Slashdot Mirror
Will 'Chip and Pin' Credit Card Technology Really Increase Security? (Video)
The answer seems to be: sort of, a little, but not a whole lot, according to Jerry Irvine, who is a member of the U.S. Chamber of Commerce Cybersecurity Leadership Council and CIO of Chicago-based Prescient Solutions. More security theater? It sounds that way when Jerry starts reeling off the kinds of attacks the new cards will do nothing to prevent. Even so, October 1 is the date after which merchants are supposed to be liable for fraudulent purchases made with old-style cards, and are supposed to have point of sale terminals that accept "chip and PIN" cards.
date after which merchants are supposed to be liable for fraudulent purchases made with old-style cards, and are supposed to have point of sale terminals that accept "chip and PIN" cards.
It's the date after which merchants are supposed to be liable for fraudulent purchase made with New-style chip and PIN cards which are made as signature transactions (e.g. with an old terminal).
Their idea is: The bank will be liable for a fraudulent charge if the original bank/card doesn't support Chip and Pin but the merchant does, AND the Merchant will be liable if the Bank's issued card supports chip and pin, but the merchant doesn't support the feature.
...that's not the system we're getting in the US, at least for the time being and at most retailers. We're getting Chip and Signature, which is much less secure. We're just calling it Chip and PIN, but most retailers aren't actually using PIN numbers to complete transactions...
Good luck with that. No major retailer is going to stick with swipe cards only for any length of time, because they are now liable for any fraudulent transactions on swipe cards, rather than the credit card companies bearing the liability.
Yep. I literally got my first Chip and PIN card within the last three weeks, and that's only for my credit card. My Chip and PIN debit card isn't here still, and is promised some time in the next month or two. And that's the first opportunity I've had to get either.
How does this work for online retailers? How do I get my own time pin out of the card? Does this mean you can't save a credit card anymore?
I've had most of my cards replacements come with a chip, but I've certainly not been offered or required to do any type of PIN number for it...I just call and activate it on the phone the usual way.
I think it is only Europe mostly that does the PIN part too?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
It does increase security a little bit. Don't forget: What really protects you, the consumer, is that fact that you're almost never responsible for fraudulent charges on your card unless you were grossly negligent.
The credit card companies don't want to (and cannot) completely prevent fraud. All they need is something to keep it at a manageable level so their high profits remain high. And chip-and-PIN is a little better than mag-stripe.
Walmart is doing it here as of the last few weeks, as well as Dollar General.
The supermarket that I shop at (BI-LO) was doing it two weeks ago but I'm guessing someone complained because the machines weren't asking you to insert chipped cards anymore as of a few days ago.
Personally I don't find the process THAT bad, but until everyone gets used to it it certainly does slow the line down.
"People who think they know everything are very annoying to those of us who do."-Mark Twain
Despite the physical similarity to the European chip&pin system, the US one is different. It's basically the same thing as a magstripe, but different form factor. It's security through obsurity, in that the fraudsters haven't figured it out yet and the equipment to skim and clone a chip card is not yet common. It's a jump ahead in the race, but does nothing to stop the race.
These Chip and Pin cards are called "EMV" cards.
For those who are curious about what's inside those chips, check out Cardpeek, an open-source tool to read the contents of smart cards.
http://pannetrat.com/Cardpeek/
Lots of stuff in there.
The problem is that there are six million merchants out there with mag stripe readers, and nobody can force them all to change to EMV overnight. It took Europe four years to get even to 90% adoption rates. Until such time as most all retailers take them, the crappy mag stripes are required for backward compatibility. And if we say "this does nothing", that's wrong. It takes us one step further down a path we need to fully traverse.
John
Fun fact the signature is not checked by anyone and it does not have to match as most of the pos card readers are worn and do not correctly record the signature.
Minimum threshold fixed. Thanks!
Chip-and-PIN is not a new idea! We've had it for over a decade in Britain and we weren't the first to implement it! One of the reasons the banks pushed it here was because other countries that have tried it saw substantial reductions in fraud!
It works!
Punching in a four digit PIN is slowing things down?
I weep for humanity.
Faster! Faster! Faster would be better!
US chip cards are set to "prefer signature". Many of them don't have PINs at all.
It's less secure, but likely it doesn't matter. Part of chip and PIN was designed to blame the customer for all in-person fraudulent charges on the idea that if your PIN was entered, you must have been there (and not just your card). This does not pass muster with US consumer protection laws, so there isn't a lot of reason to go to chip and PIN in the US.
Not that chip and PIN wouldn't work, I think the retailers just saw it as too much hassle to make all merchants put in card readers which face the customer instead of the employees.
Chip and sign cards cannot be cloned. That's what adds the most protection anyway. Especially since much stolen credit card info from around the world has been used in the US since you could make a cloned stripe card from account info for chip and PIN cards and then use it in the US.
http://lkml.org/lkml/2005/8/20/95
Outside of the US, everyone already has it.
It's also used in Canada... it acts as a replacement for signature on CC purchases that take chip and pin.
File under 'M' for 'Manic ranting'
No, you got a card with a chip.
There's no PIN.
It's chip + sign in the US for the foreseeable future.
Studies in europe showed that when chip and pin nearly eliminated point-of-sale (in store) fraud, that within a year or so the fraud moved to card-not-present sales (that is, the fraud occured by european cards used on the internet, phone, and also countries where the Pin network was not integrated back to europes clearinghouses like brazil, the US, and off-the-grid stores). The total amount of fraud was roughly the same as it had been (one can argue about details or if it's less than it would have been).
For in-store (card present) sales, It isn't lost cards that are the biggest problem. It's stolen card numbers being either cloned onto forged plastic. Stolen card numbers are easily transmitted faster and also can be replicated many times, which is better than the original card itself. Just having the chip there can shut this down. You don't have to have the pin. thus card+signature is just as good as chip and pin for practical purposes. The pin just shuts down people using the original stolen card which is a small slice of the problem.
So no this isn't going to do much about fraud since card-not-present is actually goging to become the dominant mode of sales (internet). But the pin doesn't help much.
Some drink at the fountain of knowledge. Others just gargle.
Merchants are on the hook when a fraudulent purchase is made, with a NEW style card, but the merchant hasn't updated to a new style reader. Issuers are on the hook when a fraudulent purchase is made with an OLD style card.
(If at first you don't succeed, do it different next time!)
When I write anything recognizable at all, I put "Zaphod B". No one even looks at it.
