5 ms·
It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: y
by pieter 16y ago
It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: you can buy a cardreader that acts as a USB keyboard for $20 and use that to read a credit card and output it in TextMate. Square's hardware really has nothing to do with it: if Squary would use something else, you'd still be able to buy one of those reader thingies for $5 from DealExtreme or some other site, and use the same procedure to skim a credit card.
One thing Square could do would be to, say, encrypt the credit card info with a public key, then pass that data on to the app. The app could upload the data to Square, where it could be decrypted and verified. Of course, this wouldn't fit in a $2 reader, and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text.
- jedsmith 16y ago> and there really isn't a point to do this as long as there are other readers out there that allow you to read the data in plain text. This is the rub. If we had that attitude to everything in computing, the world would be a much worse place. Think about what you're saying, and grant me a paraphrasing: devices exist to circumvent traditional card security, so implementing card security is unnecessary. How exactly do you get from A to B, there? Software exists to root iOS; does that mean Apple should give up and stop trying to defend their platform's security? I strongly disagree with any strategy that says "well, the vector's already been exploited, so why bother doing anything about it in our product? It's cheaper if we don't!"
- pieter 16y agoNo, the fix is really easy: you drop the magnetic strip and only use chipped credit card (or similar). And this is what all the CC have been moving to already.
- jedsmith 16y agoI agree, but good luck getting every mom-and-pop merchant in the entire world to redo their POS. Moving is going to take a long time.
- drivebyacct2 16y agoNot if Mom and Pop's grandkid gave them an iPhone for christmas and all they have to do is plug in a tiny reader
- teilo 16y agoHaving worked with many so-called "Mom and Pop" POS systems, I can tell you that it is just not that simple. Most "Mom and Pop" shops are already using integrated hardware/software solutions. How is their iPhone going to transfer transactions into the Accounts Receivable software that is tightly integrated into their register system? There's a lot more to it than just capturing a transaction.
- YooLi 16y agoThe data on the magnetic stipe isn't encrypted, just encoded. There is no exploited vector. No one has cracked anything. You can read all about the encoding used and implement your own card reader with just a little Googling. You aren't 'hacking' anything to do so.
- RickHull 16y ago> It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: you can buy a cardreader that acts as a USB keyboard for $20 The point is that Square is marketed as a (presumably secure) payment device. i.e. two strangers (merchant and customer) establish trust so that the customer feels comfortable making a payment with the merchant's device. In the case of a standalone card reader, you can skim your own cards all day, but strangers aren't going to give you their card to skim without a fraudulent premise. Square's device provides a non-fraudulent premise, which is why the security flaw is a problem.
- pieter 16y agoI don't get it. What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? A lot of those packages consist of a windows/mac machine and a simple reader, you could write a kernel module or similar to do just that. Is it that Square advertises as being secure?
- jedsmith 16y agoPossible answer: the Square device is free to anybody that wants one.
- jtbigwoo 16y agoAnother possible answer: the square device is targeted at merchants with no permanent physical location thus lowering the barrier to entry for thieves.
- RickHull 16y ago> What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? Nothing, really. Most POS systems are resistant to data extraction. Square's is less so. My main point was that the USB card reader things are not POS devices. (Or are they?)