5 ms·

What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address

by im3w1l 6y ago

What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? You'd still need a billing address I guess, but you might be able to get that by looking up the name and disambiguating using the location of the terminal.

Nextgrid 6y ago
A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.
- Nursie 6y ago
  Starting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)
  - Nextgrid 6y ago
    I said "starting" to include the US which I expect to be still far behind. I agree that in the UK it's been standard and in fact EU regulations now make this mandatory anyway.
  - ceejayoz 6y ago
    > It's been pretty standard for over ten years. It's unheard of in the US.
  - untog 6y ago
    I used to live in the UK (and still visit often) but now live in the US. You'd be amazed how far behind US banking is, even compared to the UK ten years ago.
  - tricolon 6y ago
    I'm in the US and have never heard of it.
  - kergonath 6y ago
    It’s common in Europe (I think it’s even mandatory now, though not necessarily for each transaction).
  - Dylan16807 6y ago
    I've seen it once or twice ever and I didn't know the password it wanted.
oneplane 6y ago
Depends on where you bank I suppose. Also depends on where you credit. I can't use my bank card without mutual validation, same with my credit card. Even if you do it manually we still get a challenge-response that you use a hardware device or an app for.
ceejayoz 6y ago
> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)
- Nursie 6y ago
  Why would you need it, you've got an iPhone right? (semi serious here - I'm sure they want you to use Apple Pay)
  - WorldMaker 6y ago
    If you want more convenience in your contactless payments, Apple suggest that you get a more recent Apple Watch. (Also semi-serious.)
  - SomeHacker44 6y ago
    There is a little thing called COVID. All my main payment cards are contactless now. I am not an Apple card customer.
    - dhosek 6y ago
      I'm not an Apple card customer either, but I use Apple pay with my cards usually on my watch, although once in a while it doesn't work at a terminal and I have to pull out my phone (which is annoying since facial recognition doesn't work with a mask on). I understand similar things exist for Android.
    - Nursie 6y ago
      Sure, but if you have an Apple card you're going to have an Apple phone, most probably, and that can do the contactless bit for you. Not sure if apple cards and android phones work, but android-pay is the other option for most cards. Both are more secure than using the card directly with contactless - you have verified to your phone that it is you using it, by logging in with face ID, touch ID, passcode, PIN, whatever. It's a form of cardholder verification that is missing when you use the card. That was my (slightly snarky) point - you don't need contactless on the card when you have a smart device that does it better.
gnopgnip 6y ago
Vendors get much less protection when doing a card not present transaction. They also usually pay higher fees. There are also cases where an additional layer of security is used, visa secure
8K832d7tNmiQ 6y ago
Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. I don’t know about other countries, but this is basically the premise of QRIS Technology [0] used in Indonesia, basically to put an end on competing in QR-based payment method. [0]: https://www.bi.go.id/QRIS/Contents/Default.aspx https://www.bi.go.id/QRIS/Contents/Default.aspx
- gruez 6y ago
  The one thing I like about the credit card system (as opposed to "app" pay system) is that the usability is so much better. You don't have to worry about your phone being smashed or running out of battery. It's also less work than a phone, all you need to do is wave your card in front of a reader. No need to get out your phone, unlock it, open the app, wave around your camera so it scans, and finally confirming the payment. Not having to install a potentially privacy invading app is also a plus.
- ravenstine 6y ago
  Wouldn't work in a lot of places where there's no LTE reception, though that will probably change with things like 5G and Starlink. I also wouldn't want my ability to pay to be tied to my phone. Not only do I want to be able to pay for things even when my phone is dead, but it just seems like it would add yet another vector of attack to steal my money.
  - cesarb 6y ago
    > > Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. > Wouldn't work in a lot of places where there's no LTE reception, I happened to read about this recently (https://www.emvco.com/emv-technologies/qrcodes/ https://www.emvco.com/emv-technologies/qrcodes/), since it's going to be the base of Brazil's new instant payment system to be released later this year (PIX - https://www.bcb.gov.br/estabilidadefinanceira/forumpagamentosinstantaneos https://www.bcb.gov.br/estabilidadefinanceira/forumpagamento...). From what I understood, it does have a way to do offline transactions. There are two kinds of QR codes: one which is scanned by the app and used for both online and offline transactions, and a second kind used when offline which is presented by the app and scanned by the POS. This second QR code contains data similar to what a chip card would return to the reader during an offline transaction, so the transaction flow after that point is similar.

by im3w1l 6y ago

Nextgrid 6y ago

A lot of merchants are starting to use 3D Secure now which is essentially two-factor authentication.

