4 ms·

> I'd cut the original designers some slack. I'm willing to cut the original designers some slack. I'm not really willing to cut the industry slack for not fi

by amluto 4y ago

> I'd cut the original designers some slack. I'm willing to cut the original designers some slack. I'm not really willing to cut the industry slack for not fixing it. It's been years. Heck, EMV had been widely deployed in Europe for years before it showed up in the US. > Another reason: How would you even implement authentication? There are millions of terminals out there, operated by at least hundreds of different service providers. What key would you use for authentication and how would you hide it in a way that wouldn't eventually be leaked from legitimate terminals? There's no need. Just have the chip have an entirely different account number that only works for EMV transactions. This wouldn't even need updates to existing card readers. > Some issuers do, some don't. That's not the protocol's fault. This is the payment card industry, which has an entire tome of moderately onerous requirements that everyone must follow. Surely there could be a new requirement for issuers to verify that the transaction is authenticated properly.

p_l 4y ago
I do not recall all details, but EMV implementation in USA was different in terms of configuration applied, especially in terms of what data was required to auth the transaction, mainly due to some intercorporate politics iirc
lxgr 4y ago
> Just have the chip have an entirely different account number that only works for EMV transactions. Issuers can certainly do that, and some do (e.g. Apple Card). Some use cases don't handle that very well, though, e.g. booking a hotel online and then presenting the physical chip card for verification, comparing the last four digits printed on the card with those printed on the receipt for a refund, and others. But there is already something that is different across all interfaces (chip, magnetic stripe, human-readable printed card number): The CVC. Practically, this makes "cross-channel skimming" pretty hard.

by amluto 4y ago

p_l 4y ago

I do not recall all details, but EMV implementation in USA was different in terms of configuration applied, especially in terms of what data was required to auth the transaction, mainly due to some intercorporate politics iirc

lxgr 4y ago

> Just have the chip have an entirely different account number that only works for EMV transactions. Issuers can certainly do that, and some do (e.g. Apple Card). Some use cases don't handle that very well, though, e.g. booking a hotel online and then presenting the physical chip card for verification, comparing the last four digits printed on the card with those printed on the receipt for a refund, and others. But there is already something that is different across all interfaces (chip, magnetic stripe, human-readable printed card number): The CVC. Practically, this makes "cross-channel skimming" pretty hard.