2 ms·

Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card

by mbreese 16y ago

Aside from the part where a vendor is required to keep your card number for refunds... Square (as I see it) is a two part solution: hardware to read your card and software to handle the transaction. The hardware is talking to whatever software is running. As a customer, you hope that software is legit, but you never know. How is this any different from handing your card to anyone else? USB card readers aren't black market by any means. This is how most POS devices read credit cards. It used to just be straight serial connections. It seems you're under the false assumption that the hardware path from your card to the software was ever secure. If Verifone really cared about a completely protected path for card numbers, they would disallow all USB card readers and require a secured path from reader to their clearing house. Unfortunately, that would remove credit card processing for many (all?) vendors. They are blaming Square for a security "flaw" that is present in their own system.

uxp 16y ago
> Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are required to retain the last 5 digits (or last 4, I'm not 100% positive), as well as the transaction time. When a chargeback or refund comes around, they'll cross reference multiple forms of identification on the transaction, but they'll never have to handle the full card number. All card readers are a two part solution. A hardware reader (USB, serial, whatever) is useless without some sort of {firm,soft}ware behind it. With Square, consumers will be trusting whoever they hand their card to be running current and legitimate software. How this is any different than me handing my card to an entirely random person at the corner store I don't understand, except this time I could write an alternate application to process the transaction myself without having to use a JTAG cable as I would for one of Verifone's closed systems. edit: clarification of last paragraph.
deleted 16y ago
[deleted]

by mbreese 16y ago

uxp 16y ago

> Aside from the part where a vendor is required to keep your card number for refunds... Vendors aren't required to retain the full card number. They are required to retain the last 5 digits (or last 4, I'm not 100% positive), as well as the transaction time. When a chargeback or refund comes around, they'll cross reference multiple forms of identification on the transaction, but they'll never have to handle the full card number. All card readers are a two part solution. A hardware reader (USB, serial, whatever) is useless without some sort of {firm,soft}ware behind it. With Square, consumers will be trusting whoever they hand their card to be running current and legitimate software. How this is any different than me handing my card to an entirely random person at the corner store I don't understand, except this time I could write an alternate application to process the transaction myself without having to use a JTAG cable as I would for one of Verifone's closed systems. edit: clarification of last paragraph.

deleted 16y ago

[deleted]