5 ms·

Again, please answer this: why does the Square app need to know the plaintext number? That is what makes it different from a USB card reader that operates as a

Again, please answer this: why does the Square app need to know the plaintext number? That is what makes it different from a USB card reader that operates as a keyboard. One is designed to accept payments, and the other is designed to steal numbers. We're comparing apples and oranges here. The path from the Square device to Square's servers should be completely untouchable to any app. That's what VeriFone is saying. Simply because there are alternative black-market products that encourage crime (and cost money, by the way), there shouldn't be a free product that simply hands you card numbers if asked nicely.

mustpax 16y ago
It's a matter of cost vs. benefit. Designing an iPhone peripheral that has built-in crypto is extremely expensive (or any embedded system with strong crypto for that matter), especially if the information you're trying to protect is printed on the other side of the friggin card. The fact is, as a consumer, you can't know if the device that's going to read your card is legit. This is true even if you're looking at a state of the art IBM POS system or a tiny plastic widget with a coil of wire attached to a headphone jack.
- wmf 16y ago
  I think this is the most important point in this thread. Verifone (and the other big players) makes expensive card readers. Square is disrupting that with a card reader so cheap that they can give it away for free. Verifone is using a standard anti-disruption argument: we're not over-engineered because everyone needs this level of complexity (crypto in this case). This would potentially break Square's business model.
mbreese 16y ago
Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card and software to handle the transaction. The hardware is talking to whatever software is running. As a customer, you hope that software is legit, but you never know. How is this any different from handing your card to anyone else? USB card readers aren't black market by any means. This is how most POS devices read credit cards. It used to just be straight serial connections. It seems you're under the false assumption that the hardware path from your card to the software was ever secure. If Verifone really cared about a completely protected path for card numbers, they would disallow all USB card readers and require a secured path from reader to their clearing house. Unfortunately, that would remove credit card processing for many (all?) vendors. They are blaming Square for a security "flaw" that is present in their own system.
- uxp 16y ago
  > Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are required to retain the last 5 digits (or last 4, I'm not 100% positive), as well as the transaction time. When a chargeback or refund comes around, they'll cross reference multiple forms of identification on the transaction, but they'll never have to handle the full card number. All card readers are a two part solution. A hardware reader (USB, serial, whatever) is useless without some sort of {firm,soft}ware behind it. With Square, consumers will be trusting whoever they hand their card to be running current and legitimate software. How this is any different than me handing my card to an entirely random person at the corner store I don't understand, except this time I could write an alternate application to process the transaction myself without having to use a JTAG cable as I would for one of Verifone's closed systems. edit: clarification of last paragraph.
- deleted 16y ago
  [deleted]

mustpax 16y ago

It's a matter of cost vs. benefit. Designing an iPhone peripheral that has built-in crypto is extremely expensive (or any embedded system with strong crypto for that matter), especially if the information you're trying to protect is printed on the other side of the friggin card. The fact is, as a consumer, you can't know if the device that's going to read your card is legit. This is true even if you're looking at a state of the art IBM POS system or a tiny plastic widget with a coil of wire attached to a headphone jack.

wmf 16y ago
I think this is the most important point in this thread. Verifone (and the other big players) makes expensive card readers. Square is disrupting that with a card reader so cheap that they can give it away for free. Verifone is using a standard anti-disruption argument: we're not over-engineered because everyone needs this level of complexity (crypto in this case). This would potentially break Square's business model.

mbreese 16y ago

Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card and software to handle the transaction. The hardware is talking to whatever software is running. As a customer, you hope that software is legit, but you never know. How is this any different from handing your card to anyone else? USB card readers aren't black market by any means. This is how most POS devices read credit cards. It used to just be straight serial connections. It seems you're under the false assumption that the hardware path from your card to the software was ever secure. If Verifone really cared about a completely protected path for card numbers, they would disallow all USB card readers and require a secured path from reader to their clearing house. Unfortunately, that would remove credit card processing for many (all?) vendors. They are blaming Square for a security "flaw" that is present in their own system.

uxp 16y ago
> Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are required to retain the last 5 digits (or last 4, I'm not 100% positive), as well as the transaction time. When a chargeback or refund comes around, they'll cross reference multiple forms of identification on the transaction, but they'll never have to handle the full card number. All card readers are a two part solution. A hardware reader (USB, serial, whatever) is useless without some sort of {firm,soft}ware behind it. With Square, consumers will be trusting whoever they hand their card to be running current and legitimate software. How this is any different than me handing my card to an entirely random person at the corner store I don't understand, except this time I could write an alternate application to process the transaction myself without having to use a JTAG cable as I would for one of Verifone's closed systems. edit: clarification of last paragraph.
deleted 16y ago
[deleted]