution of square is ahead of the curve, but there certainly exists an array of intangibles that may prevent it from gaining critical mass.