3 ms·

I'm not convinced by their card reader at all... It would be trivial for people to intercept the PIN number when it is entered on the seller's phone. That's wh

I'm not convinced by their card reader at all... It would be trivial for people to intercept the PIN number when it is entered on the seller's phone. That's why competitor devices (iZettle, PayPal) all have a keypad and screen on the card reader itself, it lowers the possibility of interception of the PIN number. In fact, I am fairly sure that I read in the past that the credit card companies wouldn't allow this type of implementation. I would certainly feel very uncomfortable entering my PIN number into someone's phone. -- EDIT: So, from what I can tell the design of the PIN entry keypad for EMV is governed by ISO 9564[1], which states: "The PIN entry device shall be physically secured so that it is not feasible to modify its operation or extract PINs or encryption keys from it." I don't believe that entering a PIN into a phone based keypad is compliant with that. 1: https://en.wikipedia.org/wiki/ISO_9564 https://en.wikipedia.org/wiki/ISO_9564

pjc50 10y ago
This is a very good question and I wonder how they've "squared" that with the credit card companies. Is it by any chance iPhone-only? Or does it actually do a card-not-present transaction? All the normal Verifone, Ingenico etc EMV devices have built in key pads.
snowwolf 10y ago
For the types of places this device will appeal to (small businesses where individual transactions are less that £30), contactless is taking over (in the UK at least) so this is less of a concern I think.
- dbbk 10y ago
  Contactless has already taken over. But it is still possible to spend more than £30 in a small business. What happens then?
objclxt 10y ago
I don't see any indication on their website or marketing materials that they are accepting the PIN. I would be surprised if they did, because EMVCo have been firm in the past that a dedicated keypad is required. I would be interested to know whether they're either capping the amount that can be charged, or are taking some of the liability themselves. Square will also be looking to get as many people on contactless as possible, because with Apple Pay / Android Pay you can exceed the usual capped limit in the UK (I believe it's something like £30 with a regular contactless card before PIN entry is required).
- homero 10y ago
  They do clearly show a pin screen on their site though but it might just be the marketing dept
Nursie 10y ago
The only security-relates info I can find, the PCI PTS certification for the Square contactless and ICC reader, mentions a USB connection to a branded base-station, and nothing much about PIN entry. I hope they aren't trying an end-run around PCI certs?

pjc50 10y ago

This is a very good question and I wonder how they've "squared" that with the credit card companies. Is it by any chance iPhone-only? Or does it actually do a card-not-present transaction? All the normal Verifone, Ingenico etc EMV devices have built in key pads.

snowwolf 10y ago

For the types of places this device will appeal to (small businesses where individual transactions are less that £30), contactless is taking over (in the UK at least) so this is less of a concern I think.

dbbk 10y ago
Contactless has already taken over. But it is still possible to spend more than £30 in a small business. What happens then?

objclxt 10y ago

I don't see any indication on their website or marketing materials that they are accepting the PIN. I would be surprised if they did, because EMVCo have been firm in the past that a dedicated keypad is required. I would be interested to know whether they're either capping the amount that can be charged, or are taking some of the liability themselves. Square will also be looking to get as many people on contactless as possible, because with Apple Pay / Android Pay you can exceed the usual capped limit in the UK (I believe it's something like £30 with a regular contactless card before PIN entry is required).

homero 10y ago
They do clearly show a pin screen on their site though but it might just be the marketing dept

Nursie 10y ago

The only security-relates info I can find, the PCI PTS certification for the Square contactless and ICC reader, mentions a USB connection to a branded base-station, and nothing much about PIN entry. I hope they aren't trying an end-run around PCI certs?