7 ms·

Bleh. I hate to see all this new tech trying to drag the credit card infrastructure into the 21st century. The way credit cards work is exactly wrong— to make

by Cushman 16y ago

Bleh. I hate to see all this new tech trying to drag the credit card infrastructure into the 21st century. The way credit cards work is exactly wrong— to make a purchase, I have to hand over every single piece of information the merchant needs to convince my bank to give them money. Then they ask the bank for as much money as they want. My bank will /maybe/, in extreme cases, double check with me if I actually want to give it to them. Now that smartphones are everywhere, we finally have the tech to implement electronic payments the way they should be— where the merchant provides me with /their/ id, and then /I/ tell my bank to make a payment. But no, not today. "Card 2.0" makes my financial information more secure right up until the moment I swipe it, at which point it's just as stupid and broken as classic credit cards. Not intending any offense towards the founders, but I hope the era of your tech is short-lived.

thinkcomp 16y ago
I agree. I'm biased, but I think phone-based technology is clearly better. (I run http://www.facecash.com http://www.facecash.com)
- Cushman 16y ago
  It's a step in the right direction, but (please correct me if I'm wrong) your system still seems to be merchant-initiated. I'm using my phone as a glorified piece of paper; the merchant scans my barcode and processes the transaction on their hardware, the same way they would with plastic. That still seems ridiculous when my phone itself is a device capable of handling the transaction, yes? I should be scanning the register's barcode. I should be able to see what I'm paying for on my phone as it rings up. I should be able to authorize the payment using whatever securities I want on hardware that I own. I should be able to complete the entire transaction and walk out of the store without ever giving the merchant any information besides what bank I use. All of that is completely possible with today's tech. Who decided that the future of electronic payment is a debit card in a different form factor?
  - hugh3 16y ago
    Downsides of your idea: 1. Not everyone has, or wants, a smartphone. My phone doesn't even have a camera. People who work in certain high-security environments aren't even allowed to own phones with cameras. 2. Supposing hypothetically that I'm gonna have to "upgrade" to a smartphone at some stage, do I want to carry it around all the time? I always take my wallet, but I don't always take my phone. A phone is a much larger, heavier thing to carry around than a credit card. 3. When I do have my phone with me, it always seems to run out of batteries at an inconvenient time. I'd hate for the "completely uncontactable" problem to be compounded by the "you don't have any money" problem. 4. What happens when my phone (which I am now forced to carry around all the time and religiously keep charged) gets stolen? What authentication system proves that the person holding the phone and scanning the register is actually me? There's always "Enter your pin..." but that brings me to the next problem: 5. People paying with credit cards is slow enough already... I think your system would probably slow transactions down even more. Anyway, to me it seems you're trading in a small, light system that works adequately for a heavy, bulky one that may be less secure.
    - thinkcomp 16y ago
      As much as I hate to link to a competitor, Cushman's idea is similar to what Cimbal is doing: http://www.cimbal.com http://www.cimbal.com Cimbal has all of the same downsides you describe here (and more--it's only on iPhone and no merchants accept it). FaceCash, which uses a consumer-side 1D barcode rather than a merchant-side 2D barcode, solves all of them. 1. We let you print your barcode (like a boarding pass) on a piece of paper that you can cut to business-card size so you can carry it with you in your wallet. No phone required, which also means no cameraphone required. 2. See 1. 3. See 1. 4. Your account is linked to an image of your face that shows up on the register whenever it's used, and it's pretty unlikely that a random phone thief will be mistaken for you. 5. It's the same speed as credit cards or faster.
      - hugh3 16y ago
        This is the first I've heard of your product, but I agree it does solve all the problems I mentioned. I'm actually curious as to what the point of the phone-based side of your product is, then... surely pulling a barcode out of my wallet is quicker than loading up the facecash app on my phone?
proexploit 16y ago
That's true, there's still a security concern once you've swiped a payment, but in terms of this secure card, the fact that you need the correct PIN to even see what the credit card number is would make me feel a lot better about losing my wallet. I've got no data on this, but I'm personally more concerned about a lost/stolen card being intentionally used by someone else rather than a merchant screwing me over. Is it world changing? No, probably not. Is it a significant improvement? In my opinion, yes.
- mikeknoop 16y ago
  Most (if not all?) credit card companies will not hold you liable in the event your card is stolen. They also require you to get a new credit card number and report the old as stolen in order for this protection to exist. Now the question is, are you going to trust that just because you have this security card you don't need to report the card as stolen / get a new card?
  - mseebach 16y ago
