5 ms·

The answer is yes, most chip cards can do public key cryptography to sign a transaction without compromising the secret key burned in. Also, more frequently th

The answer is yes, most chip cards can do public key cryptography to sign a transaction without compromising the secret key burned in. Also, more frequently than I would wish banks or payment processors ask payment terminal operators for a "simpler", meaning less secure, transaction protocol. Most often it's for compatibility with some legacy system from the 80's somewhere in their payment validation backend. From my experience in the industry, this happened very rarely in Europe but considerably more often in the Americas and Middle East.

ams6110 10y ago
A good number of the supermarkets and other retailers around me are still just swiping cards. Gas pumps of course as well. I'm guessing the added cost of the fraud liability for swiped cards is turning out to be lower than the cost to convert to chip readers.
- revelation 10y ago
  It's not the cost of conversion, it's that the fraud just vanishes in the insane rents American credit card processors extract. In the EU, these fees are limited to 0.3% for CC and 0.2% for debit cards, so there is less margin to just keep paying the fraudsters instead of updating systems.
  - bluedino 10y ago
    They have the new readers but they don't use them
    - cpncrunch 10y ago
      Notable the article is from Canada. Here in Canada virtually all retailers have been using chip+pin for a good number of years now. The same in the UK, where they have been using it for over 10 years. Retailers have to use chip+pin to avoid fraud liability. In the USA, however, a lot of retailers were still using signatures up until a year or two. It seems to be only in the last year that retailers are starting to move to chip+pin. I think it is simply the large number of credit card terminals, and the cost of upgrading them all.
      - hibikir 10y ago
        They are not moving to chip and pin, but chip and signature: very different. Now, the internet being a bigger share of retail every year, chip and pin is not an improvement: what we need is 2FA across the board. You have my CC number? Great. Without my 2FA secret, you won't be able to charge me anyway. This 2FA beats a pin, and would make payment fraud so much smaller, it'd become a minor thing, but good luck finding a bank in the US offering such feature for all charges.
        cpncrunch 10y ago
        >They are not moving to chip and pin, but chip and signature: very different. No, that's not quite true. They are moving to chip+pin, but some card issuers are not currently issuing PINs. However the machines themselves fully support chip+pin (and I can confirm this, as most places in the USA now require me to enter a PIN for my card). http://www.creditcards.com/credit-card-news/emv-faq-chip-cards-answers-1264.php http://www.creditcards.com/credit-card-news/emv-faq-chip-car...
        drewg123 10y ago
        And even if you want a PIN for your card, the credit card company doesn't know how to give it to you. Last summer, before I went to a conference in Canada, I called all 3 of my credit cards's customer service departments trying to get a PIN (American Express, Discover, MasterCard), and none of them would issue a PIN for my chip'ed card. I don't think any of the CSRs even knew what I was talking about. One even told me that PIN's were "just for debit cards". Sigh.
        kevin_thibedeau 10y ago
        I use a debit card with a pin and some retailers still do a signature transaction for me without any choice.
        Symbiote 10y ago
        Some European banks implement that second factor, although most commonly using an SMS or phone call. Mine only does it when the transaction is large, or unusual. I get a call asking me to confirm the transaction. Maybe they ask some other information, I can't remember.
- rando444 10y ago
  Actually the major card companies set deadlines and have all now shifted the liability for swiped transactions onto the retailers. So it's up to them to get their systems updated if they want protection. The only exception currently is for gas pumps, for which the liability shift has been extended until 2020.

ams6110 10y ago

A good number of the supermarkets and other retailers around me are still just swiping cards. Gas pumps of course as well. I'm guessing the added cost of the fraud liability for swiped cards is turning out to be lower than the cost to convert to chip readers.

revelation 10y ago
It's not the cost of conversion, it's that the fraud just vanishes in the insane rents American credit card processors extract. In the EU, these fees are limited to 0.3% for CC and 0.2% for debit cards, so there is less margin to just keep paying the fraudsters instead of updating systems.
- bluedino 10y ago
  They have the new readers but they don't use them
  - cpncrunch 10y ago
    Notable the article is from Canada. Here in Canada virtually all retailers have been using chip+pin for a good number of years now. The same in the UK, where they have been using it for over 10 years. Retailers have to use chip+pin to avoid fraud liability. In the USA, however, a lot of retailers were still using signatures up until a year or two. It seems to be only in the last year that retailers are starting to move to chip+pin. I think it is simply the large number of credit card terminals, and the cost of upgrading them all.
    - hibikir 10y ago
      They are not moving to chip and pin, but chip and signature: very different. Now, the internet being a bigger share of retail every year, chip and pin is not an improvement: what we need is 2FA across the board. You have my CC number? Great. Without my 2FA secret, you won't be able to charge me anyway. This 2FA beats a pin, and would make payment fraud so much smaller, it'd become a minor thing, but good luck finding a bank in the US offering such feature for all charges.
      - cpncrunch 10y ago
        >They are not moving to chip and pin, but chip and signature: very different. No, that's not quite true. They are moving to chip+pin, but some card issuers are not currently issuing PINs. However the machines themselves fully support chip+pin (and I can confirm this, as most places in the USA now require me to enter a PIN for my card). http://www.creditcards.com/credit-card-news/emv-faq-chip-cards-answers-1264.php http://www.creditcards.com/credit-card-news/emv-faq-chip-car...
        drewg123 10y ago
        And even if you want a PIN for your card, the credit card company doesn't know how to give it to you. Last summer, before I went to a conference in Canada, I called all 3 of my credit cards's customer service departments trying to get a PIN (American Express, Discover, MasterCard), and none of them would issue a PIN for my chip'ed card. I don't think any of the CSRs even knew what I was talking about. One even told me that PIN's were "just for debit cards". Sigh.
        kevin_thibedeau 10y ago
        I use a debit card with a pin and some retailers still do a signature transaction for me without any choice.
      - Symbiote 10y ago
        Some European banks implement that second factor, although most commonly using an SMS or phone call. Mine only does it when the transaction is large, or unusual. I get a call asking me to confirm the transaction. Maybe they ask some other information, I can't remember.
rando444 10y ago
Actually the major card companies set deadlines and have all now shifted the liability for swiped transactions onto the retailers. So it's up to them to get their systems updated if they want protection. The only exception currently is for gas pumps, for which the liability shift has been extended until 2020.