4 ms·

Chip and pin pretty much solves this. My understanding is that its much more difficult to intercept the transaction due to the cryptography involved. No one ha

Chip and pin pretty much solves this. My understanding is that its much more difficult to intercept the transaction due to the cryptography involved. No one handles your card or walks away with it like in the US. They bring the wireless cc terminal to you. These are coming to the US in 2015. I suspect a lot of the issues we have today will be minimized as we move away from magstripes and waiters walking away with your credit card. http://blogs.wsj.com/corporate-intelligence/2014/02/06/october-2015-the-end-of-the-swipe-and-sign-credit-card/ http://blogs.wsj.com/corporate-intelligence/2014/02/06/octob...

sliverstorm 12y ago
I've been pestering my credit card companies for years now, asking for chip-and-pin. It's the best I can think of to do.
calpaterson 12y ago
Sadly that is not the case. Major problems with chip and pin: - the chips used (32kb 90s-style smartcards AIUI) are simple to read and save, making chip and pin readers susceptible to the same social engineering attacks as magnetic stripe cards (btw, in the UK there have been skimmers for chip and pin for some time) - most terminals on the market transmit the pin in the clear from one part of the unit to the other, so it is trivial to doctor a legitimate chip and pin unit - it is difficult for the consumer to verify the trustworthiness of an unfamiliar chip and pin unit - in the UK, people often still try to walk away with my card, just as when we had magnetic stripe - transactions can be conducted offline in most configurations (true for example in the UK, but not in Germany) IMO the main selling point of Chip and PIN to UK retail banks is that they allow banks to reassign liability to for fraud to the customer. When your signature is forged, existing law clearly says you are not liable. When you PIN is discovered and used to send transactions, existing law is unclear and currently this allows banks to convince the customer to accept the liability. IIRC, American consumer fraud law is pretty strict, which is why the US has been slower to adopt the machines than eg the UK. In the UK, Chip and PIN seemed to cut fraud for a while, until attacks like skimming were applied. Now fraud is back on the rise :( There is good coverage of this in chapter 10 of Security Engineering 2nd edition by Ross Anderson, a book I highly recommend!
- Nursie 12y ago
  >> - the chips used (32kb 90s-style smartcards AIUI) are simple to read and save, making chip and pin readers susceptible to the same social engineering attacks as magnetic stripe cards (btw, in the UK there have been skimmers for chip and pin for some time) Erm, while it is simple to read public data off a smart card, you can't get at the private keys etc, this is pretty secure. I work in this area and while I am aware of a couple of weaknesses in the scheme (Static Data Authentication is a big one, but only affects some cards), I am not aware that even a PoC 'skimmer' exists. AFAIK (and as I said, I work in this industry) the only key-recovery attack so far involved an electron microscope. >> - most terminals on the market transmit the pin in the clear from one part of the unit to the other, so it is trivial to doctor a legitimate chip and pin unit This depends on the card, not the terminal. All parts of the system in a terminal must be secure, we have stringent standards to stop tampering. >> it is difficult for the consumer to verify the trustworthiness of an unfamiliar chip and pin unit This is true. A fake unit could me made pretty trivially. >> in the UK, people often still try to walk away with my card, just as when we had magnetic stripe This is less of a concern. >> IMO the main selling point of Chip and PIN to UK retail banks is that they allow banks to reassign liability to for fraud to the customer. When your signature is forged, existing law clearly says you are not liable. When you PIN is discovered and used to send transactions, existing law is unclear and currently this allows banks to convince the customer to accept the liability. 100% false. The liability transfer was to the merchant, not the customer. >> In the UK, Chip and PIN seemed to cut fraud for a while, until attacks like skimming were applied. Now fraud is back on the rise :( Please provide sources for EMV skimming attacks, I'd love to read about them.
cheald 12y ago
Chip & Pin has the fatal flaw of asking me to trust unverified hardware. I know that my phone is trustworthy. I don't know that your POS terminal is. It definitely eliminates a lot of the issues present in the current magstripe setup, but what I want is something that requires access to a black box I trust. As long as I'm handing credentials to an untrusted computer that I have to trust to behave honestly, the problem isn't solved.

sliverstorm 12y ago

I've been pestering my credit card companies for years now, asking for chip-and-pin. It's the best I can think of to do.

calpaterson 12y ago

Sadly that is not the case. Major problems with chip and pin: - the chips used (32kb 90s-style smartcards AIUI) are simple to read and save, making chip and pin readers susceptible to the same social engineering attacks as magnetic stripe cards (btw, in the UK there have been skimmers for chip and pin for some time) - most terminals on the market transmit the pin in the clear from one part of the unit to the other, so it is trivial to doctor a legitimate chip and pin unit - it is difficult for the consumer to verify the trustworthiness of an unfamiliar chip and pin unit - in the UK, people often still try to walk away with my card, just as when we had magnetic stripe - transactions can be conducted offline in most configurations (true for example in the UK, but not in Germany) IMO the main selling point of Chip and PIN to UK retail banks is that they allow banks to reassign liability to for fraud to the customer. When your signature is forged, existing law clearly says you are not liable. When you PIN is discovered and used to send transactions, existing law is unclear and currently this allows banks to convince the customer to accept the liability. IIRC, American consumer fraud law is pretty strict, which is why the US has been slower to adopt the machines than eg the UK. In the UK, Chip and PIN seemed to cut fraud for a while, until attacks like skimming were applied. Now fraud is back on the rise :( There is good coverage of this in chapter 10 of Security Engineering 2nd edition by Ross Anderson, a book I highly recommend!

Nursie 12y ago
>> - the chips used (32kb 90s-style smartcards AIUI) are simple to read and save, making chip and pin readers susceptible to the same social engineering attacks as magnetic stripe cards (btw, in the UK there have been skimmers for chip and pin for some time) Erm, while it is simple to read public data off a smart card, you can't get at the private keys etc, this is pretty secure. I work in this area and while I am aware of a couple of weaknesses in the scheme (Static Data Authentication is a big one, but only affects some cards), I am not aware that even a PoC 'skimmer' exists. AFAIK (and as I said, I work in this industry) the only key-recovery attack so far involved an electron microscope. >> - most terminals on the market transmit the pin in the clear from one part of the unit to the other, so it is trivial to doctor a legitimate chip and pin unit This depends on the card, not the terminal. All parts of the system in a terminal must be secure, we have stringent standards to stop tampering. >> it is difficult for the consumer to verify the trustworthiness of an unfamiliar chip and pin unit This is true. A fake unit could me made pretty trivially. >> in the UK, people often still try to walk away with my card, just as when we had magnetic stripe This is less of a concern. >> IMO the main selling point of Chip and PIN to UK retail banks is that they allow banks to reassign liability to for fraud to the customer. When your signature is forged, existing law clearly says you are not liable. When you PIN is discovered and used to send transactions, existing law is unclear and currently this allows banks to convince the customer to accept the liability. 100% false. The liability transfer was to the merchant, not the customer. >> In the UK, Chip and PIN seemed to cut fraud for a while, until attacks like skimming were applied. Now fraud is back on the rise :( Please provide sources for EMV skimming attacks, I'd love to read about them.

cheald 12y ago

Chip & Pin has the fatal flaw of asking me to trust unverified hardware. I know that my phone is trustworthy. I don't know that your POS terminal is. It definitely eliminates a lot of the issues present in the current magstripe setup, but what I want is something that requires access to a black box I trust. As long as I'm handing credentials to an untrusted computer that I have to trust to behave honestly, the problem isn't solved.