5 ms·

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

by humaniania 6y ago

kevin_thibedeau 6y ago
Won't work for gas stations which are the last holdouts.
- lsllc 6y ago
  There's no reason why contactless EMV should not be required even at a gas station (not needing a limit).
  - aerostable_slug 6y ago
    Gas pump readers are very expensive. The solution for the wise customer is to go inside and use the POS terminal at the counter if possible. Old school gas station attack: many gas stations queue and forward transactions for reconciliation in batches, waiting to do so when they don't have connectivity. People have taken advantage of this fact by climbing up on the roof of stations with satellite connections for their POS terminals, tin-foiling them or otherwise blocking their transmission, then buying a bunch of gas with a stolen credit card. Head down to the next gas station, lather rinse repeat, and by the time things get figured out you've got maybe a hundred gallons of gas and a bunch of candy bars you can trade for meth (this is not a Bond Villain-level crime).
    - tialaramex 6y ago
      > The solution for the wise customer is to go inside and use the POS terminal at the counter if possible. That's irrelevant to this attack. Bad guys aren't obliged to use that terminal, and they're the ones relying on access to a mag-stripe reader. However for that "old school" attack EMV could help if it was deployed. Because EMV cards have state, they can have arbitrary rules about how often they're willing to perform offline transactions and how much value for. So e.g. a card can decide it won't do more than five offline transactions or more than $100 of transactions without going online.
      - aerostable_slug 6y ago
        I should have been more clear: the first sentence was meant for defeating skimmers and the like. Nothing to do with helping the retailer, just the end consumer. You're entirely correct with EMV. Additionally, more gas stations are moving away from the old satellite connections, and an m2m cellular card in a POS terminal is a lot harder to shut down (at least without the cashier noticing).
        tialaramex 6y ago
        The whole point of the scheme this HN post is about is that it doesn't need to skim the mag-stripe. Here's how this goes (everything in this story actually happened in England years ago, but that's before a change this story says wasn't entirely effective in eradicating the fraud) Sarah lives in England where they are getting EMV terminals everywhere. Her cousin Terry lives somewhere which doesn't yet have terminals everywhere. Let's say it's Belgium, although in fact it was not. Sarah owns a dozen petrol stations (that's what they call gas stations in England) and there are shiny EMV terminals arriving. Terry sends over instructions and electronic kits. The terminals are hollow and the instructions explain how to open one without the "anti-tamper" mechanism noticing and add more electronics in the convenient space. Sarah teaches all her staff how to use the new terminals. She of course doesn't mention they've been tampered with. You go to a petrol station, fill up your car, and hand your card to the clerk. "We got new machines" says the clerk and hands the card back. You put your card in the machine, and enter your PIN. I guess this is more secure? In Belgium, Terry receives the magnetic stripe details of your card, retrieved from the chip using a convenient "Hey what is your mag-stripe?" API and sent over by a mobile chip in that circuit Sarah fitted. Terry has a mag-stripe writer and turns a cheap plastic card into a good-enough clone of your bank card. He sells this card to street level criminals in Belgium for €100, Sarah will get £10 per card as her cut. Those street-level Belgian crooks need mag-stripe terminals because their cards have no chip, but you not swiping made no difference. Edited to add: While we're here. This is a recurring security problem. Old insecure systems can ruin it for new secure systems. Imagine you have a brand new, up-to-the-minute TLS 1.3 only website. You use a cert for www.example.com with a nice shiny Elliptic curve public key & the corresponding Elliptic curve private key is in an HSM at a protected site, no problems. What can go wrong? Unknown to you, some numb-nuts who was angry about the company choosing Slack set up an "experimental" IRC server doing SSLv3 on port 6667 of their laptop using a *.example.com wildcard RSA cert that's still valid until next month. Bad guys who get even fairly limited access to your network can attack that IRC server, which is running on a high port on some idiot's laptop computer in corporate, not the secure datacentre where the web server is, and use it to flawlessly impersonate www.example.com if they can get on-path. They know this trick can work as soon as they find the IRC server, no special insight is needed.
- joncrane 6y ago
