5 ms·

I think we're going to have to face the music soon: credit cards are a broken transaction mechanism. They have a basic security model that's decades old, with

by lvs 13y ago

I think we're going to have to face the music soon: credit cards are a broken transaction mechanism. They have a basic security model that's decades old, with only a few patches over time. The truth is that a credit card has no inherent security once you know a few essentially public things about it. Insert cryptocurrency endorsement here -- or at least something else, because the current tech has hit a wall.

ljd 13y ago
Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up. [0] http://en.wikipedia.org/wiki/Chip_and_PIN http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure
- lvs 13y ago
  It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities
  - raverbashing 13y ago
    It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
    - dmishe 13y ago
      So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
      - deleted 13y ago
        [deleted]
      - kalleboo 13y ago
        The magstripe reader hack lets you copy the data using the magstripe and then replay it at any other mechant. When you hack a PIN keyboard, all the transactions will still go through the merchant's account, and it's easy to catch the thief.
      - raverbashing 13y ago
        You only forgot about the chip. It is very difficult to copy, and may even be impossible. Yes, there are pin readers, either a fake keyboard or a camera.
    - kalleboo 13y ago
      Some implementations of 3D secure are better than others. For instance, one of my banks uses a challenge/response system with a separate physical card reader http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.j...
- jpollock 13y ago
  Chip and Pin has already been attacked successfully. https://www.cl.cam.ac.uk/research/security/banking/relay/ https://www.cl.cam.ac.uk/research/security/banking/relay/
  - kalleboo 13y ago
    With that attack, it's super-easy to catch the criminals (both the merchants should know who they hired). With mag-strip hacks, you can anonymously attach a skimmer anywhere that broadcasts the information to wherever you are at a safe distance. Huge difference in security. edit: for the record, I believe EMV should be upgraded to put a display and PIN pad on the card itself
2bluesc 13y ago
I'm a fan of crypto currency, but the current solutions don't quite solve this problem -- yet. I'm enthusiastic about what start-ups in the space will bring to the table to fix problems like this.
- tlb 13y ago
  What do you think is needed for Bitcoin to solve the problem? Is it just wider adoption, or are there technical features missing?
  - jimktrains2 13y ago
    A stable price for one. I can't have 0.1 btc be enough for a nice dinner one day and a cup of coffee the next. Second people need to have their wallets on their phones and know how to use it. That's more of a consumer education problem than a tech problem, though.
    - asperous 13y ago
      I'm a fan of cryptocurrency but I think this is going to be a insurmountable problem. Bitcoin lost more than half its value since last november.. that's not okay. People say "with growth.. etc.. will be stable." But USD/EUR isn't all that stable and that has massive volume and resources in motion to keep it stable (http://www.fxstreet.com/rates-charts/usdollar-index/ http://www.fxstreet.com/rates-charts/usdollar-index/) (See 88 -> 74 in 10 months).
      - jimktrains2 13y ago
        I never said it'd be easy (or possible :(), but for it to be wide spread huge swings in value can't be happening.
- jimktrains2 13y ago
  The current solutions (such as Chip-and-Pin and 3D-secure) do solve the problem. The problem is noöne uses them.
ketralnis 13y ago
I don't have a strong cryptocurrency opinion, but "we should have a better way to move money" vs. "we should have a totally different money system that's different in every way" is throwing the baby out with the bathwater. We can have "better credit cards". Most countries do. Bitcoin at present has a massive theft rate. Clearly it alone doesn't solve that problem at all.
- stcredzero 13y ago
  The bitcoin protocol isn't in question. It's the exchanges and the security of user computers that is the problem. Likewise, one could say that it's security of these institutions and user computer security that's the problem with credit cards.
  - ketralnis 13y ago
    AES maths isn't in question either but a viable sidechannel still makes a broken system that happens to use AES a bad system. I don't care if the Bitcoin protocol is in question, I care if all of my money is stolen. Still, I'm not saying that Bitcoin sucks and I disclaimed that I don't care one way or the other about Bitcoin up-front specifically to preclude predictable knee-jerk defensive replies like this. My claim is that "Bitcoin will solve this problem!" in response to every article about money is bullshit because we have Bitcoin and it still has problems, like a massive theft problem. It's a problem of bad implementations, whether cloned credit cards or stolen wallet files. And Bitcoin doesn't keep me from writing bad implementations. In fact it may make it worse: financial companies that move dollars have a high startup cost because of the regulatory work. Because it can no longer be two guys in a garage, it becomes more likely that the chain of people that they have to hire and speak to has at least one competent member. Clearly not guaranteed though, you'd think that the DMV would have the resources to become competent if they wanted to.
    - stcredzero 13y ago
      I disclaimed that I don't care one way or the other about Bitcoin up-front specifically to preclude predictable knee-jerk defensive replies like this. Uh, yeah. I'm not a knee-jerk defender of Bitcoin, and my statement is not a defense of Bitcoin so much as a balanced evaluation of the weaknesses of all sorts of payment systems.
jervisfm 13y ago
Agreed. But in the mean time, I encourage everyone to inquire if their bank supports virtual Credit Cards. Sometimes they do but may not widely advertise it. Using virtual cards provides you a fine level of control over various features of the credit card and also protects your real credit card number. One can set up time limits (expiry date), set a monetary limit or make it a one time use card. Virtual credit cards are also useful for dealing with service providers who make it hard to cancel their subscriptions (e.g. you have to call in and talk to a person to unsubscribe). With virtual credit cards, one can sign up freely and not have to worry about being continuously surreptitiously charged each month. Once the card expires or the transaction limit is exceeded, the service provider will be forced to close/suspend the account on their own.
- bashinator 13y ago
  Wouldn't that last example lead some (many?) service providers to send your account to a collections agency and hurt your credit rating?
  - ScottBurson 13y ago
    Normally, such recurring charges are for the month (year, whatever) of service that's about to be provided, not for the one that was just provided. So when the charge fails, you don't actually owe the vendor anything.
    - deleted 13y ago
      [deleted]
ojii 13y ago
I always wish we had some sort of standardized way to do Oauth-style payment via e-banking. As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account. Online payment is the only reason I have a (pre-paid) credit card, but it really doesn't need a credit card. I don't want/need "credit" and since it's online a "card" is useless. We already have e-banking for many things, why can't I use this for payment?
- kalleboo 13y ago
  > As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account This is quite common in Sweden at least. It's called "direct payment" and works with the 3 biggest banks. The rules around disputes and chargebacks are muddier though. Debit/credit cards also have 3DSecure for password authentication. edit: also, debit cards work 100% for online payment, there's no reason to apply for credit
gluczywo 13y ago
>Insert cryptocurrency endorsement here Not likely to happen soon: "The system is not sustainable but it may take decades until it collapses. Having multi billion budget credit card companies can shape legislation to stifle innovation that could reduce amount of fraud. Banks have no incentive to fix the system. The more fraud exists, the more obscure and complex services they can offer and the more effectively can justify their existence and demand higher fees." http://www.securitykiss.com/resources/roboblog/credit_cards/?page=2 http://www.securitykiss.com/resources/roboblog/credit_cards/...

