14 ms·
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever s
by joshfraser 6y ago
What's crazy is that we've had public key encryption for over 40 years, and we're still publishing magic numbers on little pieces of plastic that give whoever sees them the power to take all our money without our consent.
- wangsijie 6y agoIn China, we pay by barcode\QRCode.
- bouncycastle 6y agoThis is Japan we are talking about - a place where many people still rely on fax machines.
- coeneedell 6y agocough cough glares at US federal and state agencies.
- blaser-waffle 6y agoI did federal contracting for years and never saw a single one. They all digital now homie, gov cloud all up in that bitch. State orgs wouldn't surprise me in the least tho.
- coeneedell 6y agoOkay fair, now that you mention it I think the last time I had to deal with it it was actually Montana State DOJ and not federal DOJ.
- devy 6y agoTalk about the power of inertia when attempting to change consumer behaviors. Also, we still haven't had an easy to use open tool set to make usage of Public Key Cryptography friendly to average Joes. No, GnuPG doesn't count - it's hard to use and cumbersome to configure it securely. You need to be a cryptographer or a mathematician to pick the right parameters in order to stay current and secure. Definitely not friendly even to most programmers.
- AmericanChopper 6y agoThe problem isn’t the tools. It’s that there is no such thing as an operable PKI. The best PKI (by far) is the CA system, and the CA system is not a good PKI. It has so many holes, and the PKI evangelists don’t like it anyway, because it uses trusted authorities. The only other examples of remotely useful PKIs in existence are things like Signal/WhatsApp... and those are even worse PKIs, because TOFU PKIs are in practice authenticationless PKIs.
- bleepblorp 6y agoI think most of the PKI trust issue, at least with regard to financial transactions, could be solved with government involvement. Governments could sign, or issue, PKI keys when they issue identity documents and business licenses. There's much less room for impersonation fraud if the keys used by businesses and people to identify themselves electronically are tied to their foundational identity documents. Obviously, using government-controlled PKI for communications would be unwise, but there's very little risk to using government PKI for financial transactions as governments already have warrantless access to this data.
- AmericanChopper 6y agoI think a government controlled PKI authority, especially one that required real identity authentication, would possibly be the solution that would make the least number of people happy.
- michannne 6y agoHow would encryption improve the security of a physical credit card?
- ReactiveJelly 6y agoIt only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.
- michannne 6y agoAt that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards
- ericlewis 6y agoSkimmers.
- CameronNemo 6y ago> And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? Why not allow plugging the card into the computer just like a yubikey for online payments? It would be quite difficult to pull off, but credit card companies can save a lot on fraudulent transactions if it is implemented.
- Aerroon 6y agoIn Estonia the government issued ID works like that. This allows you to log in to your bank too. Although you do need your PIN codes on top of the card.
- michannne 6y agoSeems ridiculous to have to buy a device just to use my card. I would have to carry it around as well otherwise I wouldn't be able to use my card online
- remote_phone 6y agoWhy on earth would we want this? Right now all of the burden is on the credit card companies. Any fraud is their liability. If we switch things up, and implement something like passwords or pins, WE get the liability. That’s worse than our current situation. And given how badly people get hacked or phished, all it means is that consumers lose. Right now, those “magic little numbers” work great, and in the case of fraud, we are protected. I don’t want the situation to reverse itself and have us the first to suffer from fraud.
- ineedasername 6y agoBy law, at least in the US, the maximum a consumer can be asked to pay when there's fraudulent credit card activity is $50.
- nouveaux 6y agoFraud liability usually falls on the business. Maybe the credit card companies shoulder the responsibility in some cases but I think its unlikely.
- ryanwatkins 6y agoThe liability is usually with the card issuer (bank), unless the merchant fails to meet liability shift requirements - like processes a card via the manually entered numbers or magstripe, rather than the chip in the card if the terminal supports it. This the way card networks have encouraged migration to systems that support tokens and cryptograms to limit fraud. See https://www.creditcards.com/credit-card-news/understanding-emv-fraud-liability-shift-1271/ https://www.creditcards.com/credit-card-news/understanding-e...