  You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.
  - Alupis 6y ago
    Stumbled across my first one of these the other day. It's not obvious at all that you should leave it in - particularly when accustomed to the ubiquitous slide-in-and-out-fast kind. This one tried to lock my card in, but when I reflexively yanked on it to pull it out, somehow it lost contact with the chip or something. What followed was a stuck card in this machine, and the machine stuck on "verifying"... no cancel buttons worked either. Eventually, after a long and disconcerting minute had passed, it finally released my card and told me to go inside for payment. Definitely not user friendly in the slightest... and just an awful way to start your morning on your way to work.
  - 0xffff2 6y ago
    I travel a decent amount in the Western US, mostly in California and Oregon. I have never once encountered this.
    - reaperducer 6y ago
      I've seen it in Arizona, Nevada, and New Mexico. California should get on board.
- SAI_Peregrinus 6y ago
  The chain "Speedway" has chip card readers at their pumps, at least in my region (western NY).
  - kevin_thibedeau 6y ago
    The New York Speedways are all conversions from Mobil stations and they just upgraded their pumps. Few other stations are supporting chip cards.
- SEJeff 6y ago
  Until EVs are more mainstream I guess, but that won't probably be for another 5-10 years.
  - Thlom 6y ago
    Haha. A bit unrelated, not sure how it works in the rest of the world, but inNorway EV charging stations doesn’t even have a card reader, you have to sign up with an app and register your card there. And each charging company has their own app. Absolutely bonkers. You can get a chip for your key chain and tie it to all your apps so you can read that at the charging station, but still.
    - SEJeff 6y ago
      I own a Tesla, and there are not card readers at superchargers.
LeifCarrotson 6y ago
If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card companies are more to make every transaction a success and to blame the consumer when they're too successful. [1]: Yes, I recognize this is bad framing, the fault isn't with the victim nor really with the perpetrator but the incompetent designer of the lock.
- pc86 6y ago
  > the fault isn't with the victim nor really with the perpetrator The perpetrator isn't at fault?
  - Spivak 6y ago
    The perpetrator defrauded the bank, not you. The fault for your account not showing the correct balance should be on the bank.
    - pc86 6y ago
      That seems completely orthogonal to my question.
  - asveikau 6y ago
    The perpetrator is in one sense to blame but this isn't a good justification for lax security on the part of the card issuers. You wouldn't leave your door unlocked at night because it's the burglar's responsibility to be a better citizen.
- IshKebab 6y ago
  > If a transaction doesn't get made because it was over $40, that represents unacceptable missed profit Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit".
aerostable_slug 6y ago
This kind of thing is done today with EMV cards to determine whether the customer needs to enter a PIN or not. Under a threshold: swipe and go because the level of possible fraud is acceptable vs. the impact on the customer. Above a threshold, PIN required.
- lotsofpulp 6y ago
  Not in the US.
tomatocracy 6y ago
I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable compromise to me.
- tialaramex 6y ago
  This is called "Liability shift" yes. Shift is imposed where a retailer cannot/ does not accept chip cards rather than where for whatever reason a chip card wasn't able to be used. In the US shift was supposed to be imposed everywhere left this summer, I expect COVID-19 is offered as another reason to yet again delay, but retails stores are already covered, it's mostly things like some unattended 24 hour gasoline pumps that are still mag-stripe in the US. Also most (all?) card holders don't have a problem with the chip, they may be unable to remember a PIN, or unable to enter one, in which case the chip terminal requests a human witness them signing something or asks the retailer to accept just the chip. Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead.
  - alistairSH 6y ago
    Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead. Or, in the case of unmonitored "kiosks", the American is just left with a failed transaction. This was my experience with train ticket terminals in Italy and unattended petrol stations in the UK. Fortunately, in both cases, my secondary card has a PIN enabled. It was irritating that my primary card didn't offer a PIN, so I cancelled it upon my return to the US. Edit - this was 5 years ago, may have changed since, not sure as I changed cards to one that explicitly offered chip/pin at the time.
- Symbiote 6y ago
  I don't think disability requires using the magstripe. The chip can mark what security is required, just like many American cards are "Chip and Sign".