Faster! Faster! Faster would be better!
This. Every time I sign my name it looks different anyway. I've never developed a "signature" I just scrawl out a vague cursive representation of my name. Works every time.
It hasn't stopped my boss from cracking the whip the last three months to get us to get EMV implemented.
Secession is the right of all sentient beings.
They're only liable for magstripe transactions on cards that have a chip.
Magstripe-only cards still work the same way they always did, legally and functionally.
So basically his local Home Depot is just being a panicky bunch of dicks.
So following up my own post, notice that paypal and apple pay both have the means to verify the user of the transaction for card-not-present transactions. Other card methods like say samsung-pay are just wrappers around the card right now and emulate the old swipe system. Thus samsung pay is actually obsolete before it even happened. Chip and Pin now forces you to carry your credit card not just the credit card number. Thus you will already have the credit card in your wallet making samsung pay replace exactly nothing you would have carried anyhow. Apple pay and pay-pal don't have that problem because they can conduct secure transactions through the stores payment mechanism.
Some drink at the fountain of knowledge. Others just gargle.
I've asked dozens of stores in the last couple of months if I can use the chip reader, and they all say that they haven't enabled them (and some have said they don't have plans to enable them) because of problems with the activation of the chip readers. Two 7-Elevens told me that they had problems with double-charges, a big-box store (I don't remember which) said the cards didn't read properly all the time in tests, and several others have said as recently as last week that the required software hadn't been loaded yet because corporate was still testing upgrades. Many restaurants and stores don't even have chip readers yet.
If these are even partially accurate, then despite the long lead time, I suspect this is going to be a massive fiasco. Home Depot is the one place that I've been able to use the chip reader (and that was in July, IIRC) and it went flawlessly for the one or two transactions, but that's not to say that all of the tens of millions of other upgrades are going to work as well. I'm hoping the confusion dies down quickly, but I'm not counting on it.
You can never go home again... but I guess you can shop there.
Despite the physical similarity to the European chip&pin system, the US one is different. It's basically the same thing as a magstripe, but different form factor. It's security through obsurity, in that the fraudsters haven't figured it out yet and the equipment to skim and clone a chip card is not yet common. It's a jump ahead in the race, but does nothing to stop the race.
Not exactly. The new US cards use a one time token for the transaction like other PIN and chip cards, but MC/Visa have not required issuers to force PINs. So no 2-factor but still much safer for physical transactions than magstripe, provided you don't lose the card itself. Doesn't do shit if the card itself is stolen or for online transactions though.
I browse on +1 so AC's need not respond, I won't see it.
The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Samsung Pay still provides a virtual card number, so there's some benefit to it. And it can be used now, unlike Apple/Android Pay (which may very well never have anywhere near 100% acceptance if most retailers choose to keep NFC support on their brand new terminals turned off).
US businesses that currently accept chip and PIN/signature
It depends on one's bank. Most are going with chip and signature, but some (Barclay's comes to mind, and some banks that cater heavily to international travelers) are issuing chip and PIN cards.
You can never go home again... but I guess you can shop there.
I don't think the low level cashiers, etc. at major retailers really know much other than any training materials they received from corporate. But it is looking like a lot fewer than everyone thought will be ready in time.
US businesses that currently accept chip and PIN/signature
The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.
Not only that, if I put my card in the chip reader rather than just swiping it, seems to take 10 seconds longer. Or twenty seconds, or thirty.... I think in many cases convenience will trump security.
Samsung Pay still provides a virtual card number, so there's some benefit to it. And it can be used now, unlike Apple/Android Pay (which may very well never have anywhere near 100% acceptance if most retailers choose to keep NFC support on their brand new terminals turned off).
Why would they turn it off?
Some drink at the fountain of knowledge. Others just gargle.
US chipped (credit) cards generally don't have a PIN, or it's prioritized so low that it's never going to be used domestically. OP is likely referring to having to keep the card in the slot for multiple seconds vs. being able to put it away immediately after swiping.
US businesses that currently accept chip and PIN/signature
Walmart's been doing it for a while, actually. Close to a year at this point.
Re: Dollar General--I'll see if I can confirm whether any other of their stores have support turned on (none in my area) and if so, add them to the site in my signature. Do you know if they have NFC turned on as well?
US businesses that currently accept chip and PIN/signature
The data on the chip is a signed certificate; but its not encrypted. So if you can do a bit for bit copy of the data to a new chip, viola the card is cloned and useable. IF the data was encrypted and required a pin to unlock, THEN you would have a little security because even if you clone the data, you don't have the key to unlock it to allow the transaction. HOWEVER the spec doesn't allow for that, the spec is basically half of Private Key cryptography.
Debit cards will ask for a PIN but only at places that have already accepted debit. And it's still optional, just like magstripe. Too bad I don't see that changing any time soon; might as well just never ask for a PIN on debit as well except for cash back if it's not going to be made mandatory.
US businesses that currently accept chip and PIN/signature
his bank has already sent him a new card with a chip in july, august, or september
if he didn't activate the new card, some time in october he'll go to lowe's, try to use his old card, and his transaction will be declined
he'll call the bank and raise hell and they'll say "sir, we sent you a new card and you did not activate it"
he won't be able to use magstripe-only for very long because all major banks have replaced them or are replacing them
he may have a card with some oddball institution that continues with magstripe only. that institution will be pressured by continuing changes in technology and standards, or they will raise their eyebrows at the fraud they have to cover, then they will go to chips too
and this is all a good thing, increased security
is there some valid reason why top comment doesn't want the chip?
or is it "receiving the mark of the beast" level low intelligence paranoid mental vomit?
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
It's basically the same thing as a magstripe
Other than the unique one time code that's generated for every chip transaction, of course. And the extreme difficulty of retrieving the private encryption keys needed to generate those codes from the chip itself.
US businesses that currently accept chip and PIN/signature
CVS told me they have to do it for HIPAA reasons in their pharmacy.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
It's a rationalization made by some in the media. While it might have a bit of basis in fact, the real reason is that banks don't really consider PIN a worthwhile investment of time or money.
US businesses that currently accept chip and PIN/signature
interesting. News reports said CVS and Walmart didn't do it because they are launching a competitor.
Some drink at the fountain of knowledge. Others just gargle.
It's because we have the best banking system money can buy (aka the banks want to spend as little money as possible). That's why PIN's not being bothered with, even though retailers basically have to buy terminals that support it anyway.
