8 ms·

It amazes me that cards with magstripe are still being issued. I have never needed to use magnet instead of chip despite having traveled quite a bit. I used to

by kbart 11y ago

It amazes me that cards with magstripe are still being issued. I have never needed to use magnet instead of chip despite having traveled quite a bit. I used to ask my bank to disable magstripe on my cards, but now they changed this to the default option for all new cards.

reacweb 11y ago
My magstripe is demagnetized (because my phone jacket contains a magnet). I have no problem using my card (in France).
pjc50 11y ago
It's worse than that: contactless payment has two modes, and one of them just lets you read the magswipe track 2 data (including card number) through the contactless interface. https://www.level2kernel.com/emv-glossary.html#MSDmode https://www.level2kernel.com/emv-glossary.html#MSDmode
- dzhiurgis 11y ago
  Is it used anywhere?
ptaipale 11y ago
You can also disable the magstripe simply by using a strong magnet next to it. Putting the card in the same pocket with my Android phone with a wallet case that has a magnetic "lock" seems to be enough...
- alejohausner 11y ago
  Great tip! I'll try that. ;-)
  - ptaipale 11y ago
    BTW it also works very nicely for those hotel key cards that have a magnetic stripe. You'll be safely kept away from the minibar of your room if you put your key card in the same pocket with the phone.
dmd 11y ago
I'm in Boston, and have yet to encounter a single reader that takes chips. They have started having the slot lately, but it's always taped over or there's a sign telling you not to use it. Or if you try to use it, the cashier gives you a weird look and has no idea what you're doing and tells you to swipe.
- vermontdevil 11y ago
  I'm in Indianapolis area. The chip reader requirement is spreading everywhere I go. Target, Lowes, Kroger etc. it's getting to the point now that I use the chip more than swipe per week
- hoov 11y ago
  Odd. I'm also in Boston and have to use it almost everywhere I go.
- james-skemp 11y ago
  Madison WI. Gas stations (at the pump) and grocery stores are the only places I go to that don't have or use the chips (taped over). I understand both have extra time to rollout. I assumed it had rolled out across most of the US at this point since most of the smaller places had even implemented it.
  - bbarn 11y ago
    I've actually noticed many of the pay at the pump not working with my chip card at all lately and having to go inside or use my other card that doesn't have a chip yet.
  - jrjarrett 11y ago
    I'm in Madison, too, and there are still a lot of places that don't use the chips. I was at Farm & Fleet yesterday, had to swipe, for example.
  - surge 11y ago
    I've been told that card processors will get charged more going forward if they don't implement the chips, or for non-chip transactions because of the added risk involved. That should help speed up the transition or at least activate it on those readers that have it.
chiph 11y ago
I just returned from Belgium. I made sure that all the cards I took had chips. Results were mixed: The train station kiosks recognized the cards as chip + signature even though I had a PIN for them, so I had to use the clerk to buy tickets. The payment terminals in restaurants asked for my PIN, but then rejected it. I suspect my bank (despite assurances) didn't enable it. I have no way to test my cards now that I'm back in the US, as the readers (for the stores that have them enabled) default to signature "verification". The whole situation is a mess.
- radnor 11y ago
  It's been a while, but the last time I researched credit cards for chip+pin the US didn't have any readily available - they're all chip+signature. Even though you have a PIN I can guarantee that it's only good for cash-withdrawal transactions (e.g. as a debit card or a high APR cash advance).
  - chiph 11y ago
    This was USAA, which has a lot of members living overseas, so the assumption was that they're familiar with the requirements.
- kbart 11y ago
  Authentication methods is an agreement between card and POS terminal with card having the final word. So yes, blame your bank for not configuring card parameters correctly.
Zekio 11y ago
In Denmark, everyone uses chip, it is only if the chip is damaged by a broken card, that people use the mag-stripe
0xfeba 11y ago
In the US, they are slowly rolling out chip+signature--which is no better.
kempbellt 11y ago
I'm in Seattle. You go to one store and try to swipe..."No, you have to use the chip". Next place you try to use the chip..."No, that doesn't work yet. You need to swipe it". Seems like no one is on the same page
- Someone1234 11y ago
  We had this in Europe for a few months, it was painful there too, but eventually everywhere will be chip only and the swipe will be literally removed. I understand the US is doing a slightly slower rollout so you guys might have to put up with either/or for almost a year, but once it is done you'll get used to using the chip pretty quickly. The two "big" dates for EMV in the US is Oct 2015 (liability shift: merchants) and October 2017 (liability shift: fuel dispensers and ATMs)[0]. After Oct 2017 there will be no reason for banks to issue cards with a magnetic strip at all (although they CAN for travel). In Europe some banks no longer issue cards with magnetic strips (chip only). [0] https://www.aciworldwide.com/-/media/files/other/published%20emv%20mandates_51413.pdf https://www.aciworldwide.com/-/media/files/other/published%2...
  - tekism 11y ago
    One thing I don't like about the chip is it seems to take a much longer time to authenticate. Is this the same in Europe as well? Would be nice if it was as fast as a swipe. But I rather have better security.
    - kempbellt 11y ago
      My main gripe, which is pretty trivial I guess, is that I'm so used to just swiping the card and throwing it back in my wallet. Using the chip requires leaving the card in the reader until the transaction is complete, so I've almost walked off without my card a couple times. I agree though. I'd rather have better security. I just need to adjust my habits :)
      - extrapickles 11y ago
lorenzhs 11y ago
My card (German) looks like it doesn't have a magstripe any more. It's got a black stripe on the back all right, but that's only half the usual height and has writing on it. I'm about to visit the US in a couple of weeks so we'll see if it works...
tarr11 11y ago
How secure are the chips?
- gambiting 11y ago
  Well, they literally can't be read without an authentication code from the bank, so pretty secure. Anyone can copy a whole magstripe, but the chip can't be read directly.
- PeterisP 11y ago
  There isn't any publicized actual fraud based on cloning the chips or extracting data from them - out the whole huge amount of CC fraud. They are vulnerable to a set of physical attacks e.g. etching off the surface of the chip, scanning it with sensitive microscope and attempting to deduce stored data from that (IIRC there were some proof of concept videos posted on HN a few months ago) but it's not a major risk as it (a) requires physical possession of the card, (b) takes time and is destructive, and the result is useless once the owner reports the lost/stolen card, and (c) has significant costs (rare expensive equipment, specialized skills, lots of time) that far exceed the limits on normal credit cards.
  - jevinskie 11y ago
    Does this count? http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ri...
    - PeterisP 11y ago
      This one is interesting, I had not seen it. If I'm reading this right, it still doesn't compromise the data on chip (i.e., the card cannot be copied, the limits enforced by chip are kept, etc) but allowed to modify the chip so that a physically stolen card can be used without knowing the PIN because the POS erroneously accepts a PIN verification response from another chip. This described hack seems to be impossible in recent chip implementations as well, but I'm not eager to dig through specs to check. Still, it is still similar to the chip analysis vulnerability in risk as it (a) requires physically stealing the card and modifying it - thus it doesn't enable the far more common scenarios of skimming the card by an ATM device or a person e.g. waiter; and (b) doesn't allow to clone the card, so purchases must be made quickly by people physically close to the thieves and operators doing the chip-modification, so it means a much greater chance of arresting the whole team than in the currently common fate of stolen US card data where you can just sell the data to people anonymously over internet, and they themselves can easily make cloned cards to make the risky part of actually obtaining the money/goods. A skimmed card will just work on the first try. A card modified like this is still likely to trigger "stolen, call the police" message on the POS terminal.

