4 ms·

Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking t

by ljd 13y ago

Chip & Pin [0] as well online authentication challenges such as 3-D Secure [1] have already solved these issues but the United States has been slow to picking them up. [0] http://en.wikipedia.org/wiki/Chip_and_PIN http://en.wikipedia.org/wiki/Chip_and_PIN [1] http://en.wikipedia.org/wiki/3-D_Secure http://en.wikipedia.org/wiki/3-D_Secure

lvs 13y ago
It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities
- raverbashing 13y ago
  It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
  - dmishe 13y ago
    So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
    - deleted 13y ago
      [deleted]
    - kalleboo 13y ago
      The magstripe reader hack lets you copy the data using the magstripe and then replay it at any other mechant. When you hack a PIN keyboard, all the transactions will still go through the merchant's account, and it's easy to catch the thief.
    - raverbashing 13y ago
      You only forgot about the chip. It is very difficult to copy, and may even be impossible. Yes, there are pin readers, either a fake keyboard or a camera.
  - kalleboo 13y ago
    Some implementations of 3D secure are better than others. For instance, one of my banks uses a challenge/response system with a separate physical card reader http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.j...
jpollock 13y ago
Chip and Pin has already been attacked successfully. https://www.cl.cam.ac.uk/research/security/banking/relay/ https://www.cl.cam.ac.uk/research/security/banking/relay/
- kalleboo 13y ago
  With that attack, it's super-easy to catch the criminals (both the merchants should know who they hired). With mag-strip hacks, you can anonymously attach a skimmer anywhere that broadcasts the information to wherever you are at a safe distance. Huge difference in security. edit: for the record, I believe EMV should be upgraded to put a display and PIN pad on the card itself

by ljd 13y ago

lvs 13y ago

It seems like yet another bandage on the current model, no? http://en.wikipedia.org/wiki/EMV#Vulnerabilities http://en.wikipedia.org/wiki/EMV#Vulnerabilities

raverbashing 13y ago
It may have some vulnerabilities, however the biggest vulnerability is still the backwards compatible magnetic stripe EMV is a more secure than a trivially copyable magnetic stripe. And 3-D Secure is a JOKE.
- dmishe 13y ago
  So for pin, you really only need to hack the keyboard right? Either malware in existing one or setup a fake? Is it really that more secure than magnet strip then? I.e. if you have access to install a malicious strip reader, you surely can get access to pin keyboard?
  - deleted 13y ago
    [deleted]
  - kalleboo 13y ago
    The magstripe reader hack lets you copy the data using the magstripe and then replay it at any other mechant. When you hack a PIN keyboard, all the transactions will still go through the merchant's account, and it's easy to catch the thief.
  - raverbashing 13y ago
    You only forgot about the chip. It is very difficult to copy, and may even be impossible. Yes, there are pin readers, either a fake keyboard or a camera.
- kalleboo 13y ago
  Some implementations of 3D secure are better than others. For instance, one of my banks uses a challenge/response system with a separate physical card reader http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.jpg http://farm4.staticflickr.com/3237/2486214902_8feafd8200_b.j...

jpollock 13y ago

Chip and Pin has already been attacked successfully. https://www.cl.cam.ac.uk/research/security/banking/relay/ https://www.cl.cam.ac.uk/research/security/banking/relay/

kalleboo 13y ago
With that attack, it's super-easy to catch the criminals (both the merchants should know who they hired). With mag-strip hacks, you can anonymously attach a skimmer anywhere that broadcasts the information to wherever you are at a safe distance. Huge difference in security. edit: for the record, I believe EMV should be upgraded to put a display and PIN pad on the card itself