5 ms·

How would encryption improve the security of a physical credit card?

ReactiveJelly 6y ago
It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.
- michannne 6y ago
  At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards
  - ericlewis 6y ago
    Skimmers.
  - CameronNemo 6y ago
    > And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? Why not allow plugging the card into the computer just like a yubikey for online payments? It would be quite difficult to pull off, but credit card companies can save a lot on fraudulent transactions if it is implemented.
    - Aerroon 6y ago
      In Estonia the government issued ID works like that. This allows you to log in to your bank too. Although you do need your PIN codes on top of the card.
    - michannne 6y ago
      Seems ridiculous to have to buy a device just to use my card. I would have to carry it around as well otherwise I wouldn't be able to use my card online
      - anfilt 6y ago
        It's honestly the issue is the card form factor. If you ditched the card form factor you could use USB or other common interfaces. The card form factor limits or requires it's own interface. Current cards with chips or contact less payment use a form of connection that PCs and Phones don't have integrated.
        michannne 6y ago
        The point is to have a way for the user to use their card without a device, and a way to keep the encryption. If you have a USB you've lost point #1
      - ryukafalz 6y ago
        If you were able to do this I think you’d find card readers built into laptops would be much more ubiquitous. It’s very commonly an option on business laptops already (probably thanks to the US government making heavy use of contact smartcards). And as for transactions on mobile phones, most of them have NFC as well; contactless payments could work there too.
        michannne 6y ago
        There's no reason that with chip technology as ubiquitous as it is that card readers shouldn't be more widespread. The fact that they aren't right now shows that the market isn't there
- fomine3 6y ago
  IC is secure by anti-tampering so it's secure at least now.
- bleepblorp 6y ago
  Virtually every country other than the United States uses a cryptographic NFC and/or chip and pin system for in-person credit/debit transactions. In most countries, the card number is only used for online and phone transactions. There's probably no way to do better than this without abandoning cards entirely in favor of some kind of device (or app) that has enough of a user interface to do a human-readable challenge response.
  - cdongrun 6y ago
    the us has had nfc and chip for years. we still support swiping too. your statement was true for a few short years when europe did chip first. which was much easier there, since credit cards were not as common, and didn't exist since 1950 like in america. we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can use 3dsecure, which has a pin. processing a transaction doesn't mean your money's gone. you can dispute any fraud charge for 2 months. so the pin doesn't do anything. and for bank accounts, where it's debit, and your cash is immediately taken out, we've had a pin since before europe had an atm card.
    - lmz 6y ago
      Technically true, yet POS support for chip transactions is still a bit less widespread, no?
      - xodice 6y ago
        In my small town I use only NFC via my watch, phone or tapping my card. If every place accepts NFC payments in this little town I would assume it's more widespread than you think. I think it's just not widely known about/common usage in the US even though the infrastructure seems to be widely there.
    - Symbiote 6y ago
      The USA is still rolling out chip support, with a date of 1 October for the remaining holdouts to use it. The rest of the world reached that point around 15 years ago, including countries with high credit card use (UK, France) and high debit card use (Northern Europe).
GoblinSlayer 6y ago
With public key cryptography you don't need the weak card number at all, it becomes just a historic baggage like the magnetic strip.

It only works if you have a chip inside, like Yubikey and other HSMs do. You can't do crypto with dumb block storage. But if you have a chip you should absolutely do _something_ smarter than storing and reciting the number verbatim.

michannne 6y ago
At that point why even show the number? It would be useless without the encryption. And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? I don't believe the majority of fraud is stolen physical credit cards
- ericlewis 6y ago
  Skimmers.
- CameronNemo 6y ago
  > And if you have some way to enter the numbers so online transactions still work, then what is the point of the encryption? Why not allow plugging the card into the computer just like a yubikey for online payments? It would be quite difficult to pull off, but credit card companies can save a lot on fraudulent transactions if it is implemented.
  - Aerroon 6y ago
    In Estonia the government issued ID works like that. This allows you to log in to your bank too. Although you do need your PIN codes on top of the card.
  - michannne 6y ago
    Seems ridiculous to have to buy a device just to use my card. I would have to carry it around as well otherwise I wouldn't be able to use my card online
    - anfilt 6y ago
      It's honestly the issue is the card form factor. If you ditched the card form factor you could use USB or other common interfaces. The card form factor limits or requires it's own interface. Current cards with chips or contact less payment use a form of connection that PCs and Phones don't have integrated.
      - michannne 6y ago
        The point is to have a way for the user to use their card without a device, and a way to keep the encryption. If you have a USB you've lost point #1
    - ryukafalz 6y ago
      If you were able to do this I think you’d find card readers built into laptops would be much more ubiquitous. It’s very commonly an option on business laptops already (probably thanks to the US government making heavy use of contact smartcards). And as for transactions on mobile phones, most of them have NFC as well; contactless payments could work there too.
      - michannne 6y ago
        There's no reason that with chip technology as ubiquitous as it is that card readers shouldn't be more widespread. The fact that they aren't right now shows that the market isn't there
fomine3 6y ago
IC is secure by anti-tampering so it's secure at least now.
bleepblorp 6y ago
Virtually every country other than the United States uses a cryptographic NFC and/or chip and pin system for in-person credit/debit transactions. In most countries, the card number is only used for online and phone transactions. There's probably no way to do better than this without abandoning cards entirely in favor of some kind of device (or app) that has enough of a user interface to do a human-readable challenge response.
- cdongrun 6y ago
  the us has had nfc and chip for years. we still support swiping too. your statement was true for a few short years when europe did chip first. which was much easier there, since credit cards were not as common, and didn't exist since 1950 like in america. we don't use a pin, because that doesn't help with fraud. most fraud is either online, or someone at the store, who can easily skim or see your pin. online you can use 3dsecure, which has a pin. processing a transaction doesn't mean your money's gone. you can dispute any fraud charge for 2 months. so the pin doesn't do anything. and for bank accounts, where it's debit, and your cash is immediately taken out, we've had a pin since before europe had an atm card.
  - lmz 6y ago
    Technically true, yet POS support for chip transactions is still a bit less widespread, no?
    - xodice 6y ago
      In my small town I use only NFC via my watch, phone or tapping my card. If every place accepts NFC payments in this little town I would assume it's more widespread than you think. I think it's just not widely known about/common usage in the US even though the infrastructure seems to be widely there.
  - Symbiote 6y ago
    The USA is still rolling out chip support, with a date of 1 October for the remaining holdouts to use it. The rest of the world reached that point around 15 years ago, including countries with high credit card use (UK, France) and high debit card use (Northern Europe).

GoblinSlayer 6y ago

With public key cryptography you don't need the weak card number at all, it becomes just a historic baggage like the magnetic strip.