4 ms·

UPDATE Since I raised some serious concerns, I wanted to update from the comments provided. Square does not store the data on the device. The device must have a

by latch 16y ago

UPDATE Since I raised some serious concerns, I wanted to update from the comments provided. Square does not store the data on the device. The device must have an internet connection and the data is sent, securely, online. In other words, the original allegations are stupid any way you slice it. --- I think I'm missing something. People seem to think that the problem is that Square can be used as a skimmer - which I agree is stupid. That's like saying a pen & paper is a skimmer. However, it seems like the real issue is that Square stores the data on the device in the clear. What happens if the device gets stolen? Imagine if a web app stored CC information in the clear and it got hacked, people would rightfully hold the vendor/processor responsible. If devices get stolen and data is stored in the clear, Square is totally wrong and they are totally deflecting/mis-representing the issue. Can anyone with actual knowledge about this, rather than two business pointing fingers, clear this up for us?

bigmac 16y ago
Square doesn't store any data at all. Currently, the app requires internet access to process the payments.
Groxx 16y ago
From http://www.sq-skim.com/ http://www.sq-skim.com/ >Let me explain how easy it is to exploit the vulnerability. A criminal signs up with Square, obtains the dongle for free and creates a fake Square app on his smartphone. Insert the dongle into the audio jack of a smartphone or iPad, and you've got a mobile skimming device that fits in your pocket and that can be used to illegally collect personal and financial data from the magnetic stripe of a payment card. It's shockingly simple. The issue is that Square's hardware is poorly constructed and lacks all ability to encrypt consumers' data, creating a window for criminals to turn the device into a skimming machine in a matter of minutes. The "problem" is that the Square reader thing doesn't encrypt its communication to the iDevice. And it shouldn't. As Square said in the letter, by merely seeing your card someone has enough information to steal from you. At best they could public-key encrypt the data in the reader itself and pipe the encrypted data to their servers... until someone cracks the key. Or makes a fake Square reader that's identical to the ones out now. At which point we're back at square one. As it stands, Square just made a simpler version of a standard credit card reader, and for some reason they're claiming it's a security hole. FWIW: Verifone just guaranteed I'll go out of my way to avoid ever being a customer of theirs. This is FUD, plain and simple; they're probably doing it because they see a threat and are trying to squash it, rather than out-perform it.
- enjo 16y ago
  Is that really right tho? Lets follow the waiter example. In order to skim the card number they'd have to put the card down, pull out a pen, and copy it. Likely within plain sight of their employees. With a skimmer they just discretely 'double swipe' the card and they got what they need. It certainly makes it a simpler attack vector. Now you don't really need square to do this. There are plenty of magnetic card readers out there (I seem to recall someone got caught doing precisely this with a PDA of some kind). That doesn't mean that Square should make it simple. Why not provide some sort of encryption to the communications layer?
  - Groxx 16y ago
    People have cell phones with cameras - just take a picture. Nobody would think it strange that they have a cell phone in-hand while walking around. What sort of encryption would you think they could do? And how much larger and more expensive would it make the reader? And where would it get enough power to perform the encryption (which MUST be asymmetric to be secure, or the key can be extracted from the device)? They'd lose all semblance of interoperability between devices, add a battery, add significant cost, and all to fight a bogus claim and do nothing to prevent someone from buying a standard, unencrypted card reader that isn't under fire.
zbrock 16y ago
We don't store any data on the device per PCI security standards. We mention this on our security page: https://squareup.com/security https://squareup.com/security
- ryanhuff 16y ago
  Does the PCI security standards mention data communication encryption? If so, would this apply to the communication of data from the reader device to the software on the phone?
dgreensp 16y ago
The issue is truly the stupid one you mention. But it makes sense if you think about it from the point of view of a company whose business is "secure hardware" to bash the Square hardware as somehow being "insecure".
ryanhuff 16y ago
Isn't it possible that malware which found its way onto the phone could skim off the data as its being swiped? This is entirely different than a typical physical skimmer, as the person swiping the card for entirely legitimate reasons is likely unaware of the malware, and would be as much a victim as much as the cardholder. From what I understand, the Square device does not encrypt the data sent to the Square app, making it easier for malware to capture transaction data as its processed.

by latch 16y ago

bigmac 16y ago

Square doesn't store any data at all. Currently, the app requires internet access to process the payments.

Groxx 16y ago

From http://www.sq-skim.com/ http://www.sq-skim.com/ >Let me explain how easy it is to exploit the vulnerability. A criminal signs up with Square, obtains the dongle for free and creates a fake Square app on his smartphone. Insert the dongle into the audio jack of a smartphone or iPad, and you've got a mobile skimming device that fits in your pocket and that can be used to illegally collect personal and financial data from the magnetic stripe of a payment card. It's shockingly simple. The issue is that Square's hardware is poorly constructed and lacks all ability to encrypt consumers' data, creating a window for criminals to turn the device into a skimming machine in a matter of minutes. The "problem" is that the Square reader thing doesn't encrypt its communication to the iDevice. And it shouldn't. As Square said in the letter, by merely seeing your card someone has enough information to steal from you. At best they could public-key encrypt the data in the reader itself and pipe the encrypted data to their servers... until someone cracks the key. Or makes a fake Square reader that's identical to the ones out now. At which point we're back at square one. As it stands, Square just made a simpler version of a standard credit card reader, and for some reason they're claiming it's a security hole. FWIW: Verifone just guaranteed I'll go out of my way to avoid ever being a customer of theirs. This is FUD, plain and simple; they're probably doing it because they see a threat and are trying to squash it, rather than out-perform it.

enjo 16y ago
Is that really right tho? Lets follow the waiter example. In order to skim the card number they'd have to put the card down, pull out a pen, and copy it. Likely within plain sight of their employees. With a skimmer they just discretely 'double swipe' the card and they got what they need. It certainly makes it a simpler attack vector. Now you don't really need square to do this. There are plenty of magnetic card readers out there (I seem to recall someone got caught doing precisely this with a PDA of some kind). That doesn't mean that Square should make it simple. Why not provide some sort of encryption to the communications layer?
- Groxx 16y ago
  People have cell phones with cameras - just take a picture. Nobody would think it strange that they have a cell phone in-hand while walking around. What sort of encryption would you think they could do? And how much larger and more expensive would it make the reader? And where would it get enough power to perform the encryption (which MUST be asymmetric to be secure, or the key can be extracted from the device)? They'd lose all semblance of interoperability between devices, add a battery, add significant cost, and all to fight a bogus claim and do nothing to prevent someone from buying a standard, unencrypted card reader that isn't under fire.

zbrock 16y ago

We don't store any data on the device per PCI security standards. We mention this on our security page: https://squareup.com/security https://squareup.com/security

ryanhuff 16y ago
Does the PCI security standards mention data communication encryption? If so, would this apply to the communication of data from the reader device to the software on the phone?

dgreensp 16y ago

The issue is truly the stupid one you mention. But it makes sense if you think about it from the point of view of a company whose business is "secure hardware" to bash the Square hardware as somehow being "insecure".

ryanhuff 16y ago

Isn't it possible that malware which found its way onto the phone could skim off the data as its being swiped? This is entirely different than a typical physical skimmer, as the person swiping the card for entirely legitimate reasons is likely unaware of the malware, and would be as much a victim as much as the cardholder. From what I understand, the Square device does not encrypt the data sent to the Square app, making it easier for malware to capture transaction data as its processed.