3 ms·

Are you serious? The victim in this scenario is handing their credit card to the attacker. That's game over. It doesn't matter whether the attacker has a Squar

by al3x 16y ago

Are you serious? The victim in this scenario is handing their credit card to the attacker. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. But then, there isn't yet a widely-deployed, field-tested alternative, at least in the US. The advent of NFC payments may put reasonable crypto in the POS flow, but I'm sure it's matter of time before side-channel attacks are discovered in the burgeoning NFC solutions. Security is hard. But VeriFone isn't talking about security. They're using security as an anti-competitive stalking horse, and that's a disgusting way to do business.

jedsmith 16y ago
> Are you serious? Very, and I will dig my heels in on this. For the record, your point would have been just as clear without this assertion that my point is stupid. > The victim in this scenario is HANDING THEIR CREDIT CARD TO THE ATTACKER. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. So everybody should just stop doing security, since people will figure out ways around it? Why bother? The Square device, as another commenter points out elsewhere in this thread, sets the expectation of a legitimate transaction. It's pushed, it's marketed, it's being set as the new brand of credit card processing. As such, Square have a responsibility to make sure that their products do not make skimming easier. And guess what? VeriFone found a way to skim, easily, with their product. This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous. I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. Internet Explorer 6 is pretty much a lost cause for Web exploits. Does that mean the rest of the browsers should not protect against Web exploits? This argument makes absolutely no sense. Who cares what others are doing? Do your product right. > I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. True. But there is NO REASON to make the vector EASIER. PERIOD. Simply because there are real risks with the vector means that we should take strides to make the vector harder.
- tedunangst 16y ago
  I don't know about you, but when I hand my credit card to somebody, I don't actually check out the brand name of the reader they're using. Whether the little gadget says Square or Circle or Rhombus on it has no effect on my expectation of a legitimate transaction. If legitimate people using Square could have their numbers stolen because the upstream communication to the server wasn't encrypted, that would be a problem. That would be something to secure. I mean, if the Square device couldn't read the raw numbers, then people would be complaining about how they own the hardware and they should be able to do whatever they want with it.
- YooLi 16y ago
  "This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous." Nice way to add 'black market' in there to try to dismiss a valid point. You can get card readers from legitimate businesses. They are valid peripherals used all the time. Do a search for 'usb credit card reader' on Google. All those results are not black market. As an aside, it's funny how you have a problem with GP saying 'Are you serious?' and thinking it implies your point is stupid but then take the exact same dismissive tone for your whole post. "I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. " The fact of the matter is that people hand their cards over all the time to pay for things and no one ever looks to see what kind of device it is. When you are paying for something in a shop, do you check out the credit card processing machine first to make sure it's secure? When you hand your card over to the waiter to take to the back and pay for your meal, do you follow him to make sure he isn't swiping it into another machine or writing the number down on paper? Nope. And the fact that the square reader is a plaintext device, like a lot of the readers on point-of-sale systems, really doesn't mean anything.
- tptacek 16y ago
  Jed, there are exactly two directions you can go from here, and I advise you to pick one of them instead of standing in the crossroads hollering and waving your arms. On one road, you make the argument that it is fundamentally unsafe to accept credit cards with commodity mobile computing devices, because there is no way to do chain-of-custody control with insecure magstripe cards. There is a reasonable case to be made here. I'll disagree with it, but you won't automatically lose. On the other road, you can provide one of more specific steps Square could take to make their commodity mobile card reader device meaningfully more secure. Be careful on this road because it is dangerous; people, myself included, will be standing on the side of the road shooting at you. Remember, anything you come up with must meaningfully improve the security of a device that can only interact with insecure magstripes. You can also walk your argument back, which is what I'd do if I were in your shoes.

by al3x 16y ago

jedsmith 16y ago

> Are you serious? Very, and I will dig my heels in on this. For the record, your point would have been just as clear without this assertion that my point is stupid. > The victim in this scenario is HANDING THEIR CREDIT CARD TO THE ATTACKER. That's game over. It doesn't matter whether the attacker has a Square, a VeriFone device, or a piece of paper for writing down the card number. If you hand your credit card to someone malicious, they can figure out how to do bad things with it. So everybody should just stop doing security, since people will figure out ways around it? Why bother? The Square device, as another commenter points out elsewhere in this thread, sets the expectation of a legitimate transaction. It's pushed, it's marketed, it's being set as the new brand of credit card processing. As such, Square have a responsibility to make sure that their products do not make skimming easier. And guess what? VeriFone found a way to skim, easily, with their product. This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous. I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. Internet Explorer 6 is pretty much a lost cause for Web exploits. Does that mean the rest of the browsers should not protect against Web exploits? This argument makes absolutely no sense. Who cares what others are doing? Do your product right. > I'm a big fan of Square, but it's important to remember that their solution doesn't remove the traditional risks of credit card usage. True. But there is NO REASON to make the vector EASIER. PERIOD. Simply because there are real risks with the vector means that we should take strides to make the vector harder.

tedunangst 16y ago
I don't know about you, but when I hand my credit card to somebody, I don't actually check out the brand name of the reader they're using. Whether the little gadget says Square or Circle or Rhombus on it has no effect on my expectation of a legitimate transaction. If legitimate people using Square could have their numbers stolen because the upstream communication to the server wasn't encrypted, that would be a problem. That would be something to secure. I mean, if the Square device couldn't read the raw numbers, then people would be complaining about how they own the hardware and they should be able to do whatever they want with it.
YooLi 16y ago
"This whole "but you can do it on the black market for $20!" argument is, pardon the Latin, fucking ridiculous." Nice way to add 'black market' in there to try to dismiss a valid point. You can get card readers from legitimate businesses. They are valid peripherals used all the time. Do a search for 'usb credit card reader' on Google. All those results are not black market. As an aside, it's funny how you have a problem with GP saying 'Are you serious?' and thinking it implies your point is stupid but then take the exact same dismissive tone for your whole post. "I seriously can't believe there are people in this thread, who identify themselves as IT specialists, siding with Square because credit card processing is a lost cause. " The fact of the matter is that people hand their cards over all the time to pay for things and no one ever looks to see what kind of device it is. When you are paying for something in a shop, do you check out the credit card processing machine first to make sure it's secure? When you hand your card over to the waiter to take to the back and pay for your meal, do you follow him to make sure he isn't swiping it into another machine or writing the number down on paper? Nope. And the fact that the square reader is a plaintext device, like a lot of the readers on point-of-sale systems, really doesn't mean anything.
tptacek 16y ago
Jed, there are exactly two directions you can go from here, and I advise you to pick one of them instead of standing in the crossroads hollering and waving your arms. On one road, you make the argument that it is fundamentally unsafe to accept credit cards with commodity mobile computing devices, because there is no way to do chain-of-custody control with insecure magstripe cards. There is a reasonable case to be made here. I'll disagree with it, but you won't automatically lose. On the other road, you can provide one of more specific steps Square could take to make their commodity mobile card reader device meaningfully more secure. Be careful on this road because it is dangerous; people, myself included, will be standing on the side of the road shooting at you. Remember, anything you come up with must meaningfully improve the security of a device that can only interact with insecure magstripes. You can also walk your argument back, which is what I'd do if I were in your shoes.