by kbart 11y ago

reacweb 11y ago

My magstripe is demagnetized (because my phone jacket contains a magnet). I have no problem using my card (in France).

pjc50 11y ago

It's worse than that: contactless payment has two modes, and one of them just lets you read the magswipe track 2 data (including card number) through the contactless interface. https://www.level2kernel.com/emv-glossary.html#MSDmode https://www.level2kernel.com/emv-glossary.html#MSDmode

dzhiurgis 11y ago
Is it used anywhere?

ptaipale 11y ago

You can also disable the magstripe simply by using a strong magnet next to it. Putting the card in the same pocket with my Android phone with a wallet case that has a magnetic "lock" seems to be enough...

alejohausner 11y ago
Great tip! I'll try that. ;-)
- ptaipale 11y ago
  BTW it also works very nicely for those hotel key cards that have a magnetic stripe. You'll be safely kept away from the minibar of your room if you put your key card in the same pocket with the phone.

dmd 11y ago

I'm in Boston, and have yet to encounter a single reader that takes chips. They have started having the slot lately, but it's always taped over or there's a sign telling you not to use it. Or if you try to use it, the cashier gives you a weird look and has no idea what you're doing and tells you to swipe.

vermontdevil 11y ago
I'm in Indianapolis area. The chip reader requirement is spreading everywhere I go. Target, Lowes, Kroger etc. it's getting to the point now that I use the chip more than swipe per week
hoov 11y ago
Odd. I'm also in Boston and have to use it almost everywhere I go.
james-skemp 11y ago
Madison WI. Gas stations (at the pump) and grocery stores are the only places I go to that don't have or use the chips (taped over). I understand both have extra time to rollout. I assumed it had rolled out across most of the US at this point since most of the smaller places had even implemented it.
- bbarn 11y ago
  I've actually noticed many of the pay at the pump not working with my chip card at all lately and having to go inside or use my other card that doesn't have a chip yet.
- jrjarrett 11y ago
  I'm in Madison, too, and there are still a lot of places that don't use the chips. I was at Farm & Fleet yesterday, had to swipe, for example.
- surge 11y ago
  I've been told that card processors will get charged more going forward if they don't implement the chips, or for non-chip transactions because of the added risk involved. That should help speed up the transition or at least activate it on those readers that have it.

