6 ms·

If we used chip and PIN in the US would this still have been possible?

by minimax 13y ago

jrockway 13y ago
Can you buy things online with chip and PIN?
- jbroman 13y ago
  Not sure if this is serious or snark, but...no, you use the card number, of course. Similarly, the magnetic stripe is not typically used in online transactions either. The question is whether the chip-and-PIN technology would have revealed less information (i.e. insufficiently much to allow online purchases, etc.).
  - jrockway 13y ago
    Target's card readers, last time I checked, suck in the whole card like some ATM machines. So they can easily OCR the card number and CVV2, and store that. What always weirded me out about Target is that they used the credit card number (or name, or something on the card) as the key into their "loyalty program". If you bought some generic drug last time, this time their machine will print out a coupon for the name-brand version. This always weirded me out a little bit, though there is nothing preventing them from just storing a hash. Of course, the average developer never stores just a hash, and here we are.
    - helper 13y ago
      Why would you think that Target OCRs CVV2? They already have CVV1 (used for card in hand) read off the magstrap, so what would they want with CVV2? It would also be an insane violation of PCI rules.
      - jrockway 13y ago
        As far as I know, big companies can negotiate with the individual networks to do whatever they want with your credit card information, including storing the data in a non-PCI-compliant manner.
    - callahad 13y ago
      > Target's card readers, last time I checked, suck in the whole card like some ATM machines. So they can easily OCR the card number and CVV2, and store that. At least in the Minneapolis store I shopped at during the breach, it was a simple swipe terminal.
- minimax 13y ago
  From TFA: The shop was selling data stolen from the magnetic stripe of each card, which thieves can re-encode onto new, counterfeit cards and use to go shopping in bricks-and-mortar stores for items than can easily be fenced or resold. Is that possible to do with a chip and PIN card? Most of the focus from these articles seems to have to do with replicating the cards and using the replicas in stores, not online.
  - seszett 13y ago
    That's supposed to not be possible at all. I remember maybe a decade ago there was a kind of scare (well, at least the TV news talked about it) about YesCards, some kind of fraudulent EMV cards, but according to Wikipedia[0] it doesn't look like they would still work today. [0] https://fr.wikipedia.org/wiki/Yescard https://fr.wikipedia.org/wiki/Yescard (for some reason, the English article is deleted).
  - sliverstorm 13y ago
    It appears that chip-and-pin probably uses a challenge-response type of authentication, which would make the card nigh-impossible to duplicate. Chip-and-pin won't help you with online sales, but for any card-present sale (brick-and-mortar) it should ensure counterfeits cannot be used, and the PIN of course is the second factor to ensure only you can use the card.
- yosoyzenitram 13y ago
  Yes, you can - http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure When I buy something online using my CC, and if the payment processor supports that (mostly local/european shops), I get redirected to a page on my bank for verification. Some banks require the PIN to be entered, some others to enter your login credentials, some coordinates from your code card or even verify with a SMS code. Not exactly using the chip, but it involves the PIN surely.
  - superuser2 13y ago
    MasterCard has the same thing in the US. I think it's called SecureCode.
  - martinml 13y ago
    If the payment gateway decides to not implement this kind of protection, the payment goes through anyway (I'm guessing it'll be more expensive for the merchant, but still).
  - nemetroid 13y ago
    My bank issues chip and PIN readers for login and signing purposes. They are also used for 3-D Secure transactions.
radley 13y ago
Why not keep it simple: text message w/ reply...?
dlubarov 13y ago
The chip still provides a "track 2 equivalent" to the terminal - http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ If an attacker intercepts that, they can get the account number from it and potentially use it for online purchases. But they wouldn't have the postal code or security code, which most but not all ecommerce merchants require. It's a rather flawed system - there are strict protections around certain cardholder data like PINs, but none of that really prevents fraud since just the account number is enough to make certain purchases.
coin 13y ago
I don't see what the big deal is. If you use a credit card (not debit card), you aren't the one be defrauded. In the U.S., consumer protection laws limit the liability due to credit card fraud. If the fraudulent change is more than $50, the customer can dispute the charge within 60 days. During the investigation period the credit card company cannot collect on the disputed amount nor can they report this to the credit collection agencies. In other words it's the bank that out the money. This is why I prefer credit cards over debit cards. With a debit card the money is yanked out of your account. The onus is then on you to recover the funds.
- deleted 13y ago
  [deleted]
- jrockway 13y ago
  I've always liked this too. Let the bank figure out how not to have their money stolen. (Yes, this adds cost to the transaction. But as long as people want to take each other's money without permission, there is always going to be a cost to using money, whether it's an interchange fee, higher taxes, or just getting $500 bucks stolen on the subway from time to time.)
  - toomuchtodo 13y ago
    At the end of the day, it's not their money, its your money. You're paying the transaction and fraud costs built into purchases, which flows to merchants, which flows back to the banks and processors. Just because its not a line item somewhere on your bank statement doesn't mean you're not paying for it.
    - dagw 13y ago
      Sure, but at the end of the day its service that is so convenient and useful at a price that is so low I'm happy to pay for it.
    - superuser2 13y ago
      If you are taking unique and extraordinary steps to protect yourself, you're actually paying twice - with the effort to protect yourself and the money for your bank to protect you. This sort of action isn't meaningful unless it's collective. Even then, do you think businesses would lower prices or simply take home more money?