US businesses that currently accept chip and PIN/signature
A large number of US retailers actually rely on non-consensual tracking/data mining as part of their business models. NFC would really interfere with that. Not to mention there are a few (like Walmart) who really hate Visa/MC and at best want all of the benefits card acceptance brings without paying anything.
US businesses that currently accept chip and PIN/signature
Yep, CurrentC. Which is basically a usability and security/privacy disaster. It'll probably fail (and some retailers such as Best Buy already have abandoned it), but there will still be holdouts.
US businesses that currently accept chip and PIN/signature
.. so, if there are some disputed charges on your account, the bank can either 1) chase the retailer to get the lost money back - assuming the retailer has not given you the opportunity to use Chip and PIN or 2) chase you, since clearly if there is a transaction on your account, and your card is a Chip and PIN card, either you have given someone your card and PIN (in which case it's your fault) or someone has stolen your card, and found out your PIN (in which case you failed to keep it secure, and bugger me, it's YOUR FAULT again).
I was a victim of an early fraud about five years ago, at a coffee shop at Paddington Station. I bought a coffee using my chip and pin from my business account (well, there were lots of us having coffee, and I decided for once it was a business expense). A few days later, I noticed some charges on my account I couldn't identify, and I contacted the bank. Their immediate reaction was that I must have let someone have my PIN. It took six weeks to have the money returned to me by the bank - and then only when they could displace the blame on to the retailer (apparently I wasn't alone, and an investigation by the police turned up a hacked card reader which stored PINs on an SD card).
Canadian here:
We have not had Chip and Pin for too long, just about a decade I think. Along with Chip and Pin came the contact-less system that was limited to a certain amount of dollars per transaction. Of course that is some form of security, the contact-less (or 'tap') method is also used with gift cards, but up until a year or two ago most of the readers and in fact the chips on the cards themselves would be faulty after some use.
I know my first chip and pin card did not work with contact-less, but then when it did it only worked for about a year until it stopped (not sure if it was the chip or the reader), now with a new card its working again, but I know if you have an older reader you most likely have to go back to the chip and pin method.
I went to the states for skiing last winter and found it interesting that I hesitated when the waiter/ess asked for the credit card to bring it to the machine and swipe it. It has been so long since the vendor has had to take my credit card away from my sitelines that it just felt differently, even though I was used to it in Canada up until the mid 2000's.
It certainly won't eliminate the swipe cards for a long, long time. They've had chip and pin in Europe for a decade, and you can still swipe.
Expect that to change.
Swipe readers have been absent in Europe on unsupervised machines (e.g. buying a train ticket) for years, and aren't available at some smaller shops — unless they expect American trade, it's not useful. Even if it does exist, the cashier would often be reluctant to use it.
The way the system should work is every user's card should have a number pad on it where they enter there pin. It should display the merchant's name, an amount of the transaction, and a transaction ID (ie the receipt). The card should then encrypt a message with GPG that is then transmitted to the card holders bank authorizing the bank to release the funds to the merchant.
...and that's how it works with lots of European banks' e-banking interface:
a completely offline device (either chip-card in a small calculator-like device, or card with keypad directly on them) are used to sign transaction (or simply the numbers they display. But you get to see the numbers).
European banks do it because:
- it's really the best possible security at this level of conveniance, thus less risk for their customer and thus less possible liabilities for the banks themselves.
- it's their own e-banking infrastructure, they get to do what pleases them (see point above for what pleases them).
That would be completely different with credit card payment:
- because the bank themselves don't get to decide. Instead they have to abide to whatever Visa and MasterCard imposes on them, and Visa and MasterCard are interested in a different point of balance on the security vs. conveniance scale (they need the credit card usage to be as easy as possible because they need as much transaction as possible to happen, which makes more money flow, which gives them more earnings from the percentages)
What some european banks have introduced is complete out-of-bound confirmation of transaction:
you get an SMS asking you to confirm the transaction that you do with the credit card. Even if the terminal is rigged/bugged, the SMS will show you that that the transaction amount isn't what its supposed to be.
Currently, that's not very convenient (slows down the procedure a lot), it's not very secure (all it takes is a rigged/bugged picocell spoofing the SMS), but at least it helps discover and intercept fraud much faster (wait, why am I receiving a confirmation SMS when I'm just sitting at work ?!?) and is a first baby step in the right direction (the user should rely on an external non-trusty device for displaying info about the transaction and asking PIN to sign the transaction).
-----
Sadly, for the sake of convenience, some of these separate e-banking authentication are replaced... by smartphone apps.
Yup. Software running on *always online* devices that can be hacked.
All this because the user have already a phone in the pocket, and because the smartphone has a camera which is convenient for reading data from QR codes.
-----
For the record: Bitcoin protocole also relies on the user signing a transaction that they see on their side.
Except that instead of getting checked by on single authority (that might have some sort of privacy policy), the check is distributed and each transaction is publicly broadcast for the whole network to store it in its distributed ledger (no true anonymity trades for no single point of failure).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
they will give you a new card soon or you missed it in the mail (which should concern you). check with your bank
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The specs not only allow but require that merchants still be able to process mag strip only cards. If your card doesn't have a chip, they'll still accept it.
Only 70% of credit cards (and 25% of debit cards) in the US will be chip cards by the end of this year. Banks do not like losing money. It'll be a decade or more before mag strips are no longer usable.
The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing.
The chip & PIN system uses PKI and only communicates with the payment transaction system when the authorized user provides the PIN. Sure, you could have a rogue retailer push transactions in excess of what the buyer thought he was paying, but that will be caught and prosecuted swiftly.
The US system has no real authentication of the card user since (a) no one checks the signature to begin with, (b) most users leave an unintelligible scrawl, and (c) no retailer has a full-time handwriting expert on staff.
We finally had a good push to revamp the payment card infrastructure, and they totally blew it.
Not only that, if I put my card in the chip reader rather than just swiping it, seems to take 10 seconds longer. Or twenty seconds, or thirty.... I think in many cases convenience will trump security.
Problem is that the readers which support the chip will also detect that the card has a chip and force it to use the chip. Ran into that already; the mag stripe won't work with them - it's chip only. Or at least, retailers can configure it that way, which I'm pretty sure they'd be required to do under the mentioned requirements by MC/Visa/AMEX
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
You've clearly never worked in retail. There are rules. If the merchant follows the rules, they are protected, and either the merchant service or the issuing bank eats the loss.
(Online companies, mail order companies, and other "card no present" merchants cannot follow the rules, so, yeah, they're hosed.)
