6 ms·

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online

First I would love to find a way to find which banks or processors are vulnerable. Second is, is there a way to gain the safety of the chip and pin with online purchases. Currently I obscure my CC info by using PayPal where available and when in the real world I live by Apple pay. If I could disable access to my card by stripe for real world where Apple pay is not usable I would.

brendoelfrendo 6y ago
Hm, that makes me wonder; is it possible to demagnetize or scramble the data on the mag stripe without harming the chip? I'm not sure how sensitive the chips are to magnetic interference, but if you can pull it off, you can make your own chip-only cards.
- andrewnicolalde 6y ago
  There certainly is. I have done this with a non-payment card. All you need is a magstripe reader/writer. A few tens of passes of writing random data to the magstripe should do the trick. Not sure how this would impact the usability of your card though, in case you do end up relying on the magstripe.
Nursie 6y ago
>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retailer systems. It's not the same level.of assurance as EMV, but it is something, and any transactions that don't go via that system are more likely to be declined or flagged as fraud.
- 0xffff2 6y ago
  How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.
  - te_chris 6y ago
    You don’t sign up to anything, it’s with the issuing bank or provider.
  - tialaramex 6y ago
    They're kind of half-arsed. So far as it's possible to tell, nobody who knew anything about UX or digital security was anywhere close to these projects. So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago) If an online retailer performs Authorisation the API they talk to will examine your card number and conclude it needs this extra check, so it tells them to forward your browser to an HTTPS site you've never heard of, in the arcot.com domain. I guess if you're a huge bank you've heard of Arcot, but consumers haven't. The site claims to be from your famous bank brand, but the domain name clearly isn't, anybody who has learned anything about phishing ought to run screaming. The arcot.com HTTPS site looks at the transaction and if you've never done this before it (presumably always? but maybe if there's a fraud flag this doesn't happen?) registers you for the "Verified by Visa" service. You can pick "No, I'm busy right now, just let me buy stuff" and it will give you a few passes, but I believe eventually it's mandatory. Signing up requires giving them some details about the card, and also effectively creating yet another secret password. (Because we all know secret passwords are great right?). There might be an option to pick a picture or text greeting so you'll "know it's them" although of course a sophisticated attacker could duplicate that part... On subsequent visits you may be asked for that secret if you've created it. Or, it might give up asking and just say everything is fine before returning you to the original payment flow. My transactions are reassuringly boring so I am never asked for anything these days. The whole thing looks like it was built by people who were impressed by IE6 and are planning to buy a 17" display soon. The cryptography would be impressive for the IE6 era and not so much today, it's TLS 1.2, it has some basic precautions, but it's scarcely Fort Knox, your GMail is better protected.
- thewebcount 6y ago
  Yeah, whenever I hit one of those, I immediately back out of the transaction. I'm like, "Wait, I'm supposed to be paying business X, why am I at a different web site? Something's fishy here. Fuck this."
  - hasa 6y ago
    Actually 3DS is much more reliable than giving credit card numbers to random online merchant that will face data breach sooner or later.
- fomine3 6y ago
  Maybe it's not two "Factor" auth because ID/pass and card number is both knowledge of secret.
grishka 6y ago
> Second is, is there a way to gain the safety of the chip and pin with online purchases. Yes, there's this 2FA thing where you're redirected to your bank's website and you have to enter the code they send to your phone. I've had this for ages and I'm surprised there are still places where it's not mainstream. Magstripes tho? I remember using mine when I visited the US in 2016 and that's about the only time when I used it. It was weird too, because most terminals had the chip slot but cashiers insisted that you swipe. The most bizarre part is that sometimes the transaction went through with just the swipe — no PIN, nothing.

brendoelfrendo 6y ago

Hm, that makes me wonder; is it possible to demagnetize or scramble the data on the mag stripe without harming the chip? I'm not sure how sensitive the chips are to magnetic interference, but if you can pull it off, you can make your own chip-only cards.

andrewnicolalde 6y ago
There certainly is. I have done this with a non-payment card. All you need is a magstripe reader/writer. A few tens of passes of writing random data to the magstripe should do the trick. Not sure how this would impact the usability of your card though, in case you do end up relying on the magstripe.

Nursie 6y ago

>Second is, is there a way to gain the safety of the chip and pin with online purchases. In the UK we have had "Verified by Visa" and "Mastercard 3D Secure" for many/most online transactions for a long time (12 years?) It's effectively a form of 2FA, the transaction flow diverts to a bank portal where you authorise the transaction with a password, or a selection of digits from a passcode. This never goes near retailer systems. It's not the same level.of assurance as EMV, but it is something, and any transactions that don't go via that system are more likely to be declined or flagged as fraud.

0xffff2 6y ago
How do those work over there? We have both in the US as well, but I've always refused to use them because signing up for either seems to transfer a significant chunk of the liability for fraudulent transactions away from the bank and on to the consumer.
- te_chris 6y ago
  You don’t sign up to anything, it’s with the issuing bank or provider.
- tialaramex 6y ago
  They're kind of half-arsed. So far as it's possible to tell, nobody who knew anything about UX or digital security was anywhere close to these projects. So, your bank opts in to the Verified by Visa scheme (they can't opt individual account holders out, or at least my otherwise very co-operative "good" bank said they can't when I asked years ago) If an online retailer performs Authorisation the API they talk to will examine your card number and conclude it needs this extra check, so it tells them to forward your browser to an HTTPS site you've never heard of, in the arcot.com domain. I guess if you're a huge bank you've heard of Arcot, but consumers haven't. The site claims to be from your famous bank brand, but the domain name clearly isn't, anybody who has learned anything about phishing ought to run screaming. The arcot.com HTTPS site looks at the transaction and if you've never done this before it (presumably always? but maybe if there's a fraud flag this doesn't happen?) registers you for the "Verified by Visa" service. You can pick "No, I'm busy right now, just let me buy stuff" and it will give you a few passes, but I believe eventually it's mandatory. Signing up requires giving them some details about the card, and also effectively creating yet another secret password. (Because we all know secret passwords are great right?). There might be an option to pick a picture or text greeting so you'll "know it's them" although of course a sophisticated attacker could duplicate that part... On subsequent visits you may be asked for that secret if you've created it. Or, it might give up asking and just say everything is fine before returning you to the original payment flow. My transactions are reassuringly boring so I am never asked for anything these days. The whole thing looks like it was built by people who were impressed by IE6 and are planning to buy a 17" display soon. The cryptography would be impressive for the IE6 era and not so much today, it's TLS 1.2, it has some basic precautions, but it's scarcely Fort Knox, your GMail is better protected.
thewebcount 6y ago
Yeah, whenever I hit one of those, I immediately back out of the transaction. I'm like, "Wait, I'm supposed to be paying business X, why am I at a different web site? Something's fishy here. Fuck this."
- hasa 6y ago
  Actually 3DS is much more reliable than giving credit card numbers to random online merchant that will face data breach sooner or later.
fomine3 6y ago
Maybe it's not two "Factor" auth because ID/pass and card number is both knowledge of secret.

grishka 6y ago

> Second is, is there a way to gain the safety of the chip and pin with online purchases. Yes, there's this 2FA thing where you're redirected to your bank's website and you have to enter the code they send to your phone. I've had this for ages and I'm surprised there are still places where it's not mainstream. Magstripes tho? I remember using mine when I visited the US in 2016 and that's about the only time when I used it. It was weird too, because most terminals had the chip slot but cashiers insisted that you swipe. The most bizarre part is that sometimes the transaction went through with just the swipe — no PIN, nothing.