5 ms·

> It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new:

> It seems their problem with Square is that it allows you to get the credit card number in plaintext if you use their hardware. Of course, this is nothing new: you can buy a cardreader that acts as a USB keyboard for $20 The point is that Square is marketed as a (presumably secure) payment device. i.e. two strangers (merchant and customer) establish trust so that the customer feels comfortable making a payment with the merchant's device. In the case of a standalone card reader, you can skim your own cards all day, but strangers aren't going to give you their card to skim without a fraudulent premise. Square's device provides a non-fraudulent premise, which is why the security flaw is a problem.

pieter 16y ago
I don't get it. What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? A lot of those packages consist of a windows/mac machine and a simple reader, you could write a kernel module or similar to do just that. Is it that Square advertises as being secure?
- jedsmith 16y ago
  Possible answer: the Square device is free to anybody that wants one.
  - jtbigwoo 16y ago
    Another possible answer: the square device is targeted at merchants with no permanent physical location thus lowering the barrier to entry for thieves.
- RickHull 16y ago
  > What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? Nothing, really. Most POS systems are resistant to data extraction. Square's is less so. My main point was that the USB card reader things are not POS devices. (Or are they?)
  - pieter 16y ago
    Yes, they are, that's how most of those systems work.
  - radicaldreamer 16y ago
    A lot of small businesses use card readers plugged into PCs. I'm more worried about trojans on those PCs rather than some crafty salesman with a jailbroken iPhone.
stevelosh 16y ago
The point is that Square is marketed as a (presumably secure) payment device. i.e. two (merchant and customer) establish trust so that the customer feels comfortable making a payment with the merchant's device. I don't see anything on Square's site that says: "If someone is using Square, then they are trustworthy." And it's a good thing, because it would be a completely wrong thing to claim. If I'm handing my credit card to someone I need to trust them no matter what device they happen to be using, because they have eyes and can read my information. It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. Square's security claims come into play once you trust that the person you're handing the card to doesn't want to rip you off. Once you accept that, then you can hold Square accountable for getting your data safely from that person to wherever it needs to go. But if you don't feel that the person you're physically giving the card to is legit, then Square can't possibly (or at least shouldn't) change your mind about that.
- RickHull 16y ago
  > It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. How is your track (magstripe) data vulnerable without a reader?
  - stevelosh 16y ago
    The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card.
    - RickHull 16y ago
      > The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card. This information is not sufficient for a majority of transactions. Ecommerce tends to require VbV/SecureCode and Retail tends to require track data. These developments are a response to your very suggestion.

pieter 16y ago

I don't get it. What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? A lot of those packages consist of a windows/mac machine and a simple reader, you could write a kernel module or similar to do just that. Is it that Square advertises as being secure?

jedsmith 16y ago
Possible answer: the Square device is free to anybody that wants one.
- jtbigwoo 16y ago
  Another possible answer: the square device is targeted at merchants with no permanent physical location thus lowering the barrier to entry for thieves.
RickHull 16y ago
> What's the difference between using Square, swiping a customer's credit card and storing the data, or using a POS system, swiping a customer's CC and storing the data from that? Nothing, really. Most POS systems are resistant to data extraction. Square's is less so. My main point was that the USB card reader things are not POS devices. (Or are they?)
- pieter 16y ago
  Yes, they are, that's how most of those systems work.
- radicaldreamer 16y ago
  A lot of small businesses use card readers plugged into PCs. I'm more worried about trojans on those PCs rather than some crafty salesman with a jailbroken iPhone.

stevelosh 16y ago

The point is that Square is marketed as a (presumably secure) payment device. i.e. two (merchant and customer) establish trust so that the customer feels comfortable making a payment with the merchant's device. I don't see anything on Square's site that says: "If someone is using Square, then they are trustworthy." And it's a good thing, because it would be a completely wrong thing to claim. If I'm handing my credit card to someone I need to trust them no matter what device they happen to be using, because they have eyes and can read my information. It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. Square's security claims come into play once you trust that the person you're handing the card to doesn't want to rip you off. Once you accept that, then you can hold Square accountable for getting your data safely from that person to wherever it needs to go. But if you don't feel that the person you're physically giving the card to is legit, then Square can't possibly (or at least shouldn't) change your mind about that.

RickHull 16y ago
> It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. How is your track (magstripe) data vulnerable without a reader?
- stevelosh 16y ago
  The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card.
  - RickHull 16y ago
    > The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card. This information is not sufficient for a majority of transactions. Ecommerce tends to require VbV/SecureCode and Retail tends to require track data. These developments are a response to your very suggestion.