Slashdot Mirror
The Chip Card Transition In the US Has Been a Disaster (qz.com)
Ian Kar, writing for Quartz: Over the last year or so in the U.S., a lot of the plastic credit cards we carry around every day have been replaced by new one with chips embedded in them. The chips are supposed to make your credit and debit cards more secure -- a good thing! -- but there's one little secret no one wants to admit: The U.S.'s transition to chip cards has been an utter disaster. They're confusing to use, painstakingly slow, less secure than the alternatives, and aren't even the best solution for consumers. If you've shopped in a store and used a credit card, you've noticed the change. Retailers have likely asked you to insert the chip into the card reader, instead of swiping. But reading the chip seems to take much longer than just swiping. And on top of that, even though many retailers now have chip reading machines, some of them ask us just the opposite -- they say not to insert the card, and just swipe. It seems like there's no rhyme or reason to the whole thing.
You should never deny Slashdot the satisfaction of posting an over-the-top headline to attract CLICKZZZ!!
slashdot: A failed experiment.
America is a higher trust society than Europe (so the extra security wasn't cost-effective). I think it's because we all speak the same language and don't have to deal with gypsys here.
As a Canadian that recently moved the US, the system here is utterly ridiculous and broken. I never know when I should swipe vs insert the chip, I have never been asked for a pin, sometimes I have to sign and sometimes I don't (there doesn't seem to be a clear limit), and there's no tap-to-pay. It's that last part that was killer; I used tap-to-pay for 90% of purchases in Canada, with chip+pin being the remaining 10% of larger purchases like electronics.
There's also an obsession with literal cash, here. People see it as the default, whereas in Canada, cash tended to be a fall-back for most people.
It's truly bizarre. I find it much more annoying to pay for things here.
What people mean when they say worst of both worlds is that it does not solve the entirety of the problem where card present transactions are concerned and chip and pin easily could have.
Implementation issues aside the mechanical action of swipe is always going to be faster than insert, wait, remove; pretty much no matter how small you make the value of wait. That said plain text mag strips with no 'real' client authentication was not a realistic security model for 21st century.
Yes its beyond the reach of most attackers to clone a chip card. Stolen card is still a problem though. It might take me hours to notice my entire wallet is missing, could be a day or more before I realize a single credit card is gone AWOL. There is plenty of time for someone to run up a lot of charges there, and cause me a real headache even if I won't ultimately be liable. Chip + PIN would have made it nearly perfect. Sure steal the card from my back pocket, now what? Go get the account locked for exceeding the number of allowed invalid PIN entries?
As a consumer I am getting a lot of new inconvenience ( which I would have found acceptable otherwise ) for a far less than ideal security solution. I could probably bang in a 4, 5, or 6 digit PIN faster than scrawling something on those signature pads anyway.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
As I understand it, this is not the point of the chip and signature system. The point of the chip is to make it much much harder to clone the card. With the old non-chip system, all someone needs is your CC number. They can program that into the magnetic strip and start using it. Many places like fast food never even required signatures. Gas stations only required zip codes, and then only sometimes.
My biggest problem with chip and pin is that banks disclaim themselves of all liability for transactions that go through with a valid PIN, as they feel the chip is secure enough to prove that the card must have been real and if the pin was used, that's because you intended to do it. Nevermind that cards can still be cloned and pin numbers skimmed. This is also a problem if someone steels your card and knows your pin, you're on the hook for everything. Happened to a guy here in Canada when his ex girlfriend stole his card. Back when they were dating he shared his pin with her (big mistake... but what about marriages that end in divorce?).
What is needed is decent 2 factor authentication.
Isn't that what chip and PIN was supposed to bring us? Something you have (the card) and something you know (the PIN)?
Why the hell did the U.S. adopt chip and signature? I was excited for my new chip and PIN credit card until I realized it was chip and signature.
Not when both accounts are linked to one card.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
You're technically in violation of your card's terms of service. A while back the post office was refusing to accept these cards (they likely still do).