6 ms·

>This is particularly unfortunate since US cards also happen to have pretty poor security... I remember reading about someone (or some startup) trying to addre

>This is particularly unfortunate since US cards also happen to have pretty poor security... I remember reading about someone (or some startup) trying to address this issue by using public key crypto to address the short-comings of credit cards in the states. The fees were supposed to be substantially lower and the major sources of fraud eliminated. But they kept hitting an invisible wall with every financial institution that was pitched the idea. It was a fascinating read (be sure to read all the parts). http://blog.rongarret.info/2013/02/a-simple-solution-to-credit-card-fraud.html http://blog.rongarret.info/2013/02/a-simple-solution-to-cred... Seriously: Why doesn't the US implement chip-and-pin?

nly 13y ago
> Seriously: Why doesn't the US implement chip-and-pin? Chip and PIN was shown to be flawed in 2010 at CCC[0]. This isn't why the US doesn't use it, but it it's a bit of a disaster in its own right. http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.h...
- aspensmonster 13y ago
  Interesting! I don't have a strong enough background to know if Ron Garret's suggested protocol is superior to chip-and-pin or falls to the same sort of attack mentioned in the link, but surely a strong and water-tight implementation is floating out there somewhere in the collective ether.
  - nly 13y ago
    The problem is presumably getting everyone to agree and move at once. Same problem with all the early 90s Internet protocols. Chip n PIN really messed up though, it was a big opportunity for change.
mcherm 13y ago
> Why doesn't the US implement chip-and-pin? The consumers don't implement chip-and-pin because they don't control ANYTHING. The retailers don't implement chip-and-pin because they buy their point-of-sale terminals from some supplier and they choose the cheapest one, which only has a magstripe reader, not a chip-and-pin reader. They're not losing any business this way because everyone's card supports magstripe readers. The card issuers are actually kind of interested in chip-and-pin, and have been for a couple of decades. But there are some serious problems. The cards cost more, and it's not fun to shoulder that expense without some benefit. Worse yet, the chip-and-pin cards are harder to use (you have to memorize a pin) and that loses customers. A couple of experiments with more advanced cards (notable the American Express Blue Card which had some SERIOUS advertising money behind it) have been abject failures. But this is all about to change. The rate of credit-card fraud by organized crime has finally reached the point where the credit card companies realize that they MUST act. While some of the cost gets pushed onto merchants, the majority is absorbed by the credit card companies and that's cutting into their profits. They can start issuing chip-and-pin capable cards, but it won't help because there aren't any reader terminals in the US. So they've found a way to fix that problem: by pushing the cost onto someone else. Starting in late 2015, any card-present transaction done with a chip-and-pin capable card (or chip-and-signature which will be used more heavily in the US because of that usability issue) which is found to be fraudulent will be the liability of the merchant, not the credit card issuer, if the merchant had a magstripe-only card reader. This, they hope, will finally change the US infrastructure, motivating major retailers and mom-and-pop small businesses throughout the country to spend collectively 100s of millions to billions of dollars on new card reader hardware. SOURCE: I work for one of the top US credit card issuers.
- frogpelt 13y ago
  What are the hardware costs per chip-and-pin reader? $500? It doesn't seem like such a big investment for a mom and pop. Wal-Mart/Target would have to buy 50-75 per store but the costs would be relatively the same.
  - mcherm 13y ago
    Whether or not it is "a lot" depends on a lot of details like what price you're getting offered, how big your profit margin is, and how much you have to pay to the person who installs it, configures it, and trains you to use it. These costs may be much more than $500. Empirically, I can say that despite the credit card industry asking nicely, almost no merchants anywhere in the US have installed pin-and-chip readers. (Of course, there has been essentially no benefit to them either.)
    - frogpelt 13y ago
      So, I guess as soon as the benefits outweigh the costs, just like any other business decision, retailers will be installing chip-and-pin readers here.
      - mcherm 13y ago
        Exactly. That's why I think the threat of having to shoulder the fraud risk will encourage people to upgrade. Not only is it an additional cost, it's an UNKNOWN cost, which is quite scary.
- zeidrich 13y ago
  I work as a retailer in Canada. When the banks issued people chip and pin cards, we upgraded our terminals. We had to because people needed to use the chip and pin cards. We didn't have an option to resist it because all that does is harm our ability to take payment. I also notice though that from consumers, interac debit seems to be more popular than credit cards for general purpose, and those have always required a pin. Does the US consumer primarily use credit cards? Or do they at least use them more than Canadians (or maybe Europeans?). I can see the difference in behavior between knowing a pin and not having to being a big difference in consumer adoption, moreso than retailers being willing to accept the cards. Like I said, when we had chip and pin introduced years ago, we just had to be able to support it whether we wanted to or not unless we wanted to start turning people away. But if consumers have always used primarily credit cards or cash, I can understand them avoiding the move towards having to remember a pin. The way that it was dealt with here is: If the merchant has a magstripe-only reader, my card will not be accepted. Everyone card is a chip and pin card, and people rarely carry cash. If you don't upgrade your hardware, it's not just a matter of being liable for fraud, it's simply that you can't continue to do business.
jobu 13y ago
Chip-and-pin is actually starting to roll out now, with a deadline for some types of transactions in October 2015: http://www.qsrmagazine.com/exclusives/are-you-ready-emv http://www.qsrmagazine.com/exclusives/are-you-ready-emv
- rblatz 13y ago
  That's annoying, now that it's been broken let's roll it out. Why not do the next big jump in payments, and just totally skip over chip and pin?