EMV means the rules are changing, and they're more complicated, but if the car has no chip, the old rules still apply, and the merchant is protected if they follow the rules.
his bank has already sent him a new card with a chip in july, august, or september
Of my 5 cards (2 business, 3 personal), only 2 (1 business, 1 personal) have chips in them. one is chip+pin, and the other is chip+signature.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Most Brick and Mortar Merchants are already liable for the vast majority of fraudulent transactions. Chargebacks for identity fraud (ie, a stolen credit card) currently hit the merchant, not the issuing bank.
That liability will shift temporarily to the bank, IF the merchant has the new technology, AND the bank does not. Once both have the tech, the liability falls back on the merchant, because anybody with a stolen card, has also stolen the chip.
This is primarily a stick for the banks, since they will have to eat a larger percentage of chargebacks until they issue new cards. There is very little carrot for merchants. The best incentive is for early adopters to defray some of their equipment costs, as the money drops off very quickly, as banks issue new cards.
In six months to a years time, there is going to be almost zero incentive for any merchant to buy new chip & sig equipment, until it becomes part of PCI rules. The US implementation is ridiculously stupid without the pin, and this entire transition will prevent exactly one type of fraud- when organized crime manufactures fake cards with real numbers. The more common types of fraud (stolen physical cards & stolen card numbers used online) will not be impacted one bit, and merchants will continue to eat the costs.
No more a disaster than the last few years have been. Very few POS software vendors are actually ready, and at least some have delayed releasing EMV packages because of it. They'd be fools to release software that isn't ready just as the holiday shopping season starts, and the retailers would be fools to accept it.
So things continue the way they have, with the liability for that 1/10th of 1% of transactions that are fraudulent (or, more likely, half that, unless you sell consumer electronics) shifting, in some cases, to the merchant instead of the banks.
Contactless has been widespread in London for about three years, and very common in the last 18 months (since it became possible to pay for buses and the tube with it).
It's only for transactions under £20 (and transport), and if you do too many in a row you need to enter a PIN.
Different banks are taking different approaches, with some proactively sending out new cards, most at minimum accepting a request for a new card with a chip, and some waiting until cards expire before sending out new chip cards. Stores like Home Depot will continue to accept your valid magnetic stripe card; the only time they'll decline the swipe is if you swipe a chip card, it will prompt you to insert the card into the chip reader.
End of Line.
Australia no longer accepts signatures at all. August last year it became chip & pin only
For online purchased why doesn't the bank issue two factor codes like I use to log into AWS?
Given Australia is 100% chip & pin with signatures not accepted since august last year I would hope the system manufacturers have the bugs ironed out.
the rest will probably be coming soon
the changeover is industry wide
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
They didn't even have a wireless terminal that you could swipe a card with? What a backward country. I'm surprised they didn't have a racking machine lying around...
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
Actually, Barclay's cards are still Chip and Signature, in that they are programmed to prefer the signature and will only prompt you for a PIN if the location is unable to accept a signature (like a European train ticket kiosk). But that's still better than some issuers (like Chase and Capital One), which don't support PIN at all (other than for cash advances like they always have).
There are a couple credit unions at least that are issuing PIN-peferring cards.
End of Line.
While the USA are getting on board with Chip and Pin, the rest of the world has already moved on to NFC.
I don't recall the last time I used a magnetic strip.
There was a petrol station near me that did exactly the same. Bonus was it was the cheapest in the area so loads of people used it...
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
My bank still covers me for fraud, no matter how it's done.
The difference here is the liability of the merchants, not the users of the card. If a merchant accepts a fraudulent mag strip payment, they're liable. If they accept a chip-and-pin fraudulent payment, they are not liable, the bank/issuer is.
The data on the chip is a signed certificate; but its not encrypted.
Most certificates aren't encrypted.
IF the data was encrypted and required a pin to unlock, THEN you would have a little security because even if you clone the data, you don't have the key to unlock it to allow the transaction. HOWEVER the spec doesn't allow for that, the spec is basically half of Private Key cryptography.
That wouldn't be private key cryptography, that would be shared secret cryptography.
In EMV theres a couple of modes, modern cards use what is called DDA. in DDA the card provides the unencrypted public certificate to the terminal, the terminal then provides 'random' data (and this is where the few attacks on emv happen if the terminal is broken and provides not truly random data). The emv chip in the card then uses its own internal private key to sign that random data and returns the signed random data. The terminal then uses the cards certificate it received earlier to validate the signature, then forwards the information on to the processing company. at no time does the private key ever leave the chip and touch the terminal.
Now some earlier chips did do SDA where it just had a pre-signed set of data on the card, that has not been the use case in EMV for about 5 years now. I just checked every card in my wallet and all of them in fact do use DDA.
The whole point of the chip is that you can't skim it (e.g. you can't simply read the information and make a fake card that outputs the same info).
Sure there is no law of physics that says you can't copy the chip in theory, compared to magnetic stripes which are designed to be read to even work, their is currently no easy way to copy a computer chip.
Comparing the security of a magnetic stripe to a smart chip is like comparing the security of a paper document folded in half to an encrypted digital file. Sure there is no guarantee that the encryption can't be broken at some point in the future, but it is almost incalculably more secure than hoping no one unfolds the document and reads it.
Contactless in Aus is limited at $100 or about 50GBP. You are insured for any contactless transactions for 48hrs if you lose your card.
In Australia, most transactions now are contactless (NFC) chip transactions, with PIN only required when the merchant hits a (merchant dependant) limit. With our without the PIN, it's faster than swipe plus signature. Without the PIN it's faster than cash. The US is basically a nation of paranoid luddites looking for an excuse not to move on.
Until there is a way to feasibly copy the data on the chip, encryption doesn't really buy you anything. I think we should probably still do it, as it's probably not that expensive (we already know how to do it).
I'm just saying that this alone is pretty secure especially compared to magnetic strips.
how far behind
Miles behind. Wait while I convert that to kilometers.
Have gnu, will travel.
The US chips will be cracked in a matter of a months, maybe a more, and we gain almost nothing
1000 years is still 12000 months, so your claim is basically unfalsifiable
Which is why the US banking system, in its infinite wisdom, went for chip and signature, which is worthless as a security measure. The one advantage of the system is that when we go to Europe, our credit cards will at least work in European machines, rather than eliciting hapless giggles.
