4 ms·

Traditional financial regulation and compliance is a joke and mostly security theatre from the perspective of a security engineer or cryptographers. - credit c

by lixtra 7y ago

Traditional financial regulation and compliance is a joke and mostly security theatre from the perspective of a security engineer or cryptographers. - credit cards with secrets printed and shared in plain sight - hacked banks - hacked atms It only works because most involved are somewhat trustworthy and the damages are small enough that it’s still worth to have the system. But the latter also seems to be true for crypto. It shifts the responsibility further to the user. Some like it because they assume they can provide better opsec than their bank (which was easy in the past). Others don’t like to take responsibility and leave it with some exchange, which in some cases even lack behind banks.

deleted 7y ago
[deleted]
Nursie 7y ago
> credit cards with secrets printed and shared in plain sight This is a simplification. For all customer-present transactions cards use the secrets in a secure chip, and the transaction is authorised by the cryptographic processor in those chips signing the transaction data with a secret key. It's classic 2FA - Something you have (a card) and something you know (a PIN). The type-in-a-number-on-a-website purchases are the weak link, and even they are usually protected by another layer of passwords (3D-secure, Verified by Visa etc). It's quite a while (in most places outside the US) since the number on the front was the secret.
- basch 7y ago
  Most chip credit transactions in the US dont use a pin yet.
  - arcticbull 7y ago
    Correct, and they won't any time soon. This US is a Chip + Signature market, which still incorporates cryptographic elements on the card itself as the secret. In a Chip + PIN transaction, the second factor is your digital PIN, whereas in the Chip + Signature transaction the second factor is your signature. It's still 2fac, but more importantly, in neither case is the secret on the front of the card.
    - basch 7y ago
      a signature doesnt stop the transaction from going through. if i dispute a transaction, I can go "thats not my signature." do most people sign their name on those digital pads, or do they scribble random patterns? a signature is not a pre-authentication factor, a PIN is.
      - arcticbull 7y ago
        There are three security elements aspects to the EMV standard: card duplication (your card is the real deal), cardholder verification (you are the real deal), and lending (that you still have available credit). Having a chip prevents (or at least is intended to prevent) card skimming. EMV payments cannot be re-played, cards cannot be duplicated and neither the card nor the reader can be tampered with. The magstripe of a chip card includes a flag indicating the card has a chip so even if you duplicated the stripe, it still wouldn't work. That is a material improvement over magstripe-only cards, and the private key is embedded within the silicon in a highly tamper-resistant way. This got the US the bulk of the 'win'. With respect to cardholder verification, the Cardholder Verification Methods range, from least to most secure (from the perspective of a bank): None (i.e. have at it), Signature, PIN and CDCVM (ApplePay, etc). The CVM is negotiated between the card and the reader on insertion (EMV) or presentation (NFC/EMV). Each of these CVMs will impact to some extent things such as how likely a transaction is to be approved vs declined, how much you're charged in interchange to make up for it, and so on. Yes, PINs are more secure in some ways because they provide a pre-payment second factor and in some ways yield a false sense of security. For instance, if someone sees you key in your PIN, you'll have a harder time claiming fraud, and in Europe it's on you to prove that. In the US, it's on the merchant. The trade-off here is again more time. Merchants are often willing to pay a slightly higher interchange rate to get people through the line faster, and signature is unequivocally faster than Online pin (requiring another network request to decrypt/verify) and still faster than Offline pin (which only works in Europe and is capped through floor limit). Consider this from the perspective of all the layers of security even an EMV signature payment has. Tamper-proof physical card required that cannot be cloned, tamper-proof terminal, the card yields a signed payment request to your acquirer who can flag it as fraudulent, to the issuing bank who can flag it as fraudulent, and all the way back down to the card which can itself mark your transaction as fraudulent (it's called a reversal). Then you sign. And your photograph / video is likely recorded by the merchant at the point of sale, too. PIN or no-PIN, in a low fraud rate market, the win is small but the cost in added time can be really high. If this mattered in the US and PIN were truly advantageous, restaurants could configure their terminals to request signatures or no verification while high-ticket size merchants could still capture PINs. They could still make this change at any time, really, all the tech out there more or less supports it. During the EMV transition all this was considered, and the decision was made it wasn't worth it. tl;dr: Sometimes the 'less secure' method get you the bulk of the security win while yielding more profit for the merchant. Source: I worked in payments for years including during the EMV switchover :) Hope that helps!
arcticbull 7y ago
A bank's lack of opsec isn't my problem, it's theirs. They get hacked, I still get made whole. Only in crypto is the lack of anyones opsec your problem.
SmellyGeekBoy 7y ago
When I was a student 15 years ago my debit card was skimmed (here in the UK) and someone in the middle east completely emptied my bank account. I called my bank, they explained what had happened and what little money I had was back the very next day. So while the infrastructure may be fundamentally insecure, quite frankly that's not my problem. If it was a crypto wallet I would have had zero legal recourse and of course never would have seen that money again - as we're seeing again and again. I do hold some ETH but I don't see it replacing my bank anytime soon.
- nstart 7y ago
  Ouch. Sucks to read that. For anyone who might be interested in a possible alternative to this, I keep two bank accounts with the same bank with only one being connected to my debit card. I keep a tiny balance in the account connected to the debit card so that even if I lose it, the damage is minimal. Whenever my balance is running low, I do a quick transfer via online banking. No idea how feasible this might be in other countries, but wanted to share in case its helpful. It's really helped me have ease of mind in using my card when I've been abroad. Doesn't stop me from attempting to dismantle any ATM though whenever I use one :')
- lixtra 7y ago
  How many hours did you spend resolving the issue? That’s your damage. And while you were reimbursed, the damage to the whole community was still done and just covered by an insurance fee that everyone pays on every transaction.
zaarn 7y ago
In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight (you need a TAN to complete a transaction over 25€ or total 100€ per day). We also have SEPA Inst which allows me to send people money instantly for no fees (atleast at my bank), faster than Bitcoin ever could. I'm insured against the bank being hacked. I'm also insured against the ATM's being hacked. If I'd open my bank account today and found 0€ via hacks, I'd get it all back in 99.9% of cases. If I loose my card I get back everything too. If I loose my bitcoin wallet, I'm SOL and should be sorry for not making backups and using a multisig wallet with 2FA!
- acqq 7y ago
  I’ve read somewhere that regarding the way the cards, checks and transfers work the U.S. is not only behind Europe but even the African countries. And that the chip cards were invented and used in Europe decades before they started to be spread in the UK and the U.S. I don’t know why but somebody with more insider information can maybe explain?
  - arcticbull 7y ago
    Same-day ACH took a while AFAIK because of fraud risk especially to smaller banks and credit unions, although we've moved into phase 3 of the work last year so that's happening now. I think the push-to-debit functionality pioneered by the likes of Square Cash helped hurry this along but I'm only speculating. It's not particularly insider information, the reason America was slow to the chip card game was pragmatic. The US is a very low fraud rate market, and re-issuing all 1.43 billion credit cards [1] and 14M payment terminals [2] was going to cost an awful lot of money. Further, major industry players like McDonalds weren't interested in seeing line speeds go down at point of sale as they switch from mag stripe payments which happen real fast to EMV chip transactions which, at the time, were really slow. Think <1s for magstripe to 10s of seconds for EMV. NFC helps mitigate this, but again, dual-interface cards (EMV + NFC + Mastripe) are a few dollars a piece. tl:dr; it wasn't until a few years ago that the cost of the transition outweighed the cost of the fraud that would be mitigated as a result. [1] https://wallethub.com/edu/cc/number-of-credit-cards/25532/ https://wallethub.com/edu/cc/number-of-credit-cards/25532/ [2] https://gomedici.com/steady-growth-in-nfc-pos-terminals-in-the-us-in-the-last-six-months/ https://gomedici.com/steady-growth-in-nfc-pos-terminals-in-t...