chiph 11y ago

I just returned from Belgium. I made sure that all the cards I took had chips. Results were mixed: The train station kiosks recognized the cards as chip + signature even though I had a PIN for them, so I had to use the clerk to buy tickets. The payment terminals in restaurants asked for my PIN, but then rejected it. I suspect my bank (despite assurances) didn't enable it. I have no way to test my cards now that I'm back in the US, as the readers (for the stores that have them enabled) default to signature "verification". The whole situation is a mess.

radnor 11y ago
It's been a while, but the last time I researched credit cards for chip+pin the US didn't have any readily available - they're all chip+signature. Even though you have a PIN I can guarantee that it's only good for cash-withdrawal transactions (e.g. as a debit card or a high APR cash advance).
- chiph 11y ago
  This was USAA, which has a lot of members living overseas, so the assumption was that they're familiar with the requirements.
kbart 11y ago
Authentication methods is an agreement between card and POS terminal with card having the final word. So yes, blame your bank for not configuring card parameters correctly.

Zekio 11y ago

In Denmark, everyone uses chip, it is only if the chip is damaged by a broken card, that people use the mag-stripe

0xfeba 11y ago

In the US, they are slowly rolling out chip+signature--which is no better.

kempbellt 11y ago

I'm in Seattle. You go to one store and try to swipe..."No, you have to use the chip". Next place you try to use the chip..."No, that doesn't work yet. You need to swipe it". Seems like no one is on the same page

Someone1234 11y ago
We had this in Europe for a few months, it was painful there too, but eventually everywhere will be chip only and the swipe will be literally removed. I understand the US is doing a slightly slower rollout so you guys might have to put up with either/or for almost a year, but once it is done you'll get used to using the chip pretty quickly. The two "big" dates for EMV in the US is Oct 2015 (liability shift: merchants) and October 2017 (liability shift: fuel dispensers and ATMs)[0]. After Oct 2017 there will be no reason for banks to issue cards with a magnetic strip at all (although they CAN for travel). In Europe some banks no longer issue cards with magnetic strips (chip only). [0] https://www.aciworldwide.com/-/media/files/other/published%20emv%20mandates_51413.pdf https://www.aciworldwide.com/-/media/files/other/published%2...
- tekism 11y ago
  One thing I don't like about the chip is it seems to take a much longer time to authenticate. Is this the same in Europe as well? Would be nice if it was as fast as a swipe. But I rather have better security.
  - kempbellt 11y ago
    My main gripe, which is pretty trivial I guess, is that I'm so used to just swiping the card and throwing it back in my wallet. Using the chip requires leaving the card in the reader until the transaction is complete, so I've almost walked off without my card a couple times. I agree though. I'd rather have better security. I just need to adjust my habits :)
    - extrapickles 11y ago

lorenzhs 11y ago

My card (German) looks like it doesn't have a magstripe any more. It's got a black stripe on the back all right, but that's only half the usual height and has writing on it. I'm about to visit the US in a couple of weeks so we'll see if it works...

tarr11 11y ago

How secure are the chips?

gambiting 11y ago
Well, they literally can't be read without an authentication code from the bank, so pretty secure. Anyone can copy a whole magstripe, but the chip can't be read directly.
PeterisP 11y ago
There isn't any publicized actual fraud based on cloning the chips or extracting data from them - out the whole huge amount of CC fraud. They are vulnerable to a set of physical attacks e.g. etching off the surface of the chip, scanning it with sensitive microscope and attempting to deduce stored data from that (IIRC there were some proof of concept videos posted on HN a few months ago) but it's not a major risk as it (a) requires physical possession of the card, (b) takes time and is destructive, and the result is useless once the owner reports the lost/stolen card, and (c) has significant costs (rare expensive equipment, specialized skills, lots of time) that far exceed the limits on normal credit cards.
- jevinskie 11y ago
  Does this count? http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ring-defeated-the-secure-chip-and-pin-credit-cards/ http://arstechnica.com/tech-policy/2015/10/how-a-criminal-ri...
  - PeterisP 11y ago
    This one is interesting, I had not seen it. If I'm reading this right, it still doesn't compromise the data on chip (i.e., the card cannot be copied, the limits enforced by chip are kept, etc) but allowed to modify the chip so that a physically stolen card can be used without knowing the PIN because the POS erroneously accepts a PIN verification response from another chip. This described hack seems to be impossible in recent chip implementations as well, but I'm not eager to dig through specs to check. Still, it is still similar to the chip analysis vulnerability in risk as it (a) requires physically stealing the card and modifying it - thus it doesn't enable the far more common scenarios of skimming the card by an ATM device or a person e.g. waiter; and (b) doesn't allow to clone the card, so purchases must be made quickly by people physically close to the thieves and operators doing the chip-modification, so it means a much greater chance of arresting the whole team than in the currently common fate of stolen US card data where you can just sell the data to people anonymously over internet, and they themselves can easily make cloned cards to make the risky part of actually obtaining the money/goods. A skimmed card will just work on the first try. A card modified like this is still likely to trigger "stolen, call the police" message on the POS terminal.