Maybe it would make sense to limit magstripe transactions to $40 or let people decide their own limit.

kevin_thibedeau 6y ago

Won't work for gas stations which are the last holdouts.

lsllc 6y ago
There's no reason why contactless EMV should not be required even at a gas station (not needing a limit).
- aerostable_slug 6y ago
  Gas pump readers are very expensive. The solution for the wise customer is to go inside and use the POS terminal at the counter if possible. Old school gas station attack: many gas stations queue and forward transactions for reconciliation in batches, waiting to do so when they don't have connectivity. People have taken advantage of this fact by climbing up on the roof of stations with satellite connections for their POS terminals, tin-foiling them or otherwise blocking their transmission, then buying a bunch of gas with a stolen credit card. Head down to the next gas station, lather rinse repeat, and by the time things get figured out you've got maybe a hundred gallons of gas and a bunch of candy bars you can trade for meth (this is not a Bond Villain-level crime).
  - tialaramex 6y ago
    > The solution for the wise customer is to go inside and use the POS terminal at the counter if possible. That's irrelevant to this attack. Bad guys aren't obliged to use that terminal, and they're the ones relying on access to a mag-stripe reader. However for that "old school" attack EMV could help if it was deployed. Because EMV cards have state, they can have arbitrary rules about how often they're willing to perform offline transactions and how much value for. So e.g. a card can decide it won't do more than five offline transactions or more than $100 of transactions without going online.
    - aerostable_slug 6y ago
      I should have been more clear: the first sentence was meant for defeating skimmers and the like. Nothing to do with helping the retailer, just the end consumer. You're entirely correct with EMV. Additionally, more gas stations are moving away from the old satellite connections, and an m2m cellular card in a POS terminal is a lot harder to shut down (at least without the cashier noticing).
      - tialaramex 6y ago
        The whole point of the scheme this HN post is about is that it doesn't need to skim the mag-stripe. Here's how this goes (everything in this story actually happened in England years ago, but that's before a change this story says wasn't entirely effective in eradicating the fraud) Sarah lives in England where they are getting EMV terminals everywhere. Her cousin Terry lives somewhere which doesn't yet have terminals everywhere. Let's say it's Belgium, although in fact it was not. Sarah owns a dozen petrol stations (that's what they call gas stations in England) and there are shiny EMV terminals arriving. Terry sends over instructions and electronic kits. The terminals are hollow and the instructions explain how to open one without the "anti-tamper" mechanism noticing and add more electronics in the convenient space. Sarah teaches all her staff how to use the new terminals. She of course doesn't mention they've been tampered with. You go to a petrol station, fill up your car, and hand your card to the clerk. "We got new machines" says the clerk and hands the card back. You put your card in the machine, and enter your PIN. I guess this is more secure? In Belgium, Terry receives the magnetic stripe details of your card, retrieved from the chip using a convenient "Hey what is your mag-stripe?" API and sent over by a mobile chip in that circuit Sarah fitted. Terry has a mag-stripe writer and turns a cheap plastic card into a good-enough clone of your bank card. He sells this card to street level criminals in Belgium for €100, Sarah will get £10 per card as her cut. Those street-level Belgian crooks need mag-stripe terminals because their cards have no chip, but you not swiping made no difference. Edited to add: While we're here. This is a recurring security problem. Old insecure systems can ruin it for new secure systems. Imagine you have a brand new, up-to-the-minute TLS 1.3 only website. You use a cert for www.example.com with a nice shiny Elliptic curve public key & the corresponding Elliptic curve private key is in an HSM at a protected site, no problems. What can go wrong? Unknown to you, some numb-nuts who was angry about the company choosing Slack set up an "experimental" IRC server doing SSLv3 on port 6667 of their laptop using a *.example.com wildcard RSA cert that's still valid until next month. Bad guys who get even fairly limited access to your network can attack that IRC server, which is running on a high port on some idiot's laptop computer in corporate, not the secure datacentre where the web server is, and use it to flawlessly impersonate www.example.com if they can get on-path. They know this trick can work as soon as they find the IRC server, no special insight is needed.
joncrane 6y ago
You sure? Most of the gas stations I use to fill up have me leave the card in for the chip reader, as opposed to slide it in and out quickly as before.
- Alupis 6y ago
  Stumbled across my first one of these the other day. It's not obvious at all that you should leave it in - particularly when accustomed to the ubiquitous slide-in-and-out-fast kind. This one tried to lock my card in, but when I reflexively yanked on it to pull it out, somehow it lost contact with the chip or something. What followed was a stuck card in this machine, and the machine stuck on "verifying"... no cancel buttons worked either. Eventually, after a long and disconcerting minute had passed, it finally released my card and told me to go inside for payment. Definitely not user friendly in the slightest... and just an awful way to start your morning on your way to work.
- 0xffff2 6y ago
  I travel a decent amount in the Western US, mostly in California and Oregon. I have never once encountered this.
  - reaperducer 6y ago
    I've seen it in Arizona, Nevada, and New Mexico. California should get on board.
SAI_Peregrinus 6y ago
The chain "Speedway" has chip card readers at their pumps, at least in my region (western NY).
- kevin_thibedeau 6y ago
  The New York Speedways are all conversions from Mobil stations and they just upgraded their pumps. Few other stations are supporting chip cards.
SEJeff 6y ago
Until EVs are more mainstream I guess, but that won't probably be for another 5-10 years.
- Thlom 6y ago
  Haha. A bit unrelated, not sure how it works in the rest of the world, but inNorway EV charging stations doesn’t even have a card reader, you have to sign up with an app and register your card there. And each charging company has their own app. Absolutely bonkers. You can get a chip for your key chain and tie it to all your apps so you can read that at the charging station, but still.
  - SEJeff 6y ago
    I own a Tesla, and there are not card readers at superchargers.