For NFC ("contactless") payments to be secure, some reviled company would have to come up with a scheme whereby your credit cards would be tokenized into a device which, when used for NFC transactions, would transmit a single-use virtual card number that changed with every transaction. But such a scheme would not be acceptable to the twitterariat unless it were open source and crammed with malware.
Our local credit union hasn't sent us new cards yet. As far as buying at Lowes, I'll go to the register, have them ring me up, and then I'll say, "I'll be right back. I'm going to the cash machine at Grow Financial across the parking lot."
Whatever they send us may still take a PIN; we use debit cards, not credit cards, for our day-to-day shopping.
- Rob
Better than magstrip and signature.
When I worked in retail 15 years ago I had someone pay with a credit card, and while checking the signature, which matched perfectly, I saw the card number on the receipt didn't match the card. I only paid attention because they were suspiciously easy to up-sell to.
They had written someone else's magstrip data on to their own card.
All you need to do is buy a $100 device from ebay, sneakily swipe customer cards while you're working your low paying gas station job and write the data to your own card.
You can then go on a spending spree, writing a new stolen card number for every purchase so the automated fraud detection algorithms don't catch you and block the stolen card.
You can't do that with a chip card, since you can't clone the card.
It's even harder with NFC, since the customer never lets go of their card.
You could buy a new set of strings for your viola!!
Australia no longer accepts signatures at all. August last year it became chip & pin only
Untrue. I was there in March of this year, and made north of 35 signature transactions up and down the entire east coast on at least two different cards. For cards without chips, Visa tells you specifically that all merchants that accept their cards are REQUIRED to accept signatures. Their travel department goes as far as to tell you that if you are refused a transaction because a merchant refuses to accept a signature as verification, to call Visa collect from the store and they will straighten things out for you.
I imagine that policy will now change starting tomorrow, but until that point - including early this year - they accepted signatures.
I've had a chipped card (issued by a US bank) for years now. But I've never seen a reader in the USA capable of using it. Some years ago, I was preparing for a trip to Europe and I figured I'd better get the PIN part of the card activated. One more interesting fact: This card was issued to me by a bank that I don not have an account with. Credit is the only business I do through them. So I call the service number and ask about the PIN. According to them, in order to have a PIN, I'd have to 'attach' the card to a bank account, effectively making it a debit card.
Other accounts I have also seem to be pushing their debit card products. The problem (as I understand it) with debit cards is that the liability for fraud falls harder on the consumer. Charge my credit card fraudulently and laws protect me and minimize my losses. Charge my debit card and someone can empty my bank account. And it's my problem.
So, whatever happens tomorrow, I'm going to watch my card agreement information very carefully. To make sure that my credit card doesn't magically turn into a debit card.
Have gnu, will travel.
...It's basically the same thing as a magstripe, but different form factor....
I'm 99.9999% sure you are absolutely wrong!
Granted, the chip&signature that the US is adopting is far weaker than the chip+pin used elsewhere (the pin is "something you know" which prevents the card from being used by others, whereas the signature is just a scribble of anything you want and doesn't technically lock/unlock anything).
However, you can swipe a mag stripe and read all the info from it via VERY cheap hardware (for example, a free square reader). Doing so will give you every piece of info that is printed on the front of the card. It's the same info you'd get if you did an old style carbon copy rubbing of the card like gas stations used to use, and that's the same info you'll get off the new chip+sig mag stripes and imprints. The chip isn't there to prevent theft of the physical card.
If, however, you use the chip, then the merchant does not get the actual card number. There's a two way communication from your card, to the terminal, to the bank, and back, all using crypto. You can think of it like an SSL handshake. Once that handshake is complete, the merchant has a one time use token to use for the purchase.
What does this solve? It ensures that the merchant can't log your card number and store it in their insecure database for thieves to later take, ala the Target breach**, because they'll never have that number. More importantly for the banks, it's "proof" that the card was there, and not some cheap copy.
** I think that's what happened at Target, but there have been mixed stories, and I'm not 100% certain... maybe it involved data they got from the web instead, but I doubt that. I'm pretty sure it was card numbers scanned locally.
I'll just avoid the merchants that require it. My local Home Depot has a sign up saying that after tomorrow they will no longer swipe credit cards. Guess I'm going to Lowe's.
What is the logic behind that? Why wouldn't you want to use a more secure way to make payments? What's the drawback?
I don't think the old cards have been used here in Oz for a while now, haven't seen one in years, my own cards have been chip and pin for over a decade. Doesn't matter if you swipe or insert the card, you still require a pin. "Pay wave" is the latest thing, you just wave the card over the reader like an office entry card no pin or signature required, works for purchases up to $100. If you have had a few drinks, don't let the bar staff wave it for you!!!! There is no phone call required to activate the card, it comes in the mail, pin comes separately in the mail on a different day, the card is automatically activated when the old one expires.
If the lights go out businesses can still use the old paper imprint method - at their own risk!
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
Jerry Irvine is wrong on most of the points he makes. Just to correct some of them:
1. The PAN (the primary account number) is not enciphered on a chip card.
2. If you have a chip reader and easily-found software, you can recover the card PAN easily and quickly.
3. Cards do not provide support for "unlimited number of transactions" - as almost all cards have amount and velocity limits.
4. Most transactions will go online to the card issuing bank for authorization - allowing for lost and stolen cards to be blocked.
5. Each purchase with a chip card does not "create a separate token". He appears to be confusing tokenization with cryptography, though it's hard to know exactly what he means.
6. Issuing banks do not create tokens. Instead, they are created by a Token Service Provider, usually an independent third-party.
7. A partial EMV implementation would have mitigated against certain segments of the Target fraud. A full implementation, with PCI, industry-wide, would have mitigated against much more.
8. Mobile payment systems, in general, today, do not provide higher levels of security than chip cards.
Documentation on most of the above is freely available from EMVCo's website at http://www.emvco.com/
Mr Irvine's four minutes are, as a whole, inaccurate and unhelpful.
No - with debit cards you have to punch in the pin anyways (you always have).
The issue is with inserting the card - and then leaving it there. Many people who are used to the "swipe" system put in the card, then pull it back out when it need to stay in the reader the whole time. That starts the process over so that they have to reswipe, reinsert, reenter pin, etc.
"People who think they know everything are very annoying to those of us who do."-Mark Twain
I'm not sure about NFC. I don't have any payment method that supports this so I haven't tested it.
