3 ms·

Articles like this ("chip cards are annoying and they're pointless because we aren't using pins") keep coming out lately, but I think it's important to consider

Articles like this ("chip cards are annoying and they're pointless because we aren't using pins") keep coming out lately, but I think it's important to consider two facts. 1) The user experience is mostly only bad because it's not clear whether terminals accept the chips or not. Once everyone has chip cards this will be a nonissue. 2) Chip and pin cards in Europe have had serious problems with attacks that make it possible to use a small device between the card and terminal to use stolen cards without knowing the pin, making the whole pin system fairly pointless. Chip cards still provide a lot of security, and chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table. Anyway, in my opinion the bigger issue is that chip cards do nothing to secure internet transactions. This is sort of a shame, but it would require much more effort on the part of the credit card processors, merchants, and banks to fix.

Symbiote 10y ago
For (2), is there any evidence that these attacks have been carried out? I know researchers have demonstrated "stealing" low-value things, like a coffee, in an offline transaction. That's not especially useful for criminals. > chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table In Europe, that was seen as a problem — waiters weren't (aren't?) trusted not to record the card number for future use. A device like this [1] can sign a transaction, but at least the British banks only use it for online banking (logging in, making a transfer and/or adding a new destination for a transfer). [1] https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program
drdaeman 10y ago
> chip cards do nothing to secure internet transactions While not today, NFC-enabled cards may change this (using snartphones as networked readers). Probably with much less effort, than needed to fix the offline stuff, because 3D-Secure is already a thing and adding physical card possession doesn't seem to be a hard problem (again, only for NFC-enabled cards)
tdkl 10y ago
> continue the system where waiters take the card to terminal away from the table. There are portable POS terminals you know. Most of the time the portable device is used first for ordering, where the waiter enters the order, kitchen receives it and the billing software makes the receipt ready. When the guest is ready to pay, he uses the card right beside the guest. Btw, this existed in EU for years now.
- superuser2 10y ago
  Yeah, Americans restaurants could easily (and cheaply) have adopted Square years ago. They are just very resistant to change and not inclined to spend their already thin margins or take risks on technology.
superuser2 10y ago
It doesn't matter when everyone has chip cards - it matters when merchants decide to enable chip functionality on the terminals they have already paid for and installed. The overwhelming majority of retail establishments near me have not. I think the solution to online payments is something like Apple Pay coming to all platforms.

Symbiote 10y ago

For (2), is there any evidence that these attacks have been carried out? I know researchers have demonstrated "stealing" low-value things, like a coffee, in an offline transaction. That's not especially useful for criminals. > chip+signature allows restaurants to continue the system where waiters take the card to terminal away from the table In Europe, that was seen as a problem — waiters weren't (aren't?) trusted not to record the card number for future use. A device like this [1] can sign a transaction, but at least the British banks only use it for online banking (logging in, making a transfer and/or adding a new destination for a transfer). [1] https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program

drdaeman 10y ago

> chip cards do nothing to secure internet transactions While not today, NFC-enabled cards may change this (using snartphones as networked readers). Probably with much less effort, than needed to fix the offline stuff, because 3D-Secure is already a thing and adding physical card possession doesn't seem to be a hard problem (again, only for NFC-enabled cards)

tdkl 10y ago

> continue the system where waiters take the card to terminal away from the table. There are portable POS terminals you know. Most of the time the portable device is used first for ordering, where the waiter enters the order, kitchen receives it and the billing software makes the receipt ready. When the guest is ready to pay, he uses the card right beside the guest. Btw, this existed in EU for years now.

superuser2 10y ago
Yeah, Americans restaurants could easily (and cheaply) have adopted Square years ago. They are just very resistant to change and not inclined to spend their already thin margins or take risks on technology.

superuser2 10y ago

It doesn't matter when everyone has chip cards - it matters when merchants decide to enable chip functionality on the terminals they have already paid for and installed. The overwhelming majority of retail establishments near me have not. I think the solution to online payments is something like Apple Pay coming to all platforms.