6 ms·

A big part of this is that apparently US credit card companies decided not to include contactless when they switched over to chip cards, in order to save money.

by notJim 7y ago

A big part of this is that apparently US credit card companies decided not to include contactless when they switched over to chip cards, in order to save money. Ironically, contactless was becoming fairly common before the move to EMV, but is now pretty rare. I think about half my cards had it a few years ago, but now none do.

_bxg1 7y ago
Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.
- simonebrunozzi 7y ago
  Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.
  - _bxg1 7y ago
    And isn't your actual credit card number
  - AceJohnny2 7y ago
    > it's via bluetooth NFC (same as contactless CCs), not Bluetooth.
    - simonebrunozzi 7y ago
      Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.
- riffraff 7y ago
  my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?
  - _bxg1 7y ago
    I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN
    - nvarsj 7y ago
      At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.
      - tokamak-teapot 7y ago
        £30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).
        Spare_account 7y ago
        > £30 currently. Though mobile payments don’t fall foul of this in theory I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.
        robjan 7y ago
        Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.
        7y ago
- TazeTSchnitzel 7y ago
  > It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless. Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.
  - _bxg1 7y ago
    From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem
    - TazeTSchnitzel 7y ago
      Yes, exactly.
- thesimon 7y ago
  >Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13-roland.pdf https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29bf665576c0b921.pdf https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)
  - reaperducer 7y ago
    I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.
    - xenocratus 7y ago
      It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
      - reaperducer 7y ago
        The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.
  - _bxg1 7y ago
    I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.
nickhalfasleep 7y ago
I wonder if contactless will also gain favor as being less likely to spread disease. If you just wave the authentication device, it is less likely to communicate surface contamination.
- beamatronic 7y ago
  Especially compared to cash currency, I’m sure this must be true.
- reaperducer 7y ago
  Considering how frequently people use their devices while sitting on a toilet, I'm not so sure.
  - ceejayoz 7y ago
    That doesn't matter, though. No one else touches the device.
    - reaperducer 7y ago
      You put your device down in public areas. You touch your nasty device and then touch other people, their desks, door handles, and on and on and on. The germs don't magically stay on the device.
      - ceejayoz 7y ago
        The point is no one else touches my device or credit card, and I don't touch the terminal.
- adrr 7y ago
  All my credits cards(Amex and Chase) support contactless and work at most stores. Most people don’t know about it.
nerfhammer 7y ago
I thought that was because the whole point of the chips is that it's vastly more secure and contactless is hopelessly insecure
- ThePowerOfFuet 7y ago
  EMV contactless is essentially as secure as a chip-based transaction (same chip, but look-ma-no-contact).
dangus 7y ago
Contactless is all over the US but is rarely advertised and retail employees tend to tell me to “insert my chip.” Weirdly enough, I have visited a US retailer that did not have working chip, but working contactless.
lilyball 7y ago
I think all of my cards have contactless now. I've used it precisely once, when I handed my card to the teller and they tapped it on the pad for me.
throwaway3563 7y ago
It’s coming back quite quickly. I had an old Amex card that had it but nobody had the readers at the time. Then the readers appeared about 3-5 years ago but the contactless cards had been mostly withdrawn. Now they’re coming back, my most recently issued Amex and Chase cards in the last year or so have been contactless.

by notJim 7y ago

_bxg1 7y ago

Contactless is also a security concern on actual cards. It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches. Very easy to skim even while it's still in your pocket.

