3 ms·

The point is that Square is marketed as a (presumably secure) payment device. i.e. two (merchant and customer) establish trust so that the customer feel

The point is that Square is marketed as a (presumably secure) payment device. i.e. two (merchant and customer) establish trust so that the customer feels comfortable making a payment with the merchant's device. I don't see anything on Square's site that says: "If someone is using Square, then they are trustworthy." And it's a good thing, because it would be a completely wrong thing to claim. If I'm handing my credit card to someone I need to trust them no matter what device they happen to be using, because they have eyes and can read my information. It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. Square's security claims come into play once you trust that the person you're handing the card to doesn't want to rip you off. Once you accept that, then you can hold Square accountable for getting your data safely from that person to wherever it needs to go. But if you don't feel that the person you're physically giving the card to is legit, then Square can't possibly (or at least shouldn't) change your mind about that.

RickHull 16y ago
> It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. How is your track (magstripe) data vulnerable without a reader?
- stevelosh 16y ago
  The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card.
  - RickHull 16y ago
    > The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card. This information is not sufficient for a majority of transactions. Ecommerce tends to require VbV/SecureCode and Retail tends to require track data. These developments are a response to your very suggestion.

RickHull 16y ago

> It doesn't matter if they're using Square, Veri-whatever, or some beige-colored plastic card reader with a register that looks like it's from the 90's -- my data is vulnerable before it ever gets to the card reader. How is your track (magstripe) data vulnerable without a reader?

stevelosh 16y ago
The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card.
- RickHull 16y ago
  > The credit card number (and security code, and expiration date, and account holder name -- i.e. everything you need to "use" a credit card) is printed right on the card. This information is not sufficient for a majority of transactions. Ecommerce tends to require VbV/SecureCode and Retail tends to require track data. These developments are a response to your very suggestion.