"People who think they know everything are very annoying to those of us who do."-Mark Twain
If you have a card that supports Android or Apple Pay you can add it to that and try tapping with your phone. It's supposed to say on the screen that NFC's accepted if it is but a lot of such places don't for some reason.
US businesses that currently accept chip and PIN/signature
The true purpose of chip cards is to transfer the cost of fraud away from the issuers.
I realize the limited value of anecdotal evidence, especially from cashiers. Some just shrug and say they don't know when they'll work. But when I do get answers, they're remarkably consistent about reported problems.
Aside from Home Depot, none of the stores I've been to in the last couple of months have working chip readers. That includes Sprouts, Tom Thumb, Kroger, 7-Eleven, CVS, or any of the myriad small stores. My wife works in a small retail shop and has asked, and was told that even with the newly-deployed chip readers, they're not likely to be active for several weeks or months yet.
It's not happening as fast as it was supposed to, and that's going to be a problem come tomorrow.
You can never go home again... but I guess you can shop there.
I've lived in Oz for over 50yrs, I had to google the question out of sheer curiosity, turns out you and the GP are both correct, the law only affects cards issued in Australia, I assume yours were issued in the US?
BTW: Hope you enjoyed your visit, Melbourne to Brisbane via the coast is still one of the world's great road trips, I've lost count of the number of times I've done it, first time was 1966 in the back seat of Dad's bright red VW beetle, it's changed quite a bit since then, hell of a lot more people and cars now. For any tourist, Oz is a hell of a long plane trip away, I don't understand (english speaking) tourists who come all the way to Oz and then don't leave the city they landed in??
And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
This still does nothing about internet transactions which are always "signature"; actually, there's not even a real signature involved.
So I steal your card and use it, scribbling a sig if needed.
My bank will reverse the charges provided I report it stolen and the card will stop working at that point. Thats how it works with both mag and chips, no difference there. What does change is you have to actually steal my card, whereas before all you had to do was get ahold of it for a few seconds to scan the mag strip so you could clone it later.
When I worked in retail 15 years ago I had someone pay with a credit card, and while checking the signature, which matched perfectly, I saw the card number on the receipt didn't match the card. I only paid attention because they were suspiciously easy to up-sell to.
So what did you do?
Even though signature is the main problem there (chip or magstripe, signatures are easy to fake and PIN's are not easy to guess) new cards in Australia are not being issued with Magstripes any more. Europe/UK have probably been like this for years.
Actually, NFC is what is making card skimming even easier.
NFC transmits the card number, expiry date and name to any device that asks for it. This is all you need to start making transactions online.
Chip and PIN reduced in store card fraud to nil in Europe, however the fraudsters just switched to making online transactions instead.
Calling someone a "hater" only means you can not rationally rebut their argument.
Up here in Canada, the limit for contactless debit ("Interac flash") is a cumulative of $50 ($100 for gas stations), then it says "Nope. Stick the chip in.".
upon the advice of my lawyer, i have no sig at this time
Way to leave us hanging on the ending of the cool story, bro.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Australia is unsually used as a 'test bed' for new banking tech, as we are small but early adopters of technlogy.
Australia also has a nearfield RFID payment system called paywave.
For transactions under a certain value (normally $50), you can just tap you card on the POS machine. Higher value transactions require a 4 digit PIN.
46137
Thank you guys for this video. I love these videos about banking and other security.
I think in many cases convenience will trump security
If you want convenience, you should check out PayPass or PayWave (one is Visa, the other Mastercard, I forget which). Here in Australia for purchases under $100 you can just tap your card on the payment terminal. No signature, no PIN, no buttons to press. It's also much faster than paying cash and/or getting change. If the purchase is $100 or over, then you tap and punch in your PIN, which is still pretty quick and no messing with cash.
Love paywave (or paypass). Just makes it soooooo convenient.
The other one I miss when I go out of Australia is the "Select your account, Chq, Sav or Credit" all from the one card.
Not true. I used a chip and signature card in Melbourne in March this year.
The security code isn't stored on the card. Can't remember the last time I saw an online payment gateway that didn't ask for that. I would be surprised if that didn't trigger a fraud detection alert at the bank.
Nothing you can't get by looking at the front of the card
Told him I had to go check something out back, got the manager
By the time I got back he had left with nothing, I still had the card.
Not a very exciting ending.
Hey right. The sales point cannot notify security, and film the people in the sales area. Right. To see who is using the card.
Notify security so they can do what? When a card gets reported stolen it just stops processing payments, it doesn't print out something on the terminal telling the cashier to arrest you and as soon as the card gets declined the offender is going to know the jig is up and make himself scarce asap. Filming the sales area is all good and well but the kind of criminals who steal cards go places they can avoid being filmed.
The US went chip & signature instead of chip & PIN, so the entire change is basically meaningless.
How so? With chip and PIN, if your card is stolen, the attacker either has to accurately guess the PIN before the chip self destructs (unlikely, but not impossible), or disassemble the chip to extract the data. It buys you a small amount of time to contact your card issuer, and have your card key deactivated. With just chip, your card is stolen, and can be used immediately, so you potentially have a couple additional transactions that you would not have had were it protected with a PIN.
In either case, the card must be stolen. That's the real purpose. A stolen card with a PIN is only going to buy you a few extra hours. The real protection is that the private key stored on the card cannot be non-destructively accessed. It cannot be skimmed without the owner's knowledge. It cannot be stored by a retailer and compromised. The owner is expected to notice the loss of the card and report it to their issuer, deactivating the key.
In the US, table service restaurants virtually NEVER have customer-facing credit card readers.
Bars don't either.
In both you give them your card.
Really the places that do reliably have them facing customers are retail checkouts and anything with a self-serve kiosk.
http://lkml.org/lkml/2005/8/20/95
Clarification - it is only on Australian issued cards. If you are on foreign cards signatures are still accepted.
Stolen card fraud is something we all pay for. But requiring PINs would require making all CC readers face the customer. That costs money. The CC companies also surely worry people won't remember their PINs and will thus not use their CCs. And then there's that chip and PIN is even slower than chip and sign which is already slower than swipe and sign.
There are a lot of different factors in a lot of different directions. This is the decision they came up with, it hardly seems terrible.
Frankly, given that clearing fees are being jacked so companies can take a bigger cut just to give "cash back" I don't know we'll notice the fraud rate difference between chip and PIN and chip and sign.
http://lkml.org/lkml/2005/8/20/95
Doesn't matter. The purpose of this is to screw over merchants and customers and to try to make banks not liable for the horribly insecure mess that is our electronic payment system.