by lixtra 7y ago

deleted 7y ago

[deleted]

Nursie 7y ago

> credit cards with secrets printed and shared in plain sight This is a simplification. For all customer-present transactions cards use the secrets in a secure chip, and the transaction is authorised by the cryptographic processor in those chips signing the transaction data with a secret key. It's classic 2FA - Something you have (a card) and something you know (a PIN). The type-in-a-number-on-a-website purchases are the weak link, and even they are usually protected by another layer of passwords (3D-secure, Verified by Visa etc). It's quite a while (in most places outside the US) since the number on the front was the secret.

basch 7y ago
Most chip credit transactions in the US dont use a pin yet.
- arcticbull 7y ago
  Correct, and they won't any time soon. This US is a Chip + Signature market, which still incorporates cryptographic elements on the card itself as the secret. In a Chip + PIN transaction, the second factor is your digital PIN, whereas in the Chip + Signature transaction the second factor is your signature. It's still 2fac, but more importantly, in neither case is the secret on the front of the card.
  - basch 7y ago
    a signature doesnt stop the transaction from going through. if i dispute a transaction, I can go "thats not my signature." do most people sign their name on those digital pads, or do they scribble random patterns? a signature is not a pre-authentication factor, a PIN is.
    - arcticbull 7y ago
      There are three security elements aspects to the EMV standard: card duplication (your card is the real deal), cardholder verification (you are the real deal), and lending (that you still have available credit). Having a chip prevents (or at least is intended to prevent) card skimming. EMV payments cannot be re-played, cards cannot be duplicated and neither the card nor the reader can be tampered with. The magstripe of a chip card includes a flag indicating the card has a chip so even if you duplicated the stripe, it still wouldn't work. That is a material improvement over magstripe-only cards, and the private key is embedded within the silicon in a highly tamper-resistant way. This got the US the bulk of the 'win'. With respect to cardholder verification, the Cardholder Verification Methods range, from least to most secure (from the perspective of a bank): None (i.e. have at it), Signature, PIN and CDCVM (ApplePay, etc). The CVM is negotiated between the card and the reader on insertion (EMV) or presentation (NFC/EMV). Each of these CVMs will impact to some extent things such as how likely a transaction is to be approved vs declined, how much you're charged in interchange to make up for it, and so on. Yes, PINs are more secure in some ways because they provide a pre-payment second factor and in some ways yield a false sense of security. For instance, if someone sees you key in your PIN, you'll have a harder time claiming fraud, and in Europe it's on you to prove that. In the US, it's on the merchant. The trade-off here is again more time. Merchants are often willing to pay a slightly higher interchange rate to get people through the line faster, and signature is unequivocally faster than Online pin (requiring another network request to decrypt/verify) and still faster than Offline pin (which only works in Europe and is capped through floor limit). Consider this from the perspective of all the layers of security even an EMV signature payment has. Tamper-proof physical card required that cannot be cloned, tamper-proof terminal, the card yields a signed payment request to your acquirer who can flag it as fraudulent, to the issuing bank who can flag it as fraudulent, and all the way back down to the card which can itself mark your transaction as fraudulent (it's called a reversal). Then you sign. And your photograph / video is likely recorded by the merchant at the point of sale, too. PIN or no-PIN, in a low fraud rate market, the win is small but the cost in added time can be really high. If this mattered in the US and PIN were truly advantageous, restaurants could configure their terminals to request signatures or no verification while high-ticket size merchants could still capture PINs. They could still make this change at any time, really, all the tech out there more or less supports it. During the EMV transition all this was considered, and the decision was made it wasn't worth it. tl;dr: Sometimes the 'less secure' method get you the bulk of the security win while yielding more profit for the merchant. Source: I worked in payments for years including during the EMV switchover :) Hope that helps!

