4 ms·

The comments on the story, and the first round here, make me worry that people are missing the point. Particularly this one: > VeriFone's point (albeit a stupi

The comments on the story, and the first round here, make me worry that people are missing the point. Particularly this one: > VeriFone's point (albeit a stupid one) is that the path from the card reader itself to the iOS device is not secure, so it's a hardware "problem." That point isn't stupid at all, and is actually a legitimate gripe. It is my understanding that the Square device is only meant to be used with the Square payment software. Is that wrong? If that's the case, it shouldn't be as easy as VeriFone claims it is to skim a number from the device. I don't follow card skimming, but I would think that the point VeriFone is trying to make here is that Square is making it easier for low-tech criminals to implement a skimmer. While it is possible today, I've never heard it described as easy. Another of the commenters mentioned that professional card skimmers have their own devices. That's fine; that isn't the problem here. Professionals will always do things better than the entry-level criminals. However, from my reading, it sounds like there is the capability here to write a shrink-wrapped iOS app that talks to the free Square reader, and you have skimming for a total investment of an iPod touch (or lack of investment -- you are a criminal, after all). Which is the problem that VeriFone is bringing up, and I halfway agree with given the limited evidence presented to me. We're way too lax with credit cards. Does the Square app really need to know the card number at all, aside from transmitting it upstream? What is the vector here? It seems like the Square device should be a black box that yields only some kind of payment token, and the app only gets the cardholder name (from their screenshots). Square's own security page[1] makes this ambiguous, too: > Card numbers, magnetic stripe data, or security codes are not stored on Square client devices. I've never used Square, so I might be full of hot air. However, I think instantly painting this as not an issue simply because it came from a competitor is doing a disservice to the potential (real) vulnerability here. Read the information, not the source... [1]: https://squareup.com/security https://squareup.com/security

