5 ms·

> the secrets we were protecting are symmetric and printed on the card for anyone to see. On the magstripe and plastic, yes, but that is very rarely used today

> the secrets we were protecting are symmetric and printed on the card for anyone to see. On the magstripe and plastic, yes, but that is very rarely used today in stores. A modern chip card doesn't really expose secrets.

Gigachad 4y ago
I'm surprised the stripe is still added to cards these days. The chip broke on my mums card around 10 years ago and although the card readers had strip readers, they would often refuse to use it. Seem to remember some requiring a few failed chip uses before allowing magnetic strip.
- lmm 4y ago
  It's only a few years ago that we started seeing cards without embossed numbers for taking impressions by rubbing.
  - Gigachad 4y ago
    I think that actually made more sense. In a power outage the bumps were the only backup. I had seen it used once at a petrol station. While there is close to no situation where a chip payment or nfc couldn’t be used.
- jon-wood 4y ago
  My UK bank card has a mag stripe on it but I have to explicitly activate it via their mobile app, and it will be disabled again after seven days.
  - avianlyric 4y ago
    Only for ATM transactions. It’ll still work for normal transactions at a POS device, but they’re lower risk for the bank as it’s easy to perform chargebacks and recover the money
- avianlyric 4y ago
  Depends in what part of the world you’re in. In Europe I wouldn’t really expect anyone to accept magstripe on card with a chip, but in the US it’s more common. Additionally terminals can be configured to detect dodgy chips and automatically fall back magstripe, or a more basic form of processing. But your bank may block these transactions, because they can’t perform chargebacks on them, they’re considered as “secure/good as” Chip and PIN transactions by the card network for merchants in some parts of the worlds (e.g. the US). So if a fraudulent transaction was performed that way, the bank would have to eat the entire cost themselves.
- vishnugupta 4y ago
  That’s correct and stripes are mostly used as a fall back now a days, if at all. Merchants are reluctant to use stripe because in case of chargeback of a striped payment the liability shifts to the merchant, no question asked. That’s how the payment networks got merchants to migrate to use chip based authentication.
- aerostable_slug 4y ago
  The biggest reason in the US is the cost of replacing gas station pump payment terminals. They held back going "full" EMV (no stripe at all) for many years.
__MatrixMan__ 4y ago
But if a human can take a picture of the card and create online transactions based on that image, the necessary secrets are leaked anyhow. Secure the chip all you want, until we stop using shared symmetric secrets to authorize spend it won't really matter.

Gigachad 4y ago

I'm surprised the stripe is still added to cards these days. The chip broke on my mums card around 10 years ago and although the card readers had strip readers, they would often refuse to use it. Seem to remember some requiring a few failed chip uses before allowing magnetic strip.

lmm 4y ago
It's only a few years ago that we started seeing cards without embossed numbers for taking impressions by rubbing.
- Gigachad 4y ago
  I think that actually made more sense. In a power outage the bumps were the only backup. I had seen it used once at a petrol station. While there is close to no situation where a chip payment or nfc couldn’t be used.
jon-wood 4y ago
My UK bank card has a mag stripe on it but I have to explicitly activate it via their mobile app, and it will be disabled again after seven days.
- avianlyric 4y ago
  Only for ATM transactions. It’ll still work for normal transactions at a POS device, but they’re lower risk for the bank as it’s easy to perform chargebacks and recover the money
avianlyric 4y ago
Depends in what part of the world you’re in. In Europe I wouldn’t really expect anyone to accept magstripe on card with a chip, but in the US it’s more common. Additionally terminals can be configured to detect dodgy chips and automatically fall back magstripe, or a more basic form of processing. But your bank may block these transactions, because they can’t perform chargebacks on them, they’re considered as “secure/good as” Chip and PIN transactions by the card network for merchants in some parts of the worlds (e.g. the US). So if a fraudulent transaction was performed that way, the bank would have to eat the entire cost themselves.
vishnugupta 4y ago
That’s correct and stripes are mostly used as a fall back now a days, if at all. Merchants are reluctant to use stripe because in case of chargeback of a striped payment the liability shifts to the merchant, no question asked. That’s how the payment networks got merchants to migrate to use chip based authentication.
aerostable_slug 4y ago
The biggest reason in the US is the cost of replacing gas station pump payment terminals. They held back going "full" EMV (no stripe at all) for many years.

__MatrixMan__ 4y ago

But if a human can take a picture of the card and create online transactions based on that image, the necessary secrets are leaked anyhow. Secure the chip all you want, until we stop using shared symmetric secrets to authorize spend it won't really matter.