simonebrunozzi 7y ago
Much better to use contactless from your iphone. You don't broadcast it, it's via bluetooth and only lasts for a few seconds.
- _bxg1 7y ago
  And isn't your actual credit card number
- AceJohnny2 7y ago
  > it's via bluetooth NFC (same as contactless CCs), not Bluetooth.
  - simonebrunozzi 7y ago
    Oh my... I don't even know why I wrote Bluetooth. Of course it's NFC. There are some similarities, but it's obviously two different protocols. I stand corrected.
riffraff 7y ago
my contactless cards need a PIN when used for significant money, don't they all? Is skimming a major issue?
- _bxg1 7y ago
  I don't know what qualifies as "significant", but I've used contactless on my actual card a handful of times and never needed a PIN
  - nvarsj 7y ago
    At least in the UK, contactless is limited to 20£ and probably has other limits as well I suspect.
    - tokamak-teapot 7y ago
      £30 currently. Though mobile payments don’t fall foul of this in theory, in practice some terminals are limited to £30 to match the card limit, which can be annoying when you want to pay by mobile (the most secure way).
      - Spare_account 7y ago
        > £30 currently. Though mobile payments don’t fall foul of this in theory I believe Apple Pay supports payments >£30 but I use Android Pay and it has never allowed me to exceed £30. I understand that it is probably a limitation of the terminal in many cases but I have observed an Apple Pay transation exceed £30 and then been rejected by my Android Pay device on the same terminal in one case.
        robjan 7y ago
        Think it's a limitation of the issuer. I use my Hong Kong contactless card all the time for transactions up to 100GBP (the HK$1000 limit set by my bank) and the terminals just accept it.
        7y ago
TazeTSchnitzel 7y ago
> It only stores a single number (like the stripe, unlike the chips or phone-based NFC), and it effectively "broadcasts" it in a radius of a couple of inches This is only for magstripe-emulation contactless, which is very regrettably a thing, thanks United States! The civilised world uses true EMV contactless. Edit: Huh, even the US will be forced to use EMV contactless soon, apparently. Makes sense that Visa and Mastercard wouldn't want to support that massive fraud risk for long.
- _bxg1 7y ago
  From a quick search, it sounds like "EMV contactless" means the NFC circuit follows the same procedure as "the chip" instead of the same procedure as the magstripe? If so, that would indeed solve the problem
  - TazeTSchnitzel 7y ago
    Yes, exactly.
thesimon 7y ago
>Very easy to skim even while it's still in your pocket Do you have any details on that? From my understanding skimming is mostly an issue for magstripe, as contactless (at least in the proper EMV implementation) is cryptographically secured. There is not much to skim. I'm aware of a few papers on relay or downgrade attacks, but I would consider them mostly of theoretical relevance (e.g. https://www.usenix.org/system/files/conference/woot13/woot13-roland.pdf https://www.usenix.org/system/files/conference/woot13/woot13... or https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29bf665576c0b921.pdf https://pdfs.semanticscholar.org/c8a6/9d63996f8f1eef414dbd29...)
- reaperducer 7y ago
  I've seen it demonstrated on local news programs, and sometimes I see TV commercials for metallic sleeves you can put your NFC cards in so they don't get skimmed. When I had a Washington State combined driver's license/North America passport, it came with one of those little sleeves. So there must be some kind of threat, or the government wouldn't hand those out.
  - xenocratus 7y ago
    It's not skimming, it simply presents an NFC transaction to the card through wallet/clothes. The card instantly approves, without you doing anything. It's a one-time loss, capped at the transaction limit for contactless. They could try and do it over and over, I guess
    - reaperducer 7y ago
      The TV reports stated that the cards could be cloned in this manner. Nobody is bringing a store point of sale terminal on the bus and holding it to your butt.
- _bxg1 7y ago
  I'm 90% sure that NFC on a card can't do any kind of dynamic token generation, so it'd be the same token every time. Even if it isn't your actual credit card number, that would mean you could at least use a copy of it at other contactless terminals.

nickhalfasleep 7y ago

I wonder if contactless will also gain favor as being less likely to spread disease. If you just wave the authentication device, it is less likely to communicate surface contamination.

beamatronic 7y ago
Especially compared to cash currency, I’m sure this must be true.
reaperducer 7y ago
Considering how frequently people use their devices while sitting on a toilet, I'm not so sure.
- ceejayoz 7y ago
  That doesn't matter, though. No one else touches the device.
  - reaperducer 7y ago
    You put your device down in public areas. You touch your nasty device and then touch other people, their desks, door handles, and on and on and on. The germs don't magically stay on the device.
    - ceejayoz 7y ago
      The point is no one else touches my device or credit card, and I don't touch the terminal.
adrr 7y ago
All my credits cards(Amex and Chase) support contactless and work at most stores. Most people don’t know about it.

nerfhammer 7y ago

I thought that was because the whole point of the chips is that it's vastly more secure and contactless is hopelessly insecure

ThePowerOfFuet 7y ago
EMV contactless is essentially as secure as a chip-based transaction (same chip, but look-ma-no-contact).

dangus 7y ago

Contactless is all over the US but is rarely advertised and retail employees tend to tell me to “insert my chip.” Weirdly enough, I have visited a US retailer that did not have working chip, but working contactless.

lilyball 7y ago

I think all of my cards have contactless now. I've used it precisely once, when I handed my card to the teller and they tapped it on the pad for me.

throwaway3563 7y ago

It’s coming back quite quickly. I had an old Amex card that had it but nobody had the readers at the time. Then the readers appeared about 3-5 years ago but the contactless cards had been mostly withdrawn. Now they’re coming back, my most recently issued Amex and Chase cards in the last year or so have been contactless.