    > Now the question is, are you going to trust that just because you have this security card you don't need to report the card as stolen / get a new card? No, but I'm going to trust that it's harder for the thief to make any charges in the time between stealing my wallet and me reporting it stole. Also, if my credit card is stolen, I'd need to get a new one.
  - kjuhyghjk 16y ago
    Except of course with the new super secure card it can't be the banks fault because it's secure - so any fraud must be your fault and so you are liable. That's what they tried here with chip+pin cards
    - Qz 16y ago
      Actually I'm fairly sure it's only legal for them to hold you responsible to ~50 dollars in case of ID theft. Don't you think the CC companies would want to make you liable? Of course they would.
sokoloff 16y ago
There's little need for your bank to double-check with you for credit cards, IMO. In fact, in the few instances where my bank has checked with me, it's been a pain in the ass. (Travelling or otherwise making unusual purchases.) If you don't agree to pay a merchant, you dispute the charge after the fact and the onus is on the merchant to prove that you agreed to that amount and that they delivered the product/service satisfactorily, etc. In 2 decades, I've probably disputed 5 or 6 charges. In every case, it took less than 15 total minutes of time, and averaged under 10. So, in 2 decades, I've spent an hour dealing with credit card issues that smartphones might solve. And believe me, I'm not shy about using the plastic, averaging $30K+ per year in purchases on the card to get the 1% cash back. I'm just not sure I care about better security for my CC information, and I'm sure I'm not alone...
deleted 16y ago
[deleted]
psranga 16y ago
The way I see it is that it's helping with "wallet bloat". It's a gizmo the end consumer buys to convert a stack of cards into a single card. Everything else is icing on the cake that I don't really care about. I would pay $15 for this device.
zhyder 16y ago
Looks like they've integrated a processor and keypad on the cards. Sounds like the problem you describe could be solved with an upgraded POS terminal, where the PIN is typed on the card, and transmitted thru the terminal[1] to the bank (with end-to-end encryption from the card to the bank). [1] - Probably still need to rely on the terminal for the data transfer; smartphones aren't ubiquitous/convenient/permanently-data-connected enough. The card could either communicate with the POS terminal wirelessly through Bluetooth/NFC, or be attached face-up while entering the PIN code.
- bananaandapple 16y ago
  Why not type in the pin code at the POS terminal? All Credit cards (smartcards) in Europe (Visa, etc..) already have a chip integrated . So whenever you do a purchase in the store, you have to enter your pin into the terminal, to complete the transaction. No pin, no transaction. I don't think that this credit card 2.0 is solving any problem at all. Maybe the founder have never been to Europ and don't know that this exists here... imagine. hehe.
  - zhyder 16y ago
    That doesn't solve the problem Cushman mentioned (and clarified several times to thinkcomp in this thread): giving up all your credentials including PIN/"password" to the merchant's hardware, and trusting the merchant and its hardware. What's needed is a device you own and control directly communicate with the bank. Cushman suggested using one's smartphone, but I think the card itself could serve that purpose. The card has a display, a processor, and a keypad: everything except a data connection.
    - bananaandapple 16y ago
      That's just like a computer without even having the possibility to reinstall. Just imagine catching a trojan horse on the phone, stealing your credit card info. I prefer paying by PIN. The POS Terminal doesn't connect to the internet.
sendos 16y ago
What you are proposing, while great for the consumer, will not happen any time soon, due to the inertia of millions of merchants and their existing POS terminals, and also due to the fact that very few people have smartphones. Also, how widespread is the problem of people handing over their credit cards to pay for something, and the merchant types in a bigger amount than you want to pay? It doesn't happen, or happens negligibly often. The bigger problem is not that merchants get to ask for as much money as they want when you are there at the store paying for something, but that they now have your credit card number and can, if they are malicious, use it later, or sell it on the black market. In comparison to your proposal, the new card being proposed can work today without any merchant making any change to their equipment. And this new card will become very useful once they add something akin to SecureID: That is, after every swipe of the card, the credit card number automatically changes to a new one. This is done on the card, and on the credit card issuer server, so that when the user makes their next purchase, both the card and the card issuer agree what number is being used. This would make it useless for people to steal credit card numbers. And having this built-in to your credit card, instead of having to go online every time, like some existing systems, makes it extremely convenient and easily adopted by users. Basically, this would mean no change on the part of users, no change on the part of the merchants, and only change on the part of the card issuers (they need to upgrade their servers and issue new cards), which is great because it is the card issuers that are most impacted by credit card fraud, so they are the most motivated to make a change.

