3 ms·
>It pretty much is the same thing as swiping the magnetic stripe. It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorizatio
by garaetjjte 6y ago
>It pretty much is the same thing as swiping the magnetic stripe.
It's not, magnetic stripe is dumb data store, EMV transaction does cryptographic authorization on card. If final amount isn't known it performs transaction with some dummy value, but from EMV view it is still transaction.
- tjoff 6y agoWhat would the point be of a cryptographic authorization if anyone+anything could just query the card details? As is trivially demonstrated. Maybe it is highly advanced data store that in the end just sends out the secret in plaintext. Doesn't really make a difference though.
- garaetjjte 6y agoBecause it is cryptographic authorization that allows to make payment, not just card details. You can read it, but card number is not enough to make payment in card-present mode. Whole point of EMV is that card cannot be cloned, as is trivially done with magnetic stripe card. You can do relay attacks, but this is so cumbersome, with PIN required at higher amounts, that I doubt anyone actually does it in practice.
- tjoff 6y agoDoesn't matter? I'll just use the details that I got on the internet instead.
- garaetjjte 6y agoCard not present transactions are ridiculously insecure, but that's totally different matter. That is complaining that EMV doesn't protect against transactions not made by EMV.. of course it doesn't. And these can be chargebacked easily anyway.