arcticbull 7y ago

A bank's lack of opsec isn't my problem, it's theirs. They get hacked, I still get made whole. Only in crypto is the lack of anyones opsec your problem.

SmellyGeekBoy 7y ago

When I was a student 15 years ago my debit card was skimmed (here in the UK) and someone in the middle east completely emptied my bank account. I called my bank, they explained what had happened and what little money I had was back the very next day. So while the infrastructure may be fundamentally insecure, quite frankly that's not my problem. If it was a crypto wallet I would have had zero legal recourse and of course never would have seen that money again - as we're seeing again and again. I do hold some ETH but I don't see it replacing my bank anytime soon.

nstart 7y ago
Ouch. Sucks to read that. For anyone who might be interested in a possible alternative to this, I keep two bank accounts with the same bank with only one being connected to my debit card. I keep a tiny balance in the account connected to the debit card so that even if I lose it, the damage is minimal. Whenever my balance is running low, I do a quick transfer via online banking. No idea how feasible this might be in other countries, but wanted to share in case its helpful. It's really helped me have ease of mind in using my card when I've been abroad. Doesn't stop me from attempting to dismantle any ATM though whenever I use one :')
lixtra 7y ago
How many hours did you spend resolving the issue? That’s your damage. And while you were reimbursed, the damage to the whole community was still done and just covered by an insurance fee that everyone pays on every transaction.

zaarn 7y ago

In Europe it's more common to have an EC card, which doesn't have any necessary secrets printed in plain sight (you need a TAN to complete a transaction over 25€ or total 100€ per day). We also have SEPA Inst which allows me to send people money instantly for no fees (atleast at my bank), faster than Bitcoin ever could. I'm insured against the bank being hacked. I'm also insured against the ATM's being hacked. If I'd open my bank account today and found 0€ via hacks, I'd get it all back in 99.9% of cases. If I loose my card I get back everything too. If I loose my bitcoin wallet, I'm SOL and should be sorry for not making backups and using a multisig wallet with 2FA!

acqq 7y ago
I’ve read somewhere that regarding the way the cards, checks and transfers work the U.S. is not only behind Europe but even the African countries. And that the chip cards were invented and used in Europe decades before they started to be spread in the UK and the U.S. I don’t know why but somebody with more insider information can maybe explain?
- arcticbull 7y ago
  Same-day ACH took a while AFAIK because of fraud risk especially to smaller banks and credit unions, although we've moved into phase 3 of the work last year so that's happening now. I think the push-to-debit functionality pioneered by the likes of Square Cash helped hurry this along but I'm only speculating. It's not particularly insider information, the reason America was slow to the chip card game was pragmatic. The US is a very low fraud rate market, and re-issuing all 1.43 billion credit cards [1] and 14M payment terminals [2] was going to cost an awful lot of money. Further, major industry players like McDonalds weren't interested in seeing line speeds go down at point of sale as they switch from mag stripe payments which happen real fast to EMV chip transactions which, at the time, were really slow. Think <1s for magstripe to 10s of seconds for EMV. NFC helps mitigate this, but again, dual-interface cards (EMV + NFC + Mastripe) are a few dollars a piece. tl:dr; it wasn't until a few years ago that the cost of the transition outweighed the cost of the fraud that would be mitigated as a result. [1] https://wallethub.com/edu/cc/number-of-credit-cards/25532/ https://wallethub.com/edu/cc/number-of-credit-cards/25532/ [2] https://gomedici.com/steady-growth-in-nfc-pos-terminals-in-the-us-in-the-last-six-months/ https://gomedici.com/steady-growth-in-nfc-pos-terminals-in-t...