Any other effects are unimportant.
How so? Go check the European news. Chip and PIN was compromised years ago. The banks have been trying to cover it up and in doing so blaming the victim in fraudulent transaction cases. This provides no benefit to anyone except the banks which will claim infallibility where it doesn't exist just to avoid liability.
Just more bankster fraud at work here.
The default way that NFC "contactless payments work now" is with no security. In Europe, the pickpockets are already carrying around little devices that skim cash from peoples' credit cards as they brush past on the street.
But if some Silicon Valley company known for its cultlike fan base were to tokenize credit cards instead of relying on the card's EMV chip, in a transaction cycle authorized by the user's thumbprint, this would give us a secure NFC that would totally eclipse chip-and-no-PIN EMV.
Chip and PIN was compromised years ago.
Can you cite one instance of chip and pin being compromised?
Heres a tip, that chip and skim paper was about faulty terminals that allowed you to guess the nonce they would provide, the actual chip and pin design itself was and still is secure. Idiot manufacturers just didnt build to the chip and pin spec in their terminals.
The paper
https://www.cl.cam.ac.uk/resea...
The UK has the same. It's now implemented on London underground so you can use your credit card like an Oyster card and it will open the gates. (Apple Pay also works)
Actually Europe is moving to contactless cards (to the level that you are not even offered cards that are not contactless) - which means you don't even have to punch in the pin most of the time. That solves the complaint about "slowing things down". I personally do not trust that as far as I can throw the merchant.
He's referring to ApplePay. Which does not work the same way as contactless.
So if you can do a bit for bit copy of the data to a new chip
That's an awfully big "if". It's very impractical to copy the data; the chip on the card isn't simply some flash memory chip, it contains a microprocessor. And it has memory that's only accessible by that microprocessor. So if you can't read that memory, how are you going to write it to a new chip? Maybe you could remove the chip from its packaging and look at the silicon with an electron microscope, but nobody's going to go through that time and expense to copy a card that has a $5000 credit limit or whatever.
Chip cards have been around for over a decade in Europe. While there have been some attacks on them, none involve cloning the card. (There was a paper describing an attack that has "cloning EMV cards" in the title, but the flaw was actually in the card reader terminals. The card wasn't literally cloned... they just found a way to trick the terminal into thinking another card was the same as the original card).
Sorry, UK guy here. Somebody seems to have a made a repost from the early 2000s...
We're just in the process over here of replacing chip and pin with 'contactless', thus removing the security that the PIN afforded us.
We have that in the US too (e.g., Visa payWave, Mastercard Paypass, Discover Zip. EMV can use either a contact smart card (ISO/IEC 7816) or a contactless smart card (ISO/IEC 14443). They both have chips; the difference is whether the reader communicates with the chip via electrical contacts or via radio waves.
Also, what's happening today is that US banks are changing who has to eat the cost of fraudulent transactions... it's not that the US is just getting EMV cards (or contactless cards) today. They've been around for years... Discover Zip was out in 2011 (however, it still hasn't become popular... probably because there weren't many terminals that could do contactless back then. Now that merchants are being forced by the banks to upgrade their terminals to support EMV, a lot are getting terminals that take both contact and contactless).
That paper outlines how a compromised reader can be used to perform a MITM attack, not that Chip and Pin is broken, regardless of the title of the paper. So we're still waiting...
Buying something with a magstripe normally involves swiping the card in a reader and scrawling a signature onto a screen. Theoretically the cashier might ask for ID or compare the signature to the card but they rarely do. And the cashier might even be cahoots with the thief, knowing the card is stolen and not do any check at all. On top of that the merchant might store transaction details insecurely, or their software may be hacked. And in some scenarios such as bars & restaurants, the card might be taken from the sight of the customer which increases the risk of it being skimmed. All of these are major vulnerabilities that thieves have been known to exploit.
A chip and pin reader means that the card holder must authenticate themselves before proceeding. That stops someone from picking up a card, or cloning one and being able to use it without the pin. And authentication is to the payment processor and not to the store or cashier so it's not possible to bypass this check. It also means the store never captures the credit card info (they only get partial info and some payment authorization code) so hacking the store does not put details at risk. And chip & pin devices are portable so payments in bars & restaurants can be made in the presence of the customer so they are less likely to be swiped.
So yes it closes some very obvious security flaws. Is it perfect? Of course not, but it's a hell of a lot better than a magnetic stripe. It's a damned shame that it's taken the US so long to even switch to chip and pin. The next step would be to get rid of the magnetic stripe altogether but I expect we can look forward to years of lobbying by ATMs and banks how this couldn't possibly be done.
It's amazing that the rest of the world did this transition up to a decade ago, without any issues.
It's excuses for the sake of it. Or using poor software systems instead of proven systems as used elsewhere in the world.
We still get the magstripe on cards in the UK. Presumably so we can still use them when we travel to America.
Chip and signature sounds really odd though - how does the card match the signatures?
Contactless is great in use ... but yeah, if someone nicks your card they can go on a contactless spree until they get the very low frequency pin code confirmation security check.
Referring to something like this? http://www.thisismoney.co.uk/m...
Which is odd, because for Cardholder Not Present, you need to know the card's house number and postcode, as well as the CVV, for the transaction to be approved. That was put in place in the UK about 12 years ago. I know many online retailers only require the CVV once when registering the card (Amazon, Paypal, etc), but you would then also need to access the attackee's amazon account, change the delivery address ...
And for cloned cards, you need to know the pin.
Something isn't right with the story.
Fact is that chip and pin has fraud at around 0.7p per £100, and other methods have about 7.5p per £100. It's far far safer.
Just because someone doesn't understand how it works and rants online doesn't make it a valid resource to link to.
If you write your pin on your card, you are a stupid idiot and deserve to lose your money.
Contactless is actually superconvenient, given a limit on the maximum amount for which it works. Over here that maximum is EUR 25, which allows you to be really fast for all small purchases (which are generally the purchases where that really matters).
I would support a system where you could authorize it to work for higher amounts at certain vendors (supermarkets, for instance).
where does the deranged anger come from? what you wrote does not contradict what i said
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Whether a cellular carrier charges extra to receive an SMS isn't a country-dependent thing. Or even carrier-dependent. It depends on which plan you have purchased.
Whether low-end cellular plans include charges for receiving is certainly country-dependent. They have been commonplace in the United States. In the United States, the tradition has been to offer plans that charge both the sender and the receiver. They have not been commonplace in European countries. In European countries, the tradition has been to offer plans that charge only the sender.