Nursie 6y ago
Starting to? It's been pretty standard for over ten years... (I'm in the UK, I have no idea how our market compares to yours)
- Nextgrid 6y ago
  I said "starting" to include the US which I expect to be still far behind. I agree that in the UK it's been standard and in fact EU regulations now make this mandatory anyway.
- ceejayoz 6y ago
  > It's been pretty standard for over ten years. It's unheard of in the US.
- untog 6y ago
  I used to live in the UK (and still visit often) but now live in the US. You'd be amazed how far behind US banking is, even compared to the UK ten years ago.
- tricolon 6y ago
  I'm in the US and have never heard of it.
- kergonath 6y ago
  It’s common in Europe (I think it’s even mandatory now, though not necessarily for each transaction).
- Dylan16807 6y ago
  I've seen it once or twice ever and I didn't know the password it wanted.

oneplane 6y ago

Depends on where you bank I suppose. Also depends on where you credit. I can't use my bank card without mutual validation, same with my credit card. Even if you do it manually we still get a challenge-response that you use a hardware device or an app for.

ceejayoz 6y ago

> What if you sidestepped all the chip cleverness and just put cameras to capture the name, CC number, expiration and 3 digits? Apple Cards have just the name on them, which is a nice step in the right direction. (No contactless, though, which is weird.)

Nursie 6y ago
Why would you need it, you've got an iPhone right? (semi serious here - I'm sure they want you to use Apple Pay)
- WorldMaker 6y ago
  If you want more convenience in your contactless payments, Apple suggest that you get a more recent Apple Watch. (Also semi-serious.)
- SomeHacker44 6y ago
  There is a little thing called COVID. All my main payment cards are contactless now. I am not an Apple card customer.
  - dhosek 6y ago
    I'm not an Apple card customer either, but I use Apple pay with my cards usually on my watch, although once in a while it doesn't work at a terminal and I have to pull out my phone (which is annoying since facial recognition doesn't work with a mask on). I understand similar things exist for Android.
  - Nursie 6y ago
    Sure, but if you have an Apple card you're going to have an Apple phone, most probably, and that can do the contactless bit for you. Not sure if apple cards and android phones work, but android-pay is the other option for most cards. Both are more secure than using the card directly with contactless - you have verified to your phone that it is you using it, by logging in with face ID, touch ID, passcode, PIN, whatever. It's a form of cardholder verification that is missing when you use the card. That was my (slightly snarky) point - you don't need contactless on the card when you have a smart device that does it better.

gnopgnip 6y ago

Vendors get much less protection when doing a card not present transaction. They also usually pay higher fees. There are also cases where an additional layer of security is used, visa secure

8K832d7tNmiQ 6y ago

Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. I don’t know about other countries, but this is basically the premise of QRIS Technology [0] used in Indonesia, basically to put an end on competing in QR-based payment method. [0]: https://www.bi.go.id/QRIS/Contents/Default.aspx https://www.bi.go.id/QRIS/Contents/Default.aspx

gruez 6y ago
The one thing I like about the credit card system (as opposed to "app" pay system) is that the usability is so much better. You don't have to worry about your phone being smashed or running out of battery. It's also less work than a phone, all you need to do is wave your card in front of a reader. No need to get out your phone, unlock it, open the app, wave around your camera so it scans, and finally confirming the payment. Not having to install a potentially privacy invading app is also a plus.
ravenstine 6y ago
Wouldn't work in a lot of places where there's no LTE reception, though that will probably change with things like 5G and Starlink. I also wouldn't want my ability to pay to be tied to my phone. Not only do I want to be able to pay for things even when my phone is dead, but it just seems like it would add yet another vector of attack to steal my money.
- cesarb 6y ago
  > > Another method would be a standardised QR code so that you can make a transaction from your app by scanning the qr code. > Wouldn't work in a lot of places where there's no LTE reception, I happened to read about this recently (https://www.emvco.com/emv-technologies/qrcodes/ https://www.emvco.com/emv-technologies/qrcodes/), since it's going to be the base of Brazil's new instant payment system to be released later this year (PIX - https://www.bcb.gov.br/estabilidadefinanceira/forumpagamentosinstantaneos https://www.bcb.gov.br/estabilidadefinanceira/forumpagamento...). From what I understood, it does have a way to do offline transactions. There are two kinds of QR codes: one which is scanned by the app and used for both online and offline transactions, and a second kind used when offline which is presented by the app and scanned by the POS. This second QR code contains data similar to what a chip card would return to the reader during an offline transaction, so the transaction flow after that point is similar.