mbreese 16y ago
I've never used the Square device either, but I don't see this as a hardware "problem". This is no different (to me) than a USB card reader that operates as a keyboard. You could scan the card into the vendor software, or into Notepad. Either way, it isn't a hardware flaw.
- jedsmith 16y ago
  Again, please answer this: why does the Square app need to know the plaintext number? That is what makes it different from a USB card reader that operates as a keyboard. One is designed to accept payments, and the other is designed to steal numbers. We're comparing apples and oranges here. The path from the Square device to Square's servers should be completely untouchable to any app. That's what VeriFone is saying. Simply because there are alternative black-market products that encourage crime (and cost money, by the way), there shouldn't be a free product that simply hands you card numbers if asked nicely.
  - mustpax 16y ago
    It's a matter of cost vs. benefit. Designing an iPhone peripheral that has built-in crypto is extremely expensive (or any embedded system with strong crypto for that matter), especially if the information you're trying to protect is printed on the other side of the friggin card. The fact is, as a consumer, you can't know if the device that's going to read your card is legit. This is true even if you're looking at a state of the art IBM POS system or a tiny plastic widget with a coil of wire attached to a headphone jack.
    - wmf 16y ago
      I think this is the most important point in this thread. Verifone (and the other big players) makes expensive card readers. Square is disrupting that with a card reader so cheap that they can give it away for free. Verifone is using a standard anti-disruption argument: we're not over-engineered because everyone needs this level of complexity (crypto in this case). This would potentially break Square's business model.
  - mbreese 16y ago
    Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card and software to handle the transaction. The hardware is talking to whatever software is running. As a customer, you hope that software is legit, but you never know. How is this any different from handing your card to anyone else? USB card readers aren't black market by any means. This is how most POS devices read credit cards. It used to just be straight serial connections. It seems you're under the false assumption that the hardware path from your card to the software was ever secure. If Verifone really cared about a completely protected path for card numbers, they would disallow all USB card readers and require a secured path from reader to their clearing house. Unfortunately, that would remove credit card processing for many (all?) vendors. They are blaming Square for a security "flaw" that is present in their own system.
deleted 16y ago
[deleted]
- deleted 16y ago
  [deleted]
al3x 16y ago
Are you serious? The victim in this scenario is handing their credit card to the attacker. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. But then, there isn't yet a widely-deployed, field-tested alternative, at least in the US. The advent of NFC payments may put reasonable crypto in the POS flow, but I'm sure it's matter of time before side-channel attacks are discovered in the burgeoning NFC solutions. Security is hard. But VeriFone isn't talking about security. They're using security as an anti-competitive stalking horse, and that's a disgusting way to do business.
- jedsmith 16y ago
  > Are you serious? Very, and I will dig my heels in on this. For the record, your point would have been just as clear without this assertion that my point is stupid. > The victim in this scenario is HANDING THEIR CREDIT CARD TO THE ATTACKER. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. So everybody should just stop doing security, since people will figure out ways around it? Why bother? The Square device, as another commenter points out elsewhere in this thread, sets the expectation of a legitimate transaction. It's pushed, it's marketed, it's being set as the new brand of credit card processing. As such, Square have a responsibility to make sure that their products do not make skimming easier. And guess what? VeriFone found a way to skim, easily, with their product. This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous. I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. Internet Explorer 6 is pretty much a lost cause for Web exploits. Does that mean the rest of the browsers should not protect against Web exploits? This argument makes absolutely no sense. Who cares what others are doing? Do your product right. > I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. True. But there is NO REASON to make the vector EASIER. PERIOD. Simply because there are real risks with the vector means that we should take strides to make the vector harder.
tptacek 16y ago
(I'm speaking only for myself with this comment). You know it's not a real security concern because it can't be mollified. The kernel of Verifone's argument requires that nobody ever accept credit cards with little white card reader dongles, because a little white card skimmer dongle is trivial to construct. If Square dongles had googley eyes and pink antennae, Verifone's argument would involve the ease with which criminals can procure googley eyes and antennae. What's pernicious about this argument is the way they've tried to make it sound as if there's a real technical concern here, when in fact the real issue they're articulating implicates the entire business model.
- not_me 16y ago
  Thomas, You're sorta not understanding what goes on in a verifone device. I would advise actually constructing and inserting a rogue verifone PED, it is non-trivial. First, understand that when you swipe your card at mcdonalds, you're not trusting the guy behind the counter, the manager, the district or anyone else physically present or even mcdonalds. you're not trusting their malware laiden office computers, nor their network, et cetera. You're trusting the terminal. And the terminals, depending on model and service/etc, all have cryptographic MAC addresses "that are burned in" (lol), and they're externally by verifone. So first hurdle is that you can't just get a job at mcdonalds and ebay your way to a better life, when you switch out the device, it gets detected and blocked, and i imagine once the burger flippers figure out that its not broken and someone tried to own them, they pull the cameras, et cetera. Next, the device has a myriad of tamper-detection qualities which make it non-trivial to get into and still have the damned thing still function. This is again, dependent on which device is in play and so on-- getting in successfully obviously can be done, but you're getting sorta specialized. Next, the card details/pin/etc all get encrypted at the device never to see plain-text again until it's "safely in the cloud". That's the theory anyways, there's some problems but it's not that joe bubblegum is gonna download an 'app' and extract my credit card details from his employers iphone. If pressed for an opinion, I'd say the entire idea of getting people used to paying by swiping their cards through some guys phone is maligned and going to be horribly problematic. This is sorta like SSL, there's another maligned trust heirarchy that exists and makes sense sorta. So, basically my point is, verifone is not entirely incorrect here. It's not that "a little white card skimmer dongle is trivial to construct" or any other hyperbole. A PED or other input device that I can dump my card info from is a problem. There's another entire trust relationship going on here which everyone seems to skip: the most common use-case of dealing with a representative of a third-party who is less trustworthy than the third-party itself ('Alice meet George, embassary of Bob, don't mind the collasped veins, he's legit!').

mbreese 16y ago

I've never used the Square device either, but I don't see this as a hardware "problem". This is no different (to me) than a USB card reader that operates as a keyboard. You could scan the card into the vendor software, or into Notepad. Either way, it isn't a hardware flaw.

jedsmith 16y ago
Again, please answer this: why does the Square app need to know the plaintext number? That is what makes it different from a USB card reader that operates as a keyboard. One is designed to accept payments, and the other is designed to steal numbers. We're comparing apples and oranges here. The path from the Square device to Square's servers should be completely untouchable to any app. That's what VeriFone is saying. Simply because there are alternative black-market products that encourage crime (and cost money, by the way), there shouldn't be a free product that simply hands you card numbers if asked nicely.
- mustpax 16y ago
  It's a matter of cost vs. benefit. Designing an iPhone peripheral that has built-in crypto is extremely expensive (or any embedded system with strong crypto for that matter), especially if the information you're trying to protect is printed on the other side of the friggin card. The fact is, as a consumer, you can't know if the device that's going to read your card is legit. This is true even if you're looking at a state of the art IBM POS system or a tiny plastic widget with a coil of wire attached to a headphone jack.
  - wmf 16y ago
    I think this is the most important point in this thread. Verifone (and the other big players) makes expensive card readers. Square is disrupting that with a card reader so cheap that they can give it away for free. Verifone is using a standard anti-disruption argument: we're not over-engineered because everyone needs this level of complexity (crypto in this case). This would potentially break Square's business model.
- mbreese 16y ago
  Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card and software to handle the transaction. The hardware is talking to whatever software is running. As a customer, you hope that software is legit, but you never know. How is this any different from handing your card to anyone else? USB card readers aren't black market by any means. This is how most POS devices read credit cards. It used to just be straight serial connections. It seems you're under the false assumption that the hardware path from your card to the software was ever secure. If Verifone really cared about a completely protected path for card numbers, they would disallow all USB card readers and require a secured path from reader to their clearing house. Unfortunately, that would remove credit card processing for many (all?) vendors. They are blaming Square for a security "flaw" that is present in their own system.