All major providers in the US (and probably all providers, even the minor ones, but I haven't actually looked) offer plans with unlimited SMS
Which then means you have to consider the cost of upgrading from your current plan to a plan with unlimited SMS. These plans cost plenty of extra dollars per month compared to an occasional-use pay-as-you-go plan only for urgent calls. If you use services with 2-factor authentication to make money, then perhaps unlimited SMS is worth $120 per year. And if you don't share a house with someone with a landline, then your landline-replacement plan may already include SMS. But for someone who mostly uses cellular to arrange an occasional ride and currently pays less than $10 per month to begin with, the cost of multiple incoming texts per day, one for each service that uses 2-factor authentication, can add up.
I'm hoping it will be faster eventually, but right now it is slowing things down (American perspective, for other countries this might not be the case).
Almost all of the terminals I see now have both a slot of swiping and for the chip. Except some stores require you to swipe, the chip part doesn't work yet. And some stores require you to use the chip if your card has it. So you never know which one to use.
With swiping, you can usually do it while the cashier is scanning your items, which means my wallet is already back in my pocket and I just have to sign when they are done scanning. With chip, you have to insert your card and leave it there until the transaction is complete. The processing time before the card has been accepted is also noticeably longer than when swiping.
Most importantly though, I have never actually been prompted for a PIN when using the chip. It's always chip and sign.
Indeed. When I had an ATM card cloned (I have no clue how), the criminal took the cloned card to one of the few ATMs in the area without a camera. They know where it's safe to use cloned cards, and where it isn't.
Karma: Poor (Mostly affected by lame karma-joke sigs)
Your in Europe, Aren't you? The spec the American card companies are using is SDA.
Will they still be using the card number as not all devices and pc's have a smart card reader on them.
They could have solved the whole thing using two factor with magstripe, pin plus second factor - could be an RSA token, Google Authenticator, or what have you. It would make pretty much all card fraud impossible.
Consumer fraud protection in the US means you're not liable if they copy down your details. And the companies seemingly would rather do it this way, it saves money in the end, even though any fraud that happens raises their clearing fees. Remember, there is nothing stopping US restaurants from bringing a portable transactor to your table. Those things read swipe cards and PIN cards just fine. So if they aren't doing it by choice, there could be a good reason.
It does reduce waiter back-and-forths, but is that really the limiting issue? The waiter bringing the reader and waiting while you use it increases waiter time spent which costs money.
If you want to go fast, ask your waiter to do the job fast. Otherwise, the restaurant can save money by having a pile of those little trays/folders and waiters picking up and running 3 at a time.
http://lkml.org/lkml/2005/8/20/95
I am not sure this is common but... My Visa provider, for internet purchases where I present the code on the rear of the card, as part of their validation,
intercepts my transaction and asks me a personal question. I have to respond with a matching answer. And if I do, the transaction is allowed to pass through to the rest of the validation routines (amount balance under limit, etc.). If validated, the vendor gets an approval. With some vendors, the transaction times out, but it works fine with other vendors.
Is my Visa provider unique, or is it uncommon practice.
Leslie Satenstein Montreal Quebec Canada
I completely disagree with the arguments prematurely concluding chip-based credit cards are insecure. For that matter any system is insecure if you consider a super strong adversary, there will be security problems in any system. Magnetic strip based credits cards should have been replaced long time ago! And, the chip-based cards are better and step in the right direction even without a user supplied pin. Why? 1. To the best of my knowledge, the chips themselves are tamper proof and its internal logic cannot be replicated easily -- very much so compared to magenetic strips. So you can't steal a card without "actually" and physically stealing the only card. This is much better as it is not hard for one to notice a lost card and immediately report it, making the stolen card invalid and useless. Note that it does not have any information to replicate or steal any identifiable information. 2. Chip's OTP based token transactions are much better than communicating the account number and password. Much of the burden on the POS system being secure is lifted any stored transaction information (which could potentially be stolen) is useless as the information can be used only for one-time use. And, the reference to Target breach seems to be inaccurate. It is true that a flaw in the backend enabled installing a malware on the POS systems, but the attack did rely on magnetic strip based credit cards and the POS systems had access to all the necessary account credentials for a future cardless transaction.
This isn't actually any different to chip & pin because there are numerous terminals which wont ask for a pin even if you insert the card for transactions under $100. If you paywave an over $100 transaction you will need to enter a pin
The fact that the cards still have a magstrip and numbers is not important. What the chip gives you is extra information.
If the credit card company sees that a purchase was made using the chip, they can be reasonably sure that whoever made that purchase was in physical access to the card.
If the credit card company sees that a purchase was made just using the printed info or the info on the mag strip, they know that people could have simply copied this information to make the purchase. At some point they may even refuse to accept those kinds of payments.
It is also probable that it will be common for consumers to own smart card readers to allow for safe online transactions. Even on a compromised computer, purchases will only be able to be made when the card is in the reader. This is analogous to giving your card to a waiter at a restaurant. They will only be able to charge the card when they are in physical possession of it. This is different than traditional cards where waiters can copy the information and make purchases in the future using that information.
The addition of a pin makes it hard for waiters and infected computers to make purchases even with physical access to the chip.
My fucking piece of shit bank had contactless cards that worked pretty good, and I was enjoying the future. Then they issued a new card with the moronic chip and took out the RFID.
Because it is a stupid technology that takes longer and offers nothing in return.
the rest will probably be coming soon
the changeover is industry wide
Probably not until they expire and are naturally replaced. I don't expect banks - especially smaller banks - to just dump cards; they'll just update them as part of their renewal cycle.
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
How does chip and pin work?
If you have to enter the data into the vendors system, it is not secure. You have to swipe the card. You have to use their equipment at their Point of Sale to enter the pin. So if they add software that stores the card data and stores the pin, the card has just been compromised. Perhaps the chip is harder to fake than a strip?
To really make this more secure, you should swipe the card/insert card to have chip read, and then receive an instant request from the bank, not the vendor, to approve the expense. This could be done with phone call, text message, email, or app push notification. Of course the vendor could wait for you to approve before letting you out of the store with their goods.
That way, the pin is never delivered to the vendor.
I am still waiting for photo recognition. If you buy something with a card, it should take a picture of your face and send that in with the transaction request. People will cry privacy, which is a silly argument. If you want privacy, pay with cash.