3 ms·

No way to batch the transactions, because they need to be online to validate the card. While you could potentially batch card-stripe data for later use, (1) you

No way to batch the transactions, because they need to be online to validate the card. While you could potentially batch card-stripe data for later use, (1) you shouldn't even build that capability into your POS system because it would be a major hacking vector, and (2) you can't do so with chip data since the chip needs to be there to perform a calculation with its embedded key. You're right that disrupting wifi is easy enough, if such an attack actually became common, it's also easy to detect what/who is causing the disruption if you have reason to look for such. Or even easier to just hard-wire your POS terminal.

gst 9y ago
Offline chip and pin transactions are possible and are also used (at least in Europe). Due to security reasons they are usually only used for lower amounts and IIRC there's a maximum total amount that the chip is willing to sign without an online transaction in between. See https://www.aciworldwide.com/-/media/files/collateral/trends/emv_online_versus_offline_pin_validation_and_transaction_authorization_tl_us_1112_5058.pdf https://www.aciworldwide.com/-/media/files/collateral/trends... for some additional information.
cesarb 9y ago
> you can't do so with chip data since the chip needs to be there to perform a calculation with its embedded key. EMV has optional offline modes, where the calculations performed by the chip are saved by the terminal to be sent later.
geofft 9y ago
> No way to batch the transactions, because they need to be online to validate the card. While you could potentially batch card-stripe data for later use, (1) you shouldn't even build that capability into your POS system because it would be a major hacking vector Is this your opinion as an end user thinking about the system from first principles, or the actual consensus of the industry about how things actually work? A quick Google for 'offline credit card transaction' brings up a huge number of links to POS vendors explaining how to do exactly this, as far as I can tell. Is it referring to something different?
tdeck 9y ago
Square has an offline mode that does this. Cards are queued up and authed when the device goes back online. The merchant accepts liability for declines, but it's a good deal in exchange for being able to run their business in remote locations or during some kind of outage. It has to be explicitly enabled so you can't just trigger it by knocking out WiFi.

gst 9y ago

Offline chip and pin transactions are possible and are also used (at least in Europe). Due to security reasons they are usually only used for lower amounts and IIRC there's a maximum total amount that the chip is willing to sign without an online transaction in between. See https://www.aciworldwide.com/-/media/files/collateral/trends/emv_online_versus_offline_pin_validation_and_transaction_authorization_tl_us_1112_5058.pdf https://www.aciworldwide.com/-/media/files/collateral/trends... for some additional information.

cesarb 9y ago

> you can't do so with chip data since the chip needs to be there to perform a calculation with its embedded key. EMV has optional offline modes, where the calculations performed by the chip are saved by the terminal to be sent later.

geofft 9y ago

> No way to batch the transactions, because they need to be online to validate the card. While you could potentially batch card-stripe data for later use, (1) you shouldn't even build that capability into your POS system because it would be a major hacking vector Is this your opinion as an end user thinking about the system from first principles, or the actual consensus of the industry about how things actually work? A quick Google for 'offline credit card transaction' brings up a huge number of links to POS vendors explaining how to do exactly this, as far as I can tell. Is it referring to something different?

tdeck 9y ago

Square has an offline mode that does this. Cards are queued up and authed when the device goes back online. The merchant accepts liability for declines, but it's a good deal in exchange for being able to run their business in remote locations or during some kind of outage. It has to be explicitly enabled so you can't just trigger it by knocking out WiFi.