3 ms·
Love the EMV plug, as if it'd actually have helped. EMV transmits the card information in the clear, it only makes physical copying of the cards harder (Which r
by jdong 12y ago
Love the EMV plug, as if it'd actually have helped. EMV transmits the card information in the clear, it only makes physical copying of the cards harder (Which really doesn't matter since credit cards can be used online).
The only thing EMV would achieve is making this data slightly less valuable, but still worth it for the attacker. Replacing the EMV cards would also be more expensive by an order of magnitude.
tl;dr: if you use your EMV card on a compromised POS, you'll be as fucked as you'd be with a magstripe card. Your bank will be ten times as fucked.
- kalleboo 12y ago> Which really doesn't matter since credit cards can be used online Don't you need the printed CVV for that? Which isn't stored on either the magstripe nor the chip. edit: 3DSecure would also help if banks cared to push it harder (for instance my bank now disallows all online debit card charges that don't use 3DSecure)
- jdong 12y agoNo, you really don't need the printed CVV for that. And several cards have actually had the CVV on the chip. Also, in many cases the chips actually contain enough information to replicate the magnetic stripe. (Which is well, bad.)
- heywire 12y agoEMV tag 57 [1] generally contains the "Track 2 Equivalent Data", and 5A the account number (PAN) [2] [1] http://www.emvlab.org/emvtags/show/t57/ http://www.emvlab.org/emvtags/show/t57/ [2] http://www.emvlab.org/emvtags/show/t5a/ http://www.emvlab.org/emvtags/show/t5a/
- JimmaDaRustla 12y agoThat's not the same CVV. Edit: Even having the track 2 data won't do you any good in reproducing an EMV card. The only way reproducing a mag stripe EMV card is useful, is if it is used at a non-EMV terminal and mag stripe is the only option. I believe Europe has complete banished mag stripe now.
- JimmaDaRustla 12y agoCVV2/CVC2 (visa/mastercard) generation on the back of the card is COMPLETELY different than the CVV on the chip. http://en.wikipedia.org/wiki/Card_security_code http://en.wikipedia.org/wiki/Card_security_code Skip down to Types of Codes
- JimmaDaRustla 12y agoYes, you need the CVV printed on the back of the credit card to make an online purchase. And the CVV on the back, is different than the CVV stored on the magstripe/chip.
- amckenna 12y agoI think you are forgetting that EMV cards introduce the concept of digitally signing a transaction. That signature is then checked by the payment card processor and if it matches then the charge goes through. The signatures are performed by the chip on the card using a non-exportable certificate. This provides the "proof of presence" for the card and makes duplicating the EMV portion virtually impossible. This doesn't stop the other portions of the card from being stolen, but if merchants force EMV only transactions, stolen credentials cannot be used. It's a step in the right direction.
- jdong 12y agoIt's a step in the right direction, but the current implementations of EMV cards wouldn't have been of any help here.
- JimmaDaRustla 12y agoEMV terminal certification must meet certain PCI standards for one thing. Not sure it would apply in this scenario, it does mention canadian cards affected, but I'm not sure if that's because it was on american machines. Secondly, if EMV was adopted in the USA, the stolen information would become useless because they wouldn't be able to use the data to produce fraudulent cards.
- deleted 12y ago[deleted]
- JimmaDaRustla 12y agoEMV isn't about securing information, it's about customer/card validation - validating that the person using the card is who they say they are. Therefore you are secure from fraud - as you said, cards are hard to reproduce. You still need the CVV code to use the card number in a card not present transaction. So not to your point, it is rather secure... EMV would have helped immensely here, especially considering EMV compliant machines are held to PCI standards as well.