3 ms·

We are talking about the credit/debit cards with chips. right? https://en.wikipedia.org/wiki/Smart_card https://en.wikipedia.org/wiki/Smart_card This is becomi

We are talking about the credit/debit cards with chips. right? https://en.wikipedia.org/wiki/Smart_card https://en.wikipedia.org/wiki/Smart_card This is becoming standard in the USA. I am glad to know that this is how they work.

digi_owl 9y ago
He lives in Estonia, that is a very "strange" place when it comes to the use of public key encryption. Most places using chips for payment is a continuation of the magnetic strip and pin, only that now the chip can attempt to verify that the payment terminal and bank connection is functioning correctly before accepting the pin and approving the transaction details the terminal is sending to the bank. In the end the transactions are basically ledger entries, be them manual or digital.
- corpMaverick 9y ago
  So the ones used in the USA are susceptible to a man in the middle attack? i.e. Somebody stealing the CC, pin or other secret while using a merchants terminal.
  - digi_owl 9y ago
    Yes and no. A chip can't be copied like a mag strip can, so it is safe from the classic skimmers. Also a pin is worthless on its own. I have however read about a kind of mitm attack that was demoed in the UK. It involved a device sitting between the card and the terminal, and it made the chip think the terminal was doing a signature payment, while the terminal thought the chip had validated the pin.
Strom 9y ago
In my case the smart card is a mandatory government issued ID. [1] I use it to sign more than just banking transactions. Indeed I use it pretty much everywhere where classically a pen signature was used. However the concept is more generic than that. Banks could easily supply customers with their own smart cards to do this. Indeed chipped credit cards could be used for this. Although as others have noted, these chipped credit cards still have the classic card numbers printed on them which act as the private key. My local banks also supply chipped credit cards, however you can disable transactions with just the numbers via a checkbox on the bank's website. Surprisingly some banks already disable it by default, so you have to go out of your way to enable transactions with just the numbers. -- [1] https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card

digi_owl 9y ago

He lives in Estonia, that is a very "strange" place when it comes to the use of public key encryption. Most places using chips for payment is a continuation of the magnetic strip and pin, only that now the chip can attempt to verify that the payment terminal and bank connection is functioning correctly before accepting the pin and approving the transaction details the terminal is sending to the bank. In the end the transactions are basically ledger entries, be them manual or digital.

corpMaverick 9y ago
So the ones used in the USA are susceptible to a man in the middle attack? i.e. Somebody stealing the CC, pin or other secret while using a merchants terminal.
- digi_owl 9y ago
  Yes and no. A chip can't be copied like a mag strip can, so it is safe from the classic skimmers. Also a pin is worthless on its own. I have however read about a kind of mitm attack that was demoed in the UK. It involved a device sitting between the card and the terminal, and it made the chip think the terminal was doing a signature payment, while the terminal thought the chip had validated the pin.

Strom 9y ago

In my case the smart card is a mandatory government issued ID. [1] I use it to sign more than just banking transactions. Indeed I use it pretty much everywhere where classically a pen signature was used. However the concept is more generic than that. Banks could easily supply customers with their own smart cards to do this. Indeed chipped credit cards could be used for this. Although as others have noted, these chipped credit cards still have the classic card numbers printed on them which act as the private key. My local banks also supply chipped credit cards, however you can disable transactions with just the numbers via a checkbox on the bank's website. Surprisingly some banks already disable it by default, so you have to go out of your way to enable transactions with just the numbers. -- [1] https://en.wikipedia.org/wiki/Estonian_ID_card https://en.wikipedia.org/wiki/Estonian_ID_card