4 ms·
btw if anyone has ever taken a look at a POS setup, it's a bit misleading to the uninformed In some solutions, the readers are in fact hooked up directly to th
by charles_kaw 4y ago
btw if anyone has ever taken a look at a POS setup, it's a bit misleading to the uninformed
In some solutions, the readers are in fact hooked up directly to the POS system. However, the card terminal does not see unencrypted payment data. The POS is acting as a network bridge or switch, while getting limited information over network from the terminal.
In fact, I'm not sure that's even something that's allowed in large scale installations today.
- MBCook 4y agoYou only get unencrypted stuff when doing mag-stripe, and that’s mostly just card number and name. Same with tap-to-pay may-stripe emulation (the old way which no one is supposed to use anymore, even in the US per credit card rules). That’s why everyone has/is moving off mag-stripe (depending on country) and to EMV. With EMV and EMV contactless the terminal never gets the full card number, among many other significant security improvements.
- charles_kaw 4y ago>You only get unencrypted stuff when doing mag-stripe The terminal encrypts it before sending it over the wire
- closewith 4y agoDo you have a source for this? The EMV spec doesn’t include encryption of any data sent to the terminal from the card. The transaction cryptogram is signed, however.
- charles_kaw 4y agoThe terminals themselves use mtls to communicate and wrap the payload , wasn't referring to the payload itself.
- closewith 4y agoThat seems like a walkback? You said: > However, the card terminal does not see unencrypted payment data. The card terminal does see unencrypted payment data. Hard to see your comment as ambiguous?
- deleted 4y ago[deleted]