LeifCarrotson 6y ago

If a transaction doesn't get made because it was over $40, that represents unacceptable missed profits, if some unfortunate consumer gets their identity stolen[1], well, they should have been more careful. It would make sense to eliminate magstripes, to limit them to $40, to let people decide their own limit, or any number of other things - the trouble is that the incentives of the businesses, banks, and credit card companies are more to make every transaction a success and to blame the consumer when they're too successful. [1]: Yes, I recognize this is bad framing, the fault isn't with the victim nor really with the perpetrator but the incompetent designer of the lock.

pc86 6y ago
> the fault isn't with the victim nor really with the perpetrator The perpetrator isn't at fault?
- Spivak 6y ago
  The perpetrator defrauded the bank, not you. The fault for your account not showing the correct balance should be on the bank.
  - pc86 6y ago
    That seems completely orthogonal to my question.
- asveikau 6y ago
  The perpetrator is in one sense to blame but this isn't a good justification for lax security on the part of the card issuers. You wouldn't leave your door unlocked at night because it's the burglar's responsibility to be a better citizen.
IshKebab 6y ago
> If a transaction doesn't get made because it was over $40, that represents unacceptable missed profit Contactless already has transaction limits so clearly payment method-specific transaction limits do not create "unacceptable missed profit".

aerostable_slug 6y ago

This kind of thing is done today with EMV cards to determine whether the customer needs to enter a PIN or not. Under a threshold: swipe and go because the level of possible fraud is acceptable vs. the impact on the customer. Above a threshold, PIN required.

lotsofpulp 6y ago
Not in the US.

tomatocracy 6y ago

I believe the way it works (in some European countries at least - perhaps also the UK) is that if the retailer uses mag stripe then effectively they bear the fraud risk, whereas with chip and PIN the bank/card company does (not sure how this works for card holders who are unable to use chip and PIN due to disabilities, which is another reason mag stripes haven't gone away completely). This seems like a reasonable compromise to me.

tialaramex 6y ago
This is called "Liability shift" yes. Shift is imposed where a retailer cannot/ does not accept chip cards rather than where for whatever reason a chip card wasn't able to be used. In the US shift was supposed to be imposed everywhere left this summer, I expect COVID-19 is offered as another reason to yet again delay, but retails stores are already covered, it's mostly things like some unattended 24 hour gasoline pumps that are still mag-stripe in the US. Also most (all?) card holders don't have a problem with the chip, they may be unable to remember a PIN, or unable to enter one, in which case the chip terminal requests a human witness them signing something or asks the retailer to accept just the chip. Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead.
- alistairSH 6y ago
  Americans using European terminals may not have a PIN either, their chips tell the terminal this user doesn't have a PIN, they may be asked to sign something instead. Or, in the case of unmonitored "kiosks", the American is just left with a failed transaction. This was my experience with train ticket terminals in Italy and unattended petrol stations in the UK. Fortunately, in both cases, my secondary card has a PIN enabled. It was irritating that my primary card didn't offer a PIN, so I cancelled it upon my return to the US. Edit - this was 5 years ago, may have changed since, not sure as I changed cards to one that explicitly offered chip/pin at the time.
Symbiote 6y ago
I don't think disability requires using the magstripe. The chip can mark what security is required, just like many American cards are "Chip and Sign".