- creeble 6y agoI wish it were so. For card-not-present transactions (i.e., all online credit card transactions) the liability is the merchant's. There is no recourse for a merchant who is a victim of a stolen card, the money is simply removed from their account.
- 6y ago
- shultays 6y agoYou can scrap off the security code and if your card gets stolen you can always cancel it and get refund
- TwoBit 6y agoYeah but that's not the primary means of card number theft.
- i386 6y agoThat’s very US centric. In every other place except America, credit card issuers mandate the use EMV’s and pin codes.
- AlphaSite 6y agoI think most us cards have chips, but no pins. It’s bizarre.
- johncolanduoni 6y agoI used to think the same thing, but it turns out it actually makes sense (at least in the US): the vast majority of credit card fraud is counterfeit cards, not stolen cards. Requiring a chip which can’t be counterfeited from a list of lifted CC numbers (and sometimes track codes) solves most of the problem as far as card present purchases are concerned. That and shifting more liability to merchants if they don’t support chip readers.
- imtringued 6y agoYou can't skim the chip but you can trivially intercept the PIN.
- seppel 6y agoMy card has a PIN but the PIN is actually quite dangerous. If someone gets my PIN, then it fraudulent transactions become my problem. Whereas a stolen credit card number is a problem for the bank or the merchant.
- mrjin 6y agoPIN is not going to help you as transactions made with PIN will be deemed made by you and you are most likely going to cover the loss if fraud did happen.
- withinboredom 6y agoMy bank has programmable pins. So one pin goes to account X, and the other goes to account Y. It's super handy when travelling so we can have our "per diem" attached to one pin, and then have another pin for things that would fall outside of that purpose.
- deleted 6y ago[deleted]
- alkonaut 6y agoI was shocked to hear that my mastercard which I always use with CVC and 2FA or PIN actually works like a normal third world mastercard in some places. So while the security problem is kind of solved where I live, if someone stole my CC details they can still skim my card! Obviously I can block it for all transactions abroad but that doesn't seem like the best idea either. The only working solution is to generate temporary card numbers for international transactions, but that leads to the shortage issue.
- mcv 6y agoThat's what you get with security that's been patched on after the fact. It's basically optional security, which isn't real security at all. We need something that's been designed from the ground up with security in mind.
- Broken_Hippo 6y agoIsn't that a feature to make sure you can use it when you travel? Not everywhere supports chip and pin, do they? Has it ever been rolled out in the US, for example - or is 2FA something everyone can get? (I know it wasn't generally a thing before I moved).
- JshWright 6y agoChips are widespread in the US (as well as contactless). US banks don't bother with PINs, but most of the PoS systems deployed to deal with chips can support PINs if the card requires it.
- Broken_Hippo 6y agothanks. I've not been back for over 7 years, and that could have changed. I worked retail, and a few banks supported contactless at the time, but not many people actually had it (or perhaps not many used it).
- mcv 6y agoThe prevalence of credit cards has baffled me for decades now. I admit I have one, but the only thing I need it for is to buy things from webshops that don't cater to the Dutch market. Every webshop that's vaguely aware of the Dutch market supports iDeal, which is specifically designed to handle internet payment and doesn't involve sharing any sensitive information with merchants or other unknown parties; my bank handles authorization of the payment, and I tell my bank to authorize the payment. I admit the ability to reverse a credit card payment is nice, but that mostly means that it's also a risky form of payment to accept for the merchant. They might send the goods and still have the customer challenge the transaction. And of course you still pay for this; credit card transactions are relatively expensive.
- bartvk 6y agoThe Dutch system is not on the side of the consumer. It's simply a bank transaction before they send you the goods.
- bartvanH 6y agoYes, because the banks are not the ones who should be protecting the consumer. There are consumer protection laws in place to do the same thing the credit card companies seem to take care of from my POV :)
- DetroitThrow 6y agoJust curious, what exactly are these laws? Unreversible transactions front loads the burden of verifying inauthentic sales/services onto the consumer or government, doesn't necessarily provide a mechanism for returning a consumer's money when inauthentic merchants do show up, and restricts consumer choice either through having to be more discerning than a credit card user or relying on a government program to oversee merchant authenticity. I absolutely agree that banks should not be the ones discharged with consumer protection but unreversible payments are not nearly as beneficial for consumers even if insured in some ways by the government.
- jokethrowaway 6y ago
- hnarn 6y agoThis is not strictly true in all parts of the world. While this is the “default” way a credit card works, in my country chips and additional two part authentication has been mandatory for many years. Any transaction over a certain amount has to be verified via OTP (often over SMS) or other authentication software.
- kenniskrag 6y agoThere also exist 2FA solutions where they want an accept on a mobile app for example.
- me_me_me 6y ago> What's crazy is that we've had C and other higher level languages for over 40 years, and we're still maintaining banking and industry backends in Cobol or other old tech. The thing is something that works, and works well is hard to displace. Especially when it makes money. And when you are running a business and you have to choose: - keep making money - update system that is making money and hope it will work and it will stop making money What really is the sane option here? Also one other point the credit card companies are way better option for customer over say paypal.
- PascLeRasc 6y agoPassphrases for credit card numbers, maybe? It'd be easier to remember "bobcat reissue onscreen crook" than a series of 15-16 numbers and you'd have essentially unlimited versions.
- majewsky 6y agoYou'd have to limit yourself to a set of reasonably well-known words (and potentially weed out words that sound too alike). If we're very optimistic and assume the final set has 10,000 words, then one word has the same amount of entropy as 4 digits. Therefore four words and 16 digits are the same size of address space. You'd need at least five words. And you're quickly getting to the point where it's getting problematic to print these on the card in a font size that everyone can read (elderly citizens with bad eyesight included).
- mrjin 6y agoCard numbers are there for a reason: transactions without presenting the card, which actually are not a big problem as there are strict rules to follow and if frauds do occur, card holders are backed by charge-back policies. I guess all your concerns should really go to magnetic strip cards as there is virtually no way to tell fake card from genuine cards and that's the reason of EMV/PBOC card migration which just as you said, put strong cryptography into the chips on cards. But again, you still need card numbers to support transactions without presenting the card.
- iso1210 6y agoThere's far better ways to do it if you can use online - I submit my card number to them, they pass the card number, their account number, and the amount to my provider, I authorise they payment with my provider. If you're doing it over the phone though things like public key won't really work - to be long enough would make the numbers impossible to read out reliably, let alone the calculation I would need to do with my private key to prove I own it.
- mrjin 6y agoNah, think again, in either the merchant's or bank's perspective: how can they tell you are really who you claimed to be? That's the core question and why all the hustle. And again, even some design can perfectly solve that problem, there are additional problems to resolve: how to implement that change with reasonable cost, within reasonable time frame and with good user experience? And most importantly, does not break existing facilities. That's exactly how we get into the current situation, there are simply too much historical burden and while someone is trying to make things better, there maybe more organizations are putting sh*ts into it. For example, I really don't know if there were any banks ever used 5 digits PIN, but there are POS machines only accept 5 digits.
- iso1210 6y agoOnline you don't have to prove your account ownership to the merchant, just the bank. The merchant tells bank "I want $50 from account 17", the bank then says "Hey user, prove you own account 17 and are happy to spend $50", the user says "yes that's me", the bank tells the merchant "transaction approved".
- otabdeveloper4 6y ago> the power to take all our money without our consent Is this really a thing in the USA? I feel for you guys.
- romanoderoma 6y agoSo now you have replaced the magic number with a public key stored somewhere in your wallet together with the CC... Benefits?