by Cushman 16y ago

thinkcomp 16y ago

I agree. I'm biased, but I think phone-based technology is clearly better. (I run http://www.facecash.com http://www.facecash.com)

Cushman 16y ago
It's a step in the right direction, but (please correct me if I'm wrong) your system still seems to be merchant-initiated. I'm using my phone as a glorified piece of paper; the merchant scans my barcode and processes the transaction on their hardware, the same way they would with plastic. That still seems ridiculous when my phone itself is a device capable of handling the transaction, yes? I should be scanning the register's barcode. I should be able to see what I'm paying for on my phone as it rings up. I should be able to authorize the payment using whatever securities I want on hardware that I own. I should be able to complete the entire transaction and walk out of the store without ever giving the merchant any information besides what bank I use. All of that is completely possible with today's tech. Who decided that the future of electronic payment is a debit card in a different form factor?
- hugh3 16y ago
  Downsides of your idea: 1. Not everyone has, or wants, a smartphone. My phone doesn't even have a camera. People who work in certain high-security environments aren't even allowed to own phones with cameras. 2. Supposing hypothetically that I'm gonna have to "upgrade" to a smartphone at some stage, do I want to carry it around all the time? I always take my wallet, but I don't always take my phone. A phone is a much larger, heavier thing to carry around than a credit card. 3. When I do have my phone with me, it always seems to run out of batteries at an inconvenient time. I'd hate for the "completely uncontactable" problem to be compounded by the "you don't have any money" problem. 4. What happens when my phone (which I am now forced to carry around all the time and religiously keep charged) gets stolen? What authentication system proves that the person holding the phone and scanning the register is actually me? There's always "Enter your pin..." but that brings me to the next problem: 5. People paying with credit cards is slow enough already... I think your system would probably slow transactions down even more. Anyway, to me it seems you're trading in a small, light system that works adequately for a heavy, bulky one that may be less secure.
  - thinkcomp 16y ago
    As much as I hate to link to a competitor, Cushman's idea is similar to what Cimbal is doing: http://www.cimbal.com http://www.cimbal.com Cimbal has all of the same downsides you describe here (and more--it's only on iPhone and no merchants accept it). FaceCash, which uses a consumer-side 1D barcode rather than a merchant-side 2D barcode, solves all of them. 1. We let you print your barcode (like a boarding pass) on a piece of paper that you can cut to business-card size so you can carry it with you in your wallet. No phone required, which also means no cameraphone required. 2. See 1. 3. See 1. 4. Your account is linked to an image of your face that shows up on the register whenever it's used, and it's pretty unlikely that a random phone thief will be mistaken for you. 5. It's the same speed as credit cards or faster.
    - hugh3 16y ago
      This is the first I've heard of your product, but I agree it does solve all the problems I mentioned. I'm actually curious as to what the point of the phone-based side of your product is, then... surely pulling a barcode out of my wallet is quicker than loading up the facecash app on my phone?

proexploit 16y ago

That's true, there's still a security concern once you've swiped a payment, but in terms of this secure card, the fact that you need the correct PIN to even see what the credit card number is would make me feel a lot better about losing my wallet. I've got no data on this, but I'm personally more concerned about a lost/stolen card being intentionally used by someone else rather than a merchant screwing me over. Is it world changing? No, probably not. Is it a significant improvement? In my opinion, yes.

mikeknoop 16y ago
Most (if not all?) credit card companies will not hold you liable in the event your card is stolen. They also require you to get a new credit card number and report the old as stolen in order for this protection to exist. Now the question is, are you going to trust that just because you have this security card you don't need to report the card as stolen / get a new card?
- mseebach 16y ago
  > Now the question is, are you going to trust that just because you have this security card you don't need to report the card as stolen / get a new card? No, but I'm going to trust that it's harder for the thief to make any charges in the time between stealing my wallet and me reporting it stole. Also, if my credit card is stolen, I'd need to get a new one.
- kjuhyghjk 16y ago
  Except of course with the new super secure card it can't be the banks fault because it's secure - so any fraud must be your fault and so you are liable. That's what they tried here with chip+pin cards
  - Qz 16y ago
    Actually I'm fairly sure it's only legal for them to hold you responsible to ~50 dollars in case of ID theft. Don't you think the CC companies would want to make you liable? Of course they would.