deleted 16y ago

[deleted]

deleted 16y ago
[deleted]

al3x 16y ago

Are you serious? The victim in this scenario is handing their credit card to the attacker. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. But then, there isn't yet a widely-deployed, field-tested alternative, at least in the US. The advent of NFC payments may put reasonable crypto in the POS flow, but I'm sure it's matter of time before side-channel attacks are discovered in the burgeoning NFC solutions. Security is hard. But VeriFone isn't talking about security. They're using security as an anti-competitive stalking horse, and that's a disgusting way to do business.

jedsmith 16y ago
> Are you serious? Very, and I will dig my heels in on this. For the record, your point would have been just as clear without this assertion that my point is stupid. > The victim in this scenario is HANDING THEIR CREDIT CARD TO THE ATTACKER. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. So everybody should just stop doing security, since people will figure out ways around it? Why bother? The Square device, as another commenter points out elsewhere in this thread, sets the expectation of a legitimate transaction. It's pushed, it's marketed, it's being set as the new brand of credit card processing. As such, Square have a responsibility to make sure that their products do not make skimming easier. And guess what? VeriFone found a way to skim, easily, with their product. This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous. I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. Internet Explorer 6 is pretty much a lost cause for Web exploits. Does that mean the rest of the browsers should not protect against Web exploits? This argument makes absolutely no sense. Who cares what others are doing? Do your product right. > I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. True. But there is NO REASON to make the vector EASIER. PERIOD. Simply because there are real risks with the vector means that we should take strides to make the vector harder.

tptacek 16y ago

(I'm speaking only for myself with this comment). You know it's not a real security concern because it can't be mollified. The kernel of Verifone's argument requires that nobody ever accept credit cards with little white card reader dongles, because a little white card skimmer dongle is trivial to construct. If Square dongles had googley eyes and pink antennae, Verifone's argument would involve the ease with which criminals can procure googley eyes and antennae. What's pernicious about this argument is the way they've tried to make it sound as if there's a real technical concern here, when in fact the real issue they're articulating implicates the entire business model.

not_me 16y ago
Thomas, You're sorta not understanding what goes on in a verifone device. I would advise actually constructing and inserting a rogue verifone PED, it is non-trivial. First, understand that when you swipe your card at mcdonalds, you're not trusting the guy behind the counter, the manager, the district or anyone else physically present or even mcdonalds. you're not trusting their malware laiden office computers, nor their network, et cetera. You're trusting the terminal. And the terminals, depending on model and service/etc, all have cryptographic MAC addresses "that are burned in" (lol), and they're externally by verifone. So first hurdle is that you can't just get a job at mcdonalds and ebay your way to a better life, when you switch out the device, it gets detected and blocked, and i imagine once the burger flippers figure out that its not broken and someone tried to own them, they pull the cameras, et cetera. Next, the device has a myriad of tamper-detection qualities which make it non-trivial to get into and still have the damned thing still function. This is again, dependent on which device is in play and so on-- getting in successfully obviously can be done, but you're getting sorta specialized. Next, the card details/pin/etc all get encrypted at the device never to see plain-text again until it's "safely in the cloud". That's the theory anyways, there's some problems but it's not that joe bubblegum is gonna download an 'app' and extract my credit card details from his employers iphone. If pressed for an opinion, I'd say the entire idea of getting people used to paying by swiping their cards through some guys phone is maligned and going to be horribly problematic. This is sorta like SSL, there's another maligned trust heirarchy that exists and makes sense sorta. So, basically my point is, verifone is not entirely incorrect here. It's not that "a little white card skimmer dongle is trivial to construct" or any other hyperbole. A PED or other input device that I can dump my card info from is a problem. There's another entire trust relationship going on here which everyone seems to skip: the most common use-case of dealing with a representative of a third-party who is less trustworthy than the third-party itself ('Alice meet George, embassary of Bob, don't mind the collasped veins, he's legit!').