3 ms·

What's all this "sign with your finger" nonsense? With Chip & PIN cards (i.e., all our modern credit cards) you should just need the chip & PIN. Signatures are

What's all this "sign with your finger" nonsense? With Chip & PIN cards (i.e., all our modern credit cards) you should just need the chip & PIN. Signatures are only a backup authentication. Also, signing with anything other than a pen and paper is still a disastrous user experience (see every courier's PDA system ever built)

altrego99 14y ago
Even signing with pen and paper is a baggage we're carrying with hardly any guarantee of identification, and has challenges like your signature being too simple or changing over time. This is utterly rubbish and should be made obsolete in the digital age, IMHO. Where are the finger print scanners or iris scanners when we need them?
buro9 14y ago
PIN keypads have to be secure... totally secure. Passing through the iPhone isn't security. For them to include a PIN entry system, they would need to do so on the chip reader device itself (non-iPhone). The keypads for PIN entry systems always hash the PIN before it leaves the keypad... no other software gets the PIN. If you cannot offer secure PIN entry, then you cannot offer PIN entry. You can still take a signature, but now the burden of responsibility changes. Fraud is covered by the merchants if you use signatures.
- objclxt 14y ago
  A good example of this is the Apple Stores in Europe: like in the US, staff use iPods to take orders and checkout. The difference is when it comes to payment: instead of swiping the credit card and signing on the iPod screen, transaction details are wirelessly sent to one of many Chip & PIN readers around the store, and you then complete your purchase there.
  - thatjoshguy 14y ago
    Do they go to cashwrap, or do they have just 'standalone' chip+pin terminals in the store?
    - objclxt 14y ago
      They have stand-alone ones around the store, often in corners or out of sight near main display units.
    - ralphsaunders 14y ago
      In an Apple store they're often portable.
  - nemesisj 14y ago
    This isn't how it works in the UK. Here, staff inputs the order details, etc. on the iphone which is in a special case with a chip & pin reader and a keypad on the back. You insert your card, turn the iphone over, and enter your pin on the physical keypad which ostensibly separately transmits the transaction to the processor. Seems like a really nice solution and is something these guys should be able to leverage.
    - objclxt 14y ago
      Sounds cool...I guess that's a new VeriFone piece of tech. It has been a while since I went into an Apple Store, they certainly used to use separate terminals.
      - buro9 14y ago
        http://www.verifone.com/payware-mobile-enterprise/solutions/touch.aspx http://www.verifone.com/payware-mobile-enterprise/solutions/...
      - tiagotm 14y ago
        In fact, I believe Apple Store in Europe (at least in France) uses this: http://www.ingenico.com/en/0/ismp_gtygmj7t.html http://www.ingenico.com/en/0/ismp_gtygmj7t.html
- ralfn 14y ago
  Dutch cards all have a chip on them, which encrypts the transaction. In other words, the machiene doesnt have to be secure, since it never gets access to the private key inside the chip inside the card. They can still screw around with that one single transaction, but they cant duplicate the card. Its like an ssl tunnel straight from your card to your bank. The other party is just passing the encrypted one time permission slip to charge money. It completely ended skimming here. As for unsecured devices like an iPad, the goverment mandates two way authentification. This is done by sending an authorisation code per text message, or an auxiliery device, not connected to anything, that uses the signing chip on the card, to provide the user with a one time authentification code.
- deleted 14y ago
  [deleted]
- deleted 14y ago
  [deleted]

altrego99 14y ago

Even signing with pen and paper is a baggage we're carrying with hardly any guarantee of identification, and has challenges like your signature being too simple or changing over time. This is utterly rubbish and should be made obsolete in the digital age, IMHO. Where are the finger print scanners or iris scanners when we need them?

buro9 14y ago

PIN keypads have to be secure... totally secure. Passing through the iPhone isn't security. For them to include a PIN entry system, they would need to do so on the chip reader device itself (non-iPhone). The keypads for PIN entry systems always hash the PIN before it leaves the keypad... no other software gets the PIN. If you cannot offer secure PIN entry, then you cannot offer PIN entry. You can still take a signature, but now the burden of responsibility changes. Fraud is covered by the merchants if you use signatures.

objclxt 14y ago
A good example of this is the Apple Stores in Europe: like in the US, staff use iPods to take orders and checkout. The difference is when it comes to payment: instead of swiping the credit card and signing on the iPod screen, transaction details are wirelessly sent to one of many Chip & PIN readers around the store, and you then complete your purchase there.
- thatjoshguy 14y ago
  Do they go to cashwrap, or do they have just 'standalone' chip+pin terminals in the store?
  - objclxt 14y ago
    They have stand-alone ones around the store, often in corners or out of sight near main display units.
  - ralphsaunders 14y ago
    In an Apple store they're often portable.
- nemesisj 14y ago
  This isn't how it works in the UK. Here, staff inputs the order details, etc. on the iphone which is in a special case with a chip & pin reader and a keypad on the back. You insert your card, turn the iphone over, and enter your pin on the physical keypad which ostensibly separately transmits the transaction to the processor. Seems like a really nice solution and is something these guys should be able to leverage.
  - objclxt 14y ago
    Sounds cool...I guess that's a new VeriFone piece of tech. It has been a while since I went into an Apple Store, they certainly used to use separate terminals.
    - buro9 14y ago
      http://www.verifone.com/payware-mobile-enterprise/solutions/touch.aspx http://www.verifone.com/payware-mobile-enterprise/solutions/...
    - tiagotm 14y ago
      In fact, I believe Apple Store in Europe (at least in France) uses this: http://www.ingenico.com/en/0/ismp_gtygmj7t.html http://www.ingenico.com/en/0/ismp_gtygmj7t.html
ralfn 14y ago
Dutch cards all have a chip on them, which encrypts the transaction. In other words, the machiene doesnt have to be secure, since it never gets access to the private key inside the chip inside the card. They can still screw around with that one single transaction, but they cant duplicate the card. Its like an ssl tunnel straight from your card to your bank. The other party is just passing the encrypted one time permission slip to charge money. It completely ended skimming here. As for unsecured devices like an iPad, the goverment mandates two way authentification. This is done by sending an authorisation code per text message, or an auxiliery device, not connected to anything, that uses the signing chip on the card, to provide the user with a one time authentification code.
deleted 14y ago
[deleted]
deleted 14y ago
[deleted]