by lvs 13y ago

ljd 13y ago

Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up. [0] http://en.wikipedia.org/wiki/Chip_and_PIN http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure

lvs 13y ago
It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities
- raverbashing 13y ago
  It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
  - dmishe 13y ago
    So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
    - deleted 13y ago
      [deleted]
    - kalleboo 13y ago
      The magstripe reader hack lets you copy the data using the magstripe and then replay it at any other mechant. When you hack a PIN keyboard, all the transactions will still go through the merchant's account, and it's easy to catch the thief.
    - raverbashing 13y ago
      You only forgot about the chip. It is very difficult to copy, and may even be impossible. Yes, there are pin readers, either a fake keyboard or a camera.
  - kalleboo 13y ago
    Some implementations of 3D secure are better than others. For instance, one of my banks uses a challenge/response system with a separate physical card reader http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.j...
jpollock 13y ago
Chip and Pin has already been attacked successfully. https://www.cl.cam.ac.uk/research/security/banking/relay/ https://www.cl.cam.ac.uk/research/security/banking/relay/
- kalleboo 13y ago
  With that attack, it's super-easy to catch the criminals (both the merchants should know who they hired). With mag-strip hacks, you can anonymously attach a skimmer anywhere that broadcasts the information to wherever you are at a safe distance. Huge difference in security. edit: for the record, I believe EMV should be upgraded to put a display and PIN pad on the card itself

2bluesc 13y ago

I'm a fan of crypto currency, but the current solutions don't quite solve this problem -- yet. I'm enthusiastic about what start-ups in the space will bring to the table to fix problems like this.

tlb 13y ago
What do you think is needed for Bitcoin to solve the problem? Is it just wider adoption, or are there technical features missing?
- jimktrains2 13y ago
  A stable price for one. I can't have 0.1 btc be enough for a nice dinner one day and a cup of coffee the next. Second people need to have their wallets on their phones and know how to use it. That's more of a consumer education problem than a tech problem, though.
  - asperous 13y ago
    I'm a fan of cryptocurrency but I think this is going to be a insurmountable problem. Bitcoin lost more than half its value since last november.. that's not okay. People say "with growth.. etc.. will be stable." But USD/EUR isn't all that stable and that has massive volume and resources in motion to keep it stable (http://www.fxstreet.com/rates-charts/usdollar-index/ http://www.fxstreet.com/rates-charts/usdollar-index/) (See 88 -> 74 in 10 months).
    - jimktrains2 13y ago
      I never said it'd be easy (or possible :(), but for it to be wide spread huge swings in value can't be happening.
jimktrains2 13y ago
The current solutions (such as Chip-and-Pin and 3D-secure) do solve the problem. The problem is noöne uses them.