If we used chip and PIN in the US would this still have been possible?

by minimax 13y ago

If we used chip and PIN in the US would this still have been possible?

jrockway 13y ago

Can you buy things online with chip and PIN?

jbroman 13y ago
Not sure if this is serious or snark, but...no, you use the card number, of course. Similarly, the magnetic stripe is not typically used in online transactions either. The question is whether the chip-and-PIN technology would have revealed less information (i.e. insufficiently much to allow online purchases, etc.).
- jrockway 13y ago
  Target's card readers, last time I checked, suck in the whole card like some ATM machines. So they can easily OCR the card number and CVV2, and store that. What always weirded me out about Target is that they used the credit card number (or name, or something on the card) as the key into their "loyalty program". If you bought some generic drug last time, this time their machine will print out a coupon for the name-brand version. This always weirded me out a little bit, though there is nothing preventing them from just storing a hash. Of course, the average developer never stores just a hash, and here we are.
  - helper 13y ago
    Why would you think that Target OCRs CVV2? They already have CVV1 (used for card in hand) read off the magstrap, so what would they want with CVV2? It would also be an insane violation of PCI rules.
    - jrockway 13y ago
      As far as I know, big companies can negotiate with the individual networks to do whatever they want with your credit card information, including storing the data in a non-PCI-compliant manner.
  - callahad 13y ago
    > Target's card readers, last time I checked, suck in the whole card like some ATM machines. So they can easily OCR the card number and CVV2, and store that. At least in the Minneapolis store I shopped at during the breach, it was a simple swipe terminal.
minimax 13y ago
From TFA: The shop was selling data stolen from the magnetic stripe of each card, which thieves can re-encode onto new, counterfeit cards and use to go shopping in bricks-and-mortar stores for items than can easily be fenced or resold. Is that possible to do with a chip and PIN card? Most of the focus from these articles seems to have to do with replicating the cards and using the replicas in stores, not online.
- seszett 13y ago
  That's supposed to not be possible at all. I remember maybe a decade ago there was a kind of scare (well, at least the TV news talked about it) about YesCards, some kind of fraudulent EMV cards, but according to Wikipedia[0] it doesn't look like they would still work today. [0] https://fr.wikipedia.org/wiki/Yescard https://fr.wikipedia.org/wiki/Yescard (for some reason, the English article is deleted).
- sliverstorm 13y ago
  It appears that chip-and-pin probably uses a challenge-response type of authentication, which would make the card nigh-impossible to duplicate. Chip-and-pin won't help you with online sales, but for any card-present sale (brick-and-mortar) it should ensure counterfeits cannot be used, and the PIN of course is the second factor to ensure only you can use the card.
yosoyzenitram 13y ago
Yes, you can - http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure When I buy something online using my CC, and if the payment processor supports that (mostly local/european shops), I get redirected to a page on my bank for verification. Some banks require the PIN to be entered, some others to enter your login credentials, some coordinates from your code card or even verify with a SMS code. Not exactly using the chip, but it involves the PIN surely.
- superuser2 13y ago
  MasterCard has the same thing in the US. I think it's called SecureCode.
- martinml 13y ago
  If the payment gateway decides to not implement this kind of protection, the payment goes through anyway (I'm guessing it'll be more expensive for the merchant, but still).
- nemetroid 13y ago
  My bank issues chip and PIN readers for login and signing purposes. They are also used for 3-D Secure transactions.

radley 13y ago

Why not keep it simple: text message w/ reply...?

dlubarov 13y ago

The chip still provides a "track 2 equivalent" to the terminal - http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ If an attacker intercepts that, they can get the account number from it and potentially use it for online purchases. But they wouldn't have the postal code or security code, which most but not all ecommerce merchants require. It's a rather flawed system - there are strict protections around certain cardholder data like PINs, but none of that really prevents fraud since just the account number is enough to make certain purchases.

coin 13y ago

I don't see what the big deal is. If you use a credit card (not debit card), you aren't the one be defrauded. In the U.S., consumer protection laws limit the liability due to credit card fraud. If the fraudulent change is more than $50, the customer can dispute the charge within 60 days. During the investigation period the credit card company cannot collect on the disputed amount nor can they report this to the credit collection agencies. In other words it's the bank that out the money. This is why I prefer credit cards over debit cards. With a debit card the money is yanked out of your account. The onus is then on you to recover the funds.

deleted 13y ago
[deleted]
jrockway 13y ago
I've always liked this too. Let the bank figure out how not to have their money stolen. (Yes, this adds cost to the transaction. But as long as people want to take each other's money without permission, there is always going to be a cost to using money, whether it's an interchange fee, higher taxes, or just getting $500 bucks stolen on the subway from time to time.)
- toomuchtodo 13y ago
  At the end of the day, it's not their money, its your money. You're paying the transaction and fraud costs built into purchases, which flows to merchants, which flows back to the banks and processors. Just because its not a line item somewhere on your bank statement doesn't mean you're not paying for it.
  - dagw 13y ago
    Sure, but at the end of the day its service that is so convenient and useful at a price that is so low I'm happy to pay for it.
  - superuser2 13y ago
    If you are taking unique and extraordinary steps to protect yourself, you're actually paying twice - with the effort to protect yourself and the money for your bank to protect you. This sort of action isn't meaningful unless it's collective. Even then, do you think businesses would lower prices or simply take home more money?