Hacker News Reader

Comment by dlubarov | Hacker News Reader

On the bright side, this only affects offline PIN verification. Cards which are configured to require online PIN verification should be more secure. They will send a (triple DES encrypted) PIN block to the terminal, which sends it to the issuer, which decrypts and verifies it.

View on HN

Yes. Most new-ish deployments of chip-and-PIN using online PIN verification, such as Germany, Switzerland, Australia, and the U.S.

Isn't the US chip-and-signature?

This the only implementation I've encountered in real-life, so far.

It's complicated. U.S. EMV credit is (virtually) all chip and signature. Debit is split between PIN and signature. US Debit Common AID is Online PIN, but you can legally do PIN bypass ("no cvm") or even fall back (or have user select) the card brand's application on the card (instead of the US Debit Common AID), in which case for Visa it will be signature and for Mastercard it will be online PIN. Politics and posturing.

I have a few chip and pin cards and one chip and signature.

We are heading there, but very slowly.

I've only ever seen one merchant (Target) that requires the chip. Every other store is still using the mag stripe. In fact, while travelling this weekend, I used my card in a dozen new stores. But none used the chip.

in my experience, Walgreens, Home Depot and Walmart all require the chip when it is present now. At least with AMEX cards.

Reply on news.ycombinator.com