ketralnis 13y ago

I don't have a strong cryptocurrency opinion, but "we should have a better way to move money" vs. "we should have a totally different money system that's different in every way" is throwing the baby out with the bathwater. We can have "better credit cards". Most countries do. Bitcoin at present has a massive theft rate. Clearly it alone doesn't solve that problem at all.

stcredzero 13y ago
The bitcoin protocol isn't in question. It's the exchanges and the security of user computers that is the problem. Likewise, one could say that it's security of these institutions and user computer security that's the problem with credit cards.
- ketralnis 13y ago
  AES maths isn't in question either but a viable sidechannel still makes a broken system that happens to use AES a bad system. I don't care if the Bitcoin protocol is in question, I care if all of my money is stolen. Still, I'm not saying that Bitcoin sucks and I disclaimed that I don't care one way or the other about Bitcoin up-front specifically to preclude predictable knee-jerk defensive replies like this. My claim is that "Bitcoin will solve this problem!" in response to every article about money is bullshit because we have Bitcoin and it still has problems, like a massive theft problem. It's a problem of bad implementations, whether cloned credit cards or stolen wallet files. And Bitcoin doesn't keep me from writing bad implementations. In fact it may make it worse: financial companies that move dollars have a high startup cost because of the regulatory work. Because it can no longer be two guys in a garage, it becomes more likely that the chain of people that they have to hire and speak to has at least one competent member. Clearly not guaranteed though, you'd think that the DMV would have the resources to become competent if they wanted to.
  - stcredzero 13y ago
    I disclaimed that I don't care one way or the other about Bitcoin up-front specifically to preclude predictable knee-jerk defensive replies like this. Uh, yeah. I'm not a knee-jerk defender of Bitcoin, and my statement is not a defense of Bitcoin so much as a balanced evaluation of the weaknesses of all sorts of payment systems.

jervisfm 13y ago

Agreed. But in the mean time, I encourage everyone to inquire if their bank supports virtual Credit Cards. Sometimes they do but may not widely advertise it. Using virtual cards provides you a fine level of control over various features of the credit card and also protects your real credit card number. One can set up time limits (expiry date), set a monetary limit or make it a one time use card. Virtual credit cards are also useful for dealing with service providers who make it hard to cancel their subscriptions (e.g. you have to call in and talk to a person to unsubscribe). With virtual credit cards, one can sign up freely and not have to worry about being continuously surreptitiously charged each month. Once the card expires or the transaction limit is exceeded, the service provider will be forced to close/suspend the account on their own.

bashinator 13y ago
Wouldn't that last example lead some (many?) service providers to send your account to a collections agency and hurt your credit rating?
- ScottBurson 13y ago
  Normally, such recurring charges are for the month (year, whatever) of service that's about to be provided, not for the one that was just provided. So when the charge fails, you don't actually owe the vendor anything.
  - deleted 13y ago
    [deleted]

ojii 13y ago

I always wish we had some sort of standardized way to do Oauth-style payment via e-banking. As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account. Online payment is the only reason I have a (pre-paid) credit card, but it really doesn't need a credit card. I don't want/need "credit" and since it's online a "card" is useless. We already have e-banking for many things, why can't I use this for payment?

kalleboo 13y ago
> As in, I go to onlinevendor.com and click "pay", it redirects me to my bank, I log in and accept the charge, it directly charges my bank account This is quite common in Sweden at least. It's called "direct payment" and works with the 3 biggest banks. The rules around disputes and chargebacks are muddier though. Debit/credit cards also have 3DSecure for password authentication. edit: also, debit cards work 100% for online payment, there's no reason to apply for credit

gluczywo 13y ago

>Insert cryptocurrency endorsement here Not likely to happen soon: "The system is not sustainable but it may take decades until it collapses. Having multi billion budget credit card companies can shape legislation to stifle innovation that could reduce amount of fraud. Banks have no incentive to fix the system. The more fraud exists, the more obscure and complex services they can offer and the more effectively can justify their existence and demand higher fees." http://www.securitykiss.com/resources/roboblog/credit_cards/?page=2 http://www.securitykiss.com/resources/roboblog/credit_cards/...