sokoloff 16y ago

There's little need for your bank to double-check with you for credit cards, IMO. In fact, in the few instances where my bank has checked with me, it's been a pain in the ass. (Travelling or otherwise making unusual purchases.) If you don't agree to pay a merchant, you dispute the charge after the fact and the onus is on the merchant to prove that you agreed to that amount and that they delivered the product/service satisfactorily, etc. In 2 decades, I've probably disputed 5 or 6 charges. In every case, it took less than 15 total minutes of time, and averaged under 10. So, in 2 decades, I've spent an hour dealing with credit card issues that smartphones might solve. And believe me, I'm not shy about using the plastic, averaging $30K+ per year in purchases on the card to get the 1% cash back. I'm just not sure I care about better security for my CC information, and I'm sure I'm not alone...

deleted 16y ago

[deleted]

psranga 16y ago

The way I see it is that it's helping with "wallet bloat". It's a gizmo the end consumer buys to convert a stack of cards into a single card. Everything else is icing on the cake that I don't really care about. I would pay $15 for this device.

zhyder 16y ago

Looks like they've integrated a processor and keypad on the cards. Sounds like the problem you describe could be solved with an upgraded POS terminal, where the PIN is typed on the card, and transmitted thru the terminal[1] to the bank (with end-to-end encryption from the card to the bank). [1] - Probably still need to rely on the terminal for the data transfer; smartphones aren't ubiquitous/convenient/permanently-data-connected enough. The card could either communicate with the POS terminal wirelessly through Bluetooth/NFC, or be attached face-up while entering the PIN code.

bananaandapple 16y ago
Why not type in the pin code at the POS terminal? All Credit cards (smartcards) in Europe (Visa, etc..) already have a chip integrated . So whenever you do a purchase in the store, you have to enter your pin into the terminal, to complete the transaction. No pin, no transaction. I don't think that this credit card 2.0 is solving any problem at all. Maybe the founder have never been to Europ and don't know that this exists here... imagine. hehe.
- zhyder 16y ago
  That doesn't solve the problem Cushman mentioned (and clarified several times to thinkcomp in this thread): giving up all your credentials including PIN/"password" to the merchant's hardware, and trusting the merchant and its hardware. What's needed is a device you own and control directly communicate with the bank. Cushman suggested using one's smartphone, but I think the card itself could serve that purpose. The card has a display, a processor, and a keypad: everything except a data connection.
  - bananaandapple 16y ago
    That's just like a computer without even having the possibility to reinstall. Just imagine catching a trojan horse on the phone, stealing your credit card info. I prefer paying by PIN. The POS Terminal doesn't connect to the internet.

sendos 16y ago

What you are proposing, while great for the consumer, will not happen any time soon, due to the inertia of millions of merchants and their existing POS terminals, and also due to the fact that very few people have smartphones. Also, how widespread is the problem of people handing over their credit cards to pay for something, and the merchant types in a bigger amount than you want to pay? It doesn't happen, or happens negligibly often. The bigger problem is not that merchants get to ask for as much money as they want when you are there at the store paying for something, but that they now have your credit card number and can, if they are malicious, use it later, or sell it on the black market. In comparison to your proposal, the new card being proposed can work today without any merchant making any change to their equipment. And this new card will become very useful once they add something akin to SecureID: That is, after every swipe of the card, the credit card number automatically changes to a new one. This is done on the card, and on the credit card issuer server, so that when the user makes their next purchase, both the card and the card issuer agree what number is being used. This would make it useless for people to steal credit card numbers. And having this built-in to your credit card, instead of having to go online every time, like some existing systems, makes it extremely convenient and easily adopted by users. Basically, this would mean no change on the part of users, no change on the part of the merchants, and only change on the part of the card issuers (they need to upgrade their servers and issue new cards), which is great because it is the card issuers that are most impacted by credit card fraud, so they are the most motivated to make a change.