nly 13y ago

> Seriously: Why doesn't the US implement chip-and-pin? Chip and PIN was shown to be flawed in 2010 at CCC[0]. This isn't why the US doesn't use it, but it it's a bit of a disaster in its own right. http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.html http://events.ccc.de/congress/2010/Fahrplan/events/4211.en.h...

aspensmonster 13y ago
Interesting! I don't have a strong enough background to know if Ron Garret's suggested protocol is superior to chip-and-pin or falls to the same sort of attack mentioned in the link, but surely a strong and water-tight implementation is floating out there somewhere in the collective ether.
- nly 13y ago
  The problem is presumably getting everyone to agree and move at once. Same problem with all the early 90s Internet protocols. Chip n PIN really messed up though, it was a big opportunity for change.

mcherm 13y ago

> Why doesn't the US implement chip-and-pin? The consumers don't implement chip-and-pin because they don't control ANYTHING. The retailers don't implement chip-and-pin because they buy their point-of-sale terminals from some supplier and they choose the cheapest one, which only has a magstripe reader, not a chip-and-pin reader. They're not losing any business this way because everyone's card supports magstripe readers. The card issuers are actually kind of interested in chip-and-pin, and have been for a couple of decades. But there are some serious problems. The cards cost more, and it's not fun to shoulder that expense without some benefit. Worse yet, the chip-and-pin cards are harder to use (you have to memorize a pin) and that loses customers. A couple of experiments with more advanced cards (notable the American Express Blue Card which had some SERIOUS advertising money behind it) have been abject failures. But this is all about to change. The rate of credit-card fraud by organized crime has finally reached the point where the credit card companies realize that they MUST act. While some of the cost gets pushed onto merchants, the majority is absorbed by the credit card companies and that's cutting into their profits. They can start issuing chip-and-pin capable cards, but it won't help because there aren't any reader terminals in the US. So they've found a way to fix that problem: by pushing the cost onto someone else. Starting in late 2015, any card-present transaction done with a chip-and-pin capable card (or chip-and-signature which will be used more heavily in the US because of that usability issue) which is found to be fraudulent will be the liability of the merchant, not the credit card issuer, if the merchant had a magstripe-only card reader. This, they hope, will finally change the US infrastructure, motivating major retailers and mom-and-pop small businesses throughout the country to spend collectively 100s of millions to billions of dollars on new card reader hardware. SOURCE: I work for one of the top US credit card issuers.

frogpelt 13y ago
What are the hardware costs per chip-and-pin reader? $500? It doesn't seem like such a big investment for a mom and pop. Wal-Mart/Target would have to buy 50-75 per store but the costs would be relatively the same.
- mcherm 13y ago
  Whether or not it is "a lot" depends on a lot of details like what price you're getting offered, how big your profit margin is, and how much you have to pay to the person who installs it, configures it, and trains you to use it. These costs may be much more than $500. Empirically, I can say that despite the credit card industry asking nicely, almost no merchants anywhere in the US have installed pin-and-chip readers. (Of course, there has been essentially no benefit to them either.)
  - frogpelt 13y ago
    So, I guess as soon as the benefits outweigh the costs, just like any other business decision, retailers will be installing chip-and-pin readers here.
    - mcherm 13y ago
      Exactly. That's why I think the threat of having to shoulder the fraud risk will encourage people to upgrade. Not only is it an additional cost, it's an UNKNOWN cost, which is quite scary.
zeidrich 13y ago
I work as a retailer in Canada. When the banks issued people chip and pin cards, we upgraded our terminals. We had to because people needed to use the chip and pin cards. We didn't have an option to resist it because all that does is harm our ability to take payment. I also notice though that from consumers, interac debit seems to be more popular than credit cards for general purpose, and those have always required a pin. Does the US consumer primarily use credit cards? Or do they at least use them more than Canadians (or maybe Europeans?). I can see the difference in behavior between knowing a pin and not having to being a big difference in consumer adoption, moreso than retailers being willing to accept the cards. Like I said, when we had chip and pin introduced years ago, we just had to be able to support it whether we wanted to or not unless we wanted to start turning people away. But if consumers have always used primarily credit cards or cash, I can understand them avoiding the move towards having to remember a pin. The way that it was dealt with here is: If the merchant has a magstripe-only reader, my card will not be accepted. Everyone card is a chip and pin card, and people rarely carry cash. If you don't upgrade your hardware, it's not just a matter of being liable for fraud, it's simply that you can't continue to do business.

jobu 13y ago

Chip-and-pin is actually starting to roll out now, with a deadline for some types of transactions in October 2015: http://www.qsrmagazine.com/exclusives/are-you-ready-emv http://www.qsrmagazine.com/exclusives/are-you-ready-emv

rblatz 13y ago
That's annoying, now that it's been broken let's roll it out. Why not do the next big jump in payments, and just totally skip over chip and pin?