6 ms·

No, they don't. They are completely insane aswell. They are like smart cards, but with the secret printed on them, visible for the world. If you want to clone t

by 1ris 10y ago

No, they don't. They are completely insane aswell. They are like smart cards, but with the secret printed on them, visible for the world. If you want to clone them you don't need a highly advanced lab, you can just remember the number. You also share said "secret" with everybody you do business with. Of course you constantly get your money stolen. You just don't notice because the loss is distributed evenly. That's why they are so expensive. I'm suprised people use such a low tech system. I wouldn't even accept such authentication system for my throw-away reddit accounts, let alone for money.

morgante 10y ago
Sure, I don't dispute that credit cards are technically very simplistic and basically don't have any security. The huge benefit of them is that almost all those security risks are externalized. If someone uses my credit card fraudulently, I don't pay any of the costs. Basically every alternative (Verified by Visa, etc.) is about shifting those liabilities back to the consumer.
- ChemicalWarfare 10y ago
  Technically "verified by visa" shifts the liability from the merchant towards the issuer.
- closeparen 10y ago
  The costs are distributed evenly, in the form of the markup on all products that covers the interchange fee and losses to charge backs. You do pay them, but in small undetectable increments all the time instead of random surprise large losses.
  - briandear 10y ago
    So kind of like insurance?
  - Hyperborian 10y ago
    Which is vastly superior to the alternative, which is taking on the liability myself and facing the possibility of being financially devastated by fraud and/or theft.
    - closeparen 10y ago
      The best alternative is a system where the bank still carries the liability but the system is harder to defraud (i.e. because it does push instead of shared secrets authorizing pull).
deleted 10y ago
[deleted]
chrisper 10y ago
Yes, but if your credit card gets stolen, it is not your money that is getting stolen. Credit card companies are okay with that. If a CC is convenient, a lot of people will use it. These companies don't care if they have to reimburse let's say 10% of all transactions. In this case convenience > security.
the_mitsuhiko 10y ago
They haven't been for a long time in the EU. All recently issued cards use two factor or are at least required to support it.
- art0rz 10y ago
  This works great, but some international merchants (some airlines in my case) don't support it yet. I've gotten my card declined with a relevant error message but no redirect to my bank's 2FA login page.
  - the_mitsuhiko 10y ago
    I think it very much depends on your bank how it handles this. I haven't had a card rejected in a very long time.
kamjam 10y ago
In the UK at least, all our payments in store above £20 require a PIN to be used (payments below £20 you can use the fairly recently introduced touch pay which just requires you to touch the card to the payment machine). If you are purchasing online, all my credit and debit card payments require me to enter 3 random characters from my (previously set up) password. Not sure what the system is like elsewhere in Europe/worldwide.
- jamessb 10y ago
  The limit for contactless payments was raised from £20 to £30 last September (and when first introduced the limit was £10) [0] [0]: http://www.bbc.co.uk/news/business-31164806 http://www.bbc.co.uk/news/business-31164806
- Amezarak 10y ago
  > If you are purchasing online, all my credit and debit card payments require me to enter 3 random characters from my (previously set up) password. Doesn't this mean your password is being stored unhashed?
- Accacin 10y ago
  It's £30 now.
- mnw21cam 10y ago
  > In the UK at least, all our payments in store above £20 require a PIN to be used... Not true (notwithstanding that it increased to £30). Some people (myself included) have opted for a chip-and-signature card instead of chip-and-pin, because it is harder for the bank to push the cost of fraud onto me that way. It's been only seven years (I think?) since chip-and-pin was introduced. It's amazing how quickly all the checkout staff have forgotten what to do when their till tells them to check the card signature. Also almost none of them actually have a pen to hand.
  - kamjam 10y ago
    Did not know the limit had been increased, and agree about checkout staff having no clue when the pin does not work (happens a fair amount with foreign cards). I've seen a lot of people in the US not sign their card and instead write "ask for ID", which seems like a much smarter move!

by 1ris 10y ago

morgante 10y ago

Sure, I don't dispute that credit cards are technically very simplistic and basically don't have any security. The huge benefit of them is that almost all those security risks are externalized. If someone uses my credit card fraudulently, I don't pay any of the costs. Basically every alternative (Verified by Visa, etc.) is about shifting those liabilities back to the consumer.

ChemicalWarfare 10y ago
Technically "verified by visa" shifts the liability from the merchant towards the issuer.
closeparen 10y ago
The costs are distributed evenly, in the form of the markup on all products that covers the interchange fee and losses to charge backs. You do pay them, but in small undetectable increments all the time instead of random surprise large losses.
- briandear 10y ago
  So kind of like insurance?
- Hyperborian 10y ago
  Which is vastly superior to the alternative, which is taking on the liability myself and facing the possibility of being financially devastated by fraud and/or theft.
  - closeparen 10y ago
    The best alternative is a system where the bank still carries the liability but the system is harder to defraud (i.e. because it does push instead of shared secrets authorizing pull).

deleted 10y ago

[deleted]

chrisper 10y ago

Yes, but if your credit card gets stolen, it is not your money that is getting stolen. Credit card companies are okay with that. If a CC is convenient, a lot of people will use it. These companies don't care if they have to reimburse let's say 10% of all transactions. In this case convenience > security.

the_mitsuhiko 10y ago

They haven't been for a long time in the EU. All recently issued cards use two factor or are at least required to support it.

art0rz 10y ago
This works great, but some international merchants (some airlines in my case) don't support it yet. I've gotten my card declined with a relevant error message but no redirect to my bank's 2FA login page.
- the_mitsuhiko 10y ago
  I think it very much depends on your bank how it handles this. I haven't had a card rejected in a very long time.

kamjam 10y ago

In the UK at least, all our payments in store above £20 require a PIN to be used (payments below £20 you can use the fairly recently introduced touch pay which just requires you to touch the card to the payment machine). If you are purchasing online, all my credit and debit card payments require me to enter 3 random characters from my (previously set up) password. Not sure what the system is like elsewhere in Europe/worldwide.

jamessb 10y ago
The limit for contactless payments was raised from £20 to £30 last September (and when first introduced the limit was £10) [0] [0]: http://www.bbc.co.uk/news/business-31164806 http://www.bbc.co.uk/news/business-31164806
Amezarak 10y ago
> If you are purchasing online, all my credit and debit card payments require me to enter 3 random characters from my (previously set up) password. Doesn't this mean your password is being stored unhashed?
Accacin 10y ago
It's £30 now.
mnw21cam 10y ago
> In the UK at least, all our payments in store above £20 require a PIN to be used... Not true (notwithstanding that it increased to £30). Some people (myself included) have opted for a chip-and-signature card instead of chip-and-pin, because it is harder for the bank to push the cost of fraud onto me that way. It's been only seven years (I think?) since chip-and-pin was introduced. It's amazing how quickly all the checkout staff have forgotten what to do when their till tells them to check the card signature. Also almost none of them actually have a pen to hand.
- kamjam 10y ago
  Did not know the limit had been increased, and agree about checkout staff having no clue when the pin does not work (happens a fair amount with foreign cards). I've seen a lot of people in the US not sign their card and instead write "ask for ID", which seems like a much smarter move!