4 ms·

This article has several inaccuracies and fallacies. The magnetic stripe on your credit card stores data in two separate bands. The old Reader grabbed from jus

This article has several inaccuracies and fallacies. The magnetic stripe on your credit card stores data in two separate bands. The old Reader grabbed from just one. With their new custom read head, Square can grab both, which makes every swipe more accurate, and more likely to work on one try. There are three tracks on a magnetic stripe (IATA, ABA and THRIFT), the first two are used in banking. The first track stores alphanumeric data such as your name; the second track stores numerical data, namely the card number. Reading both tracks doesn't make the swipe "more accurate" at all, since there is no redundancy there. On one level, developing a custom chip gave Square total control over the processes at the heart of the product: Decoding the magnetic signal from the credit card, encoding the electrical signal being sent to the smartphone, and all the encryption that happens in between. First, the decoding of the swipe does not happen on the reader. The first version of Square sent the entire audio clip to their servers for decoding; this new version may do it on the phone. Secondly, there is absolutely no encryption between the reader and the phone, any encryption is between the phone and their servers. The old version relied on a coin cell, which added around two millimeters to the overall thickness of the device. With their own chip, though, Square was able to be much more efficient in their use of power, to the point that they could draw all they needed from the smartphone via the audio jack. An audio jack provides no power. The signal is created by electromagnetic induction. The previous version of Square used a battery to amplify that signal. Edit: Square claims their new readers do some sort of "encryption." I am skeptical, but I had only tested the first version of the reader.

devicenull 13y ago
> An audio jack provides no power. The signal is created by electromagnetic induction. The previous version of Square used a battery to amplify that signal. Huh? I thought that you could get a limited amount of power from the audio jack by playing a tone through it while something's connected. http://stackoverflow.com/questions/5560867/how-to-get-electric-power-from-head-phone-jack http://stackoverflow.com/questions/5560867/how-to-get-electr... seems to agree.
- riobard 13y ago
  I have similar doubts too. If an audio jack doesn't provide any power, how does it drive headphones?
  - ChuckMcM 13y ago
    Technically the 'audio out' signal isn't power. However as folks have discovered you can send an audio signal, rectify it, and lightly load the audio amplifier (which will think it is driving some really crappy headphones :-) This is like using a side effect in software to initialize a variable. Clever but not durably so.
    - sliverstorm 13y ago
      Technically the 'audio out' signal isn't power. Explain? Even if we ignore losses, the 'audio out' signal does work when it drives headphones. I understand that an AC signal does not perform work when the current and voltage are perfectly out of phase, but that does not describe audio or else there would be no power transfer to drive the transducer.
      - ChuckMcM 13y ago
        The audio amplifier is designed with certain assumptions "baked in" which are different than those of a power supplying signal pin. In the case of the headphone amplifier, there is the impedance of the headphones and the duty cycle, or power over time component. So lets say you have a "1 Watt" headphone amplifier. Generally that specifies the peak power output when reproducing a signal. However, and many folks who have sent random tones through their stereo amplifiers have experienced this, if you send a 'peak power' tone through the amplifier continuously, the output stage may not (and often does not) have the power dissipation to keep that going. Instead it overheats and shuts off. You can of course design the power amplifier to be able to dissipate its peak power output continuously, but that is not generally necessary when listening to audio from it (even if you are a severe heavy metal listener). Something designed to supply power will deliver its rated power continuously. So the audio out signal is designed to drive headphones without distortion between a lower and upper frequency. It also has a power dissipation limit based on what the guy designing it figured you might be listening too and for how long and at what volume. If you guess wrong (as some of the imported "external speakers" for the iPhone did), you risk damaging the headphone amplifier permanently. So "Yes" there is going to be power available in the audio out signal, how much over what time period, is not part of the externally visible specification. If you damage your phone by attempting to draw too much power they don't fix it because "technically" you were not using it in an approved way. Does that help?
andrewpi 13y ago
Actually Square updated their reader to encrypt the swipe data sent from the device a while back. That is the revision that needs a battery inside the the reader (to power the chip that handles the encryption). I believe this was added after several competitors made a big deal about the skimming potential of a Square reader.
lnanek2 13y ago
Card exchanges love more data. You'll get much better cost rates and acceptance rates the more data you provide, and the more you get from the card the better. Or checking against typed in data. This is why we still use swipes at all instead of just taking a picture of the card. Converting magnetic signal to audio is a decoding and conversion. There may be more down the line, but it is still one step that can be called that. Similarly, there are plenty of pet projects out there that harvest the audio jack for power, like running an IR LED. You are just plain wrong on that point. There isn't any issue playing sound out while recording in.
djcapelis 13y ago
Most of the things you listed are untrue. You can get power out of the headphone jack, and they do. And I'm fairly certain the reader hasn't sent the audio to the servers in a long time. And the reader does directly do some encryption, which is what the new ASIC does. Your comment would match the first generations of readers, but they've iterated on them quite a bit since then.
antiterra 13y ago
It is untrue that there is no redundant data in the tracks. Track 1 and 2 both contain the account number (PAN) on credit cards. This article matches up what I saw when I worked in the payment industry: http://blog.opensecurityresearch.com/2012/02/deconstructing-credit-cards-data.html?m=1 http://blog.opensecurityresearch.com/2012/02/deconstructing-...
- eliteraspberrie 13y ago
  Track 1 is encoded as 7-bit digits, track 2 as 5-bit digits. So the data is only redundant after it is decoded, not in its binary form during the swipe.
  - SeanLuke 13y ago
    Regardless, this means the article is correct, right? By reading both tracks, Square can verify the correctness of the number it read. It doesn't matter what the "encoding" is: the number exists on both tracks. What is your complaint then?
  - antiterra 13y ago
    But if the original device didn't pull data from both tracks, this is an improvement: it allows for charging a card if you manage to get a successful read from either track. Quick service restaurants want as much of a lunch rush throughput as possible, they care about lost seconds. Also, if the reader manages to grab two error free tracks, it could compare them for accuracy.
bri3d 13y ago
"An audio jack provides no power." http://web.eecs.umich.edu/~prabal/pubs/papers/kuo10hijack.pdf http://web.eecs.umich.edu/~prabal/pubs/papers/kuo10hijack.pd... Really? It seems it's inarguably a crappy power supply but these people were able to extract over ten mW continuously from an iPhone 3GS's headphone jack, more than enough to run i.e. a commodity RFID chip.
- eliteraspberrie 13y ago
  I stand corrected. Very cool project.

devicenull 13y ago

> An audio jack provides no power. The signal is created by electromagnetic induction. The previous version of Square used a battery to amplify that signal. Huh? I thought that you could get a limited amount of power from the audio jack by playing a tone through it while something's connected. http://stackoverflow.com/questions/5560867/how-to-get-electric-power-from-head-phone-jack http://stackoverflow.com/questions/5560867/how-to-get-electr... seems to agree.

riobard 13y ago
I have similar doubts too. If an audio jack doesn't provide any power, how does it drive headphones?
- ChuckMcM 13y ago
  Technically the 'audio out' signal isn't power. However as folks have discovered you can send an audio signal, rectify it, and lightly load the audio amplifier (which will think it is driving some really crappy headphones :-) This is like using a side effect in software to initialize a variable. Clever but not durably so.
  - sliverstorm 13y ago
    Technically the 'audio out' signal isn't power. Explain? Even if we ignore losses, the 'audio out' signal does work when it drives headphones. I understand that an AC signal does not perform work when the current and voltage are perfectly out of phase, but that does not describe audio or else there would be no power transfer to drive the transducer.
    - ChuckMcM 13y ago
      The audio amplifier is designed with certain assumptions "baked in" which are different than those of a power supplying signal pin. In the case of the headphone amplifier, there is the impedance of the headphones and the duty cycle, or power over time component. So lets say you have a "1 Watt" headphone amplifier. Generally that specifies the peak power output when reproducing a signal. However, and many folks who have sent random tones through their stereo amplifiers have experienced this, if you send a 'peak power' tone through the amplifier continuously, the output stage may not (and often does not) have the power dissipation to keep that going. Instead it overheats and shuts off. You can of course design the power amplifier to be able to dissipate its peak power output continuously, but that is not generally necessary when listening to audio from it (even if you are a severe heavy metal listener). Something designed to supply power will deliver its rated power continuously. So the audio out signal is designed to drive headphones without distortion between a lower and upper frequency. It also has a power dissipation limit based on what the guy designing it figured you might be listening too and for how long and at what volume. If you guess wrong (as some of the imported "external speakers" for the iPhone did), you risk damaging the headphone amplifier permanently. So "Yes" there is going to be power available in the audio out signal, how much over what time period, is not part of the externally visible specification. If you damage your phone by attempting to draw too much power they don't fix it because "technically" you were not using it in an approved way. Does that help?

andrewpi 13y ago

Actually Square updated their reader to encrypt the swipe data sent from the device a while back. That is the revision that needs a battery inside the the reader (to power the chip that handles the encryption). I believe this was added after several competitors made a big deal about the skimming potential of a Square reader.

lnanek2 13y ago

Card exchanges love more data. You'll get much better cost rates and acceptance rates the more data you provide, and the more you get from the card the better. Or checking against typed in data. This is why we still use swipes at all instead of just taking a picture of the card. Converting magnetic signal to audio is a decoding and conversion. There may be more down the line, but it is still one step that can be called that. Similarly, there are plenty of pet projects out there that harvest the audio jack for power, like running an IR LED. You are just plain wrong on that point. There isn't any issue playing sound out while recording in.

djcapelis 13y ago

Most of the things you listed are untrue. You can get power out of the headphone jack, and they do. And I'm fairly certain the reader hasn't sent the audio to the servers in a long time. And the reader does directly do some encryption, which is what the new ASIC does. Your comment would match the first generations of readers, but they've iterated on them quite a bit since then.

antiterra 13y ago

It is untrue that there is no redundant data in the tracks. Track 1 and 2 both contain the account number (PAN) on credit cards. This article matches up what I saw when I worked in the payment industry: http://blog.opensecurityresearch.com/2012/02/deconstructing-credit-cards-data.html?m=1 http://blog.opensecurityresearch.com/2012/02/deconstructing-...

eliteraspberrie 13y ago
Track 1 is encoded as 7-bit digits, track 2 as 5-bit digits. So the data is only redundant after it is decoded, not in its binary form during the swipe.
- SeanLuke 13y ago
  Regardless, this means the article is correct, right? By reading both tracks, Square can verify the correctness of the number it read. It doesn't matter what the "encoding" is: the number exists on both tracks. What is your complaint then?
- antiterra 13y ago
  But if the original device didn't pull data from both tracks, this is an improvement: it allows for charging a card if you manage to get a successful read from either track. Quick service restaurants want as much of a lunch rush throughput as possible, they care about lost seconds. Also, if the reader manages to grab two error free tracks, it could compare them for accuracy.

bri3d 13y ago

"An audio jack provides no power." http://web.eecs.umich.edu/~prabal/pubs/papers/kuo10hijack.pdf http://web.eecs.umich.edu/~prabal/pubs/papers/kuo10hijack.pd... Really? It seems it's inarguably a crappy power supply but these people were able to extract over ten mW continuously from an iPhone 3GS's headphone jack, more than enough to run i.e. a commodity RFID chip.

eliteraspberrie 13y ago
I stand corrected. Very cool project.