5 ms·

No, there are different solutions, and where I live the common practice is to perform the contactless operation while the cashier is still scanning the goods (a

by tjoff 6y ago

No, there are different solutions, and where I live the common practice is to perform the contactless operation while the cashier is still scanning the goods (and thus the total has not even been established), and just press ok when the final total is presented and be on your way. (if the total exceeds a certain number you will be prompted to enter your PIN, but you do not need to use your card again) It pretty much is the same thing as swiping the magnetic stripe. I've read out the information from the card myself and there are multiple demonstrations of it where they have a more powerful antenna and read it from peoples pockets in their wallets.

garaetjjte 6y ago
>It pretty much is the same thing as swiping the magnetic stripe. It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.
- tjoff 6y ago
  What would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated. Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
  - garaetjjte 6y ago
    Because it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode. Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.
    - tjoff 6y ago
      Doesn't matter? I'll just use the details that I got on the internet instead.
      - garaetjjte 6y ago
        Card not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.

by tjoff 6y ago

garaetjjte 6y ago

>It pretty much is the same thing as swiping the magnetic stripe. It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.

tjoff 6y ago
What would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated. Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
- garaetjjte 6y ago
  Because it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode. Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.
  - tjoff 6y ago
    Doesn't matter? I'll just use the details that I got on the internet instead.
    - garaetjjte 6y ago
      Card not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.