4 ms·

EMV has been trivially broken[1], and it unpopularly pushes the risk of fraud onto the customer. Customers in the US don't want that (especially since EMV is br

by gergles 14y ago

EMV has been trivially broken[1], and it unpopularly pushes the risk of fraud onto the customer. Customers in the US don't want that (especially since EMV is broken!). On top of that, there are a hell of a lot more merchants that would all need to purchase entirely new credit card terminals, which is a much larger undertaking in this country than it would be elsewhere. [1] http://www.cl.cam.ac.uk/research/security/banking/nopin/oakland10chipbroken.pdf http://www.cl.cam.ac.uk/research/security/banking/nopin/oakl...

ZoFreX 14y ago
That's not trivial compared to magnetic stripe. I created a credit card reader with £2 of electronics, my laptop, and a freely available open-source program. (And I'm pretty dumb, so it's really easy)
- heywire 14y ago
  What about the most vulnerable part of credit cards, the fact that the card information is printed right on the front (and back) of the card? Someone in line at the grocery store with a pen camera in their pocket can catch a glimpse of the front and back of a card. That is generally enough information to use the card online.
  - stephengillie 14y ago
    http://dilbert.com/strips/comic/1996-01-11/ http://dilbert.com/strips/comic/1996-01-11/
  - mikeash 14y ago
    How will you use that card information, though? The printed information isn't sufficient to create a new magnetic stripe (the CVV1 code in the magstripe isn't printed on the card). Using the card info online requires knowing the cardholder's address. If you can find someone still using an imprinter, then that would work, but so would completely made-up data.
    - elithrar 14y ago
      > Using the card info online requires knowing the cardholder's address. US (and Canada, UK) issued cards are verified against the billing address (AVS), in most cases. In other countries (e.g. Australia), this is not the case. The card number and CVC are typically sufficient; you can put any other address you would like. My Amazon billing address is my work address, which is not the address my bank has (my home).
      - mikeash 14y ago
        Interesting. Any idea why they don't verify the billing address there? Seems like it would be no harder than doing it in the US.
isaacwaller 14y ago
The paper you have linked describes an attack that is only possible if the attacker has stolen the victim's physical card. I think the real security of EMV lies in the fact that cards cannot be cloned - this attack does not change that fact.
geal 14y ago
That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.
ghshephard 14y ago
" In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network." I wasn't even aware that the chipped cards _had_ PINs. I think we can all agree that a chipped card + PIN is more secure than a magnetic strip card with no PIN. But, perhaps the reduction in fraud isn't worth the cost of replacing all the old gear.

by gergles 14y ago

ZoFreX 14y ago

That's not trivial compared to magnetic stripe. I created a credit card reader with £2 of electronics, my laptop, and a freely available open-source program. (And I'm pretty dumb, so it's really easy)

heywire 14y ago
What about the most vulnerable part of credit cards, the fact that the card information is printed right on the front (and back) of the card? Someone in line at the grocery store with a pen camera in their pocket can catch a glimpse of the front and back of a card. That is generally enough information to use the card online.
- stephengillie 14y ago
  http://dilbert.com/strips/comic/1996-01-11/ http://dilbert.com/strips/comic/1996-01-11/
- mikeash 14y ago
  How will you use that card information, though? The printed information isn't sufficient to create a new magnetic stripe (the CVV1 code in the magstripe isn't printed on the card). Using the card info online requires knowing the cardholder's address. If you can find someone still using an imprinter, then that would work, but so would completely made-up data.
  - elithrar 14y ago
    > Using the card info online requires knowing the cardholder's address. US (and Canada, UK) issued cards are verified against the billing address (AVS), in most cases. In other countries (e.g. Australia), this is not the case. The card number and CVC are typically sufficient; you can put any other address you would like. My Amazon billing address is my work address, which is not the address my bank has (my home).
    - mikeash 14y ago
      Interesting. Any idea why they don't verify the billing address there? Seems like it would be no harder than doing it in the US.

isaacwaller 14y ago

The paper you have linked describes an attack that is only possible if the attacker has stolen the victim's physical card. I think the real security of EMV lies in the fact that cards cannot be cloned - this attack does not change that fact.

geal 14y ago

That attack is far from trivial. There were other attacks against EMV in the past, but they're fixed as they come. Magnetic stripes stay vulnerable, and ATMs in the US are not that secure either (seriously, some of them can be stolen and taken home by one man alone). Securing chips is hard, but a lot of the process has already been figured out. What you should fear is the new RFID cards coming up soon. Those are even more vulnerable than magnetic stripes.

ghshephard 14y ago

" In this paper we describe and demonstrate a protocol flaw which allows criminals to use a genuine card to make a payment without knowing the card’s PIN, and to remain undetected even when the merchant has an online connection to the banking network." I wasn't even aware that the chipped cards _had_ PINs. I think we can all agree that a chipped card + PIN is more secure than a magnetic strip card with no PIN. But, perhaps the reduction in fraud isn't